title: how to deny egress to all namespaces, and allow ingress from some namespaces in kubernetes using network policies
body: <p>Context: I am using EKS with calico plugin for network policies, and a managed node group.</p>
  <p>I have a namespace called &quot;simon-test&quot; in which I want to deny all egress from the namespace to others (so pods in simon-test will not be able to see other pods in other namespaces). I tried to do this using the following network policy (which seems to work as expected):</p>
  <pre><code>kind: NetworkPolicy
  apiVersion: networking.k8s.io/v1
  metadata:
    name: default-deny-all-egress
    namespace: simon-test
  spec:
    policyTypes:
    - Egress
    podSelector: {}
    egress: []
  </code></pre>
  <p>but this also blocked all the internal networking within the namespace. So in order to fix this, I created another network policy that is supposed to allow all traffic within the namespace:</p>
  <pre><code>kind: NetworkPolicy
  apiVersion: networking.k8s.io/v1
  metadata:
    name: allow-internal
    namespace: simon-test
  spec:
    podSelector:
      matchLabels: {}
    ingress:
    - from:
      - namespaceSelector:
          matchLabels:
            name: simon-test
  </code></pre>
  <p>But this doesn't solve the problem, as there is still no networking within the namespace.
  I am curious why I can still reach &quot;simon-test&quot; from another pod in another namespace though (I am running <code>nc -nlvp 9999</code> in a pod in &quot;simon-test&quot; and <code>nc -z ip-of-pod-in-simon-test-ns 9999</code> from a pod from another namespace and it can reach it, but when pinging the pod from within simon-test it can't.)</p>