NetworkPolicy

The first policy below allows incoming TCP traffic on port 80 to any pod with the label run: np-test-1 from all sources. The second policy restricts egress from pods labeled name: internal to only MySQL (port 3306) and Payroll (port 8080) pods.

# allow incoming traffic to pod "run: np-test-1" to port 80 from everywhere

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: ingress-to-nptest
  namespace: default
spec:
  podSelector:
    matchLabels:
      run: np-test-1
  policyTypes:
  - Ingress
  ingress:
  - from:
    ports:
    - protocol: TCP
      port: 80


cat  policy.yaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: internal-policy
  namespace: default
spec:
  podSelector:
    matchLabels:
      name: internal
  policyTypes:
  - Egress
  egress:
  # MySQL rule
  - to:
    - podSelector:
        matchLabels:
          name: mysql
    ports:
    - protocol: TCP
      port: 3306
  # Payroll rule
  - to:
    - podSelector:
        matchLabels:
          name: payroll
    ports:
    - protocol: TCP
      port: 8080