Issue with k8s.io/docs/concepts/services-networking/network-policies/

[EricBuist]

The page is not covering a pretty common case of targeting multiple namespaces by name. I need an egress policy allowing to send to pods in two namespaces, cannot find any way of doing it, will have to search on Google and hit tons of StackOverflow posts suggesting random solutions that may or may not work. I don't have enough privileges on the Kubernetes cluster to add labels to namespaces in order to search by label. This could be a lack of flexibility of network policies, or something missing from the documentation.

[mengjiao-liu]

/language en

[k8s-ci-robot]

@mengjiao-liu: The label(s) kind/, kind/network cannot be applied, because the repository doesn't have them.

In response to this:

/kind network
/language en

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[mengjiao-liu]

/sig network

[tengqm]

/triage accepted
/kind feature

[mrgiles]

/assign

[mrgiles]

Hello, @EricBuist. unfortunately, it is not possible to directly specify the names of the namespaces in a NetworkPolicy. You must use a namespaceSelector with matchLabels or matchExpressions to select the namespaces based on their labels.

Here is an example using labels:

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: my-network-policy
spec:
  podSelector:
    matchLabels:
      app: my-app
  policyTypes:
  - Egress
  egress:
  - to:
    - namespaceSelector:
        matchLabels:
          namespace: namespace-1
    - namespaceSelector:
        matchLabels:
          namespace: namespace-2

You will have to find somebody in your organization with enough privileges to add the labels for you, if you don't have access to do it yourself.

Thanks!

FYI: @tengqm

[tengqm]

It would be desirable to incorporate comments by @mrgiles in the docs, considering that others may have the same questions.