A NetworkPolicy does two things. Its podSelector chooses Pods in its namespace. Its rules say what those Pods may receive and send. The moment a Pod is selected by any policy, everything not listed is refused.

Refuse everything

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny
  namespace: abyss
spec:
  podSelector: {}
  policyTypes: [Ingress]

podSelector: {} selects every Pod in the namespace. policyTypes: [Ingress] says this policy is about incoming connections. There is no ingress: list, so no incoming connection is allowed.

kubectl exec client -n abyss -- wget -qO- -T 1 market-web

wget: download timed out

Blocked traffic does not get a refusal; packets are dropped, and the client waits until its timeout. That is the signature of a NetworkPolicy, as opposed to a wrong port.

Policies add up

There is no deny rule. Every policy lists allowances, and a connection passes if any policy that selects the target allows it. That is why default deny comes first: it sets the floor, and each later policy opens one door.

Reading it

kubectl get networkpolicies -n abyss
kubectl describe netpol default-deny -n abyss

Spec:
  PodSelector:     <none> (Allowing the specific traffic to all pods in this namespace)
  Allowing ingress traffic:
    <none> (Selected pods are isolated for ingress connectivity)
  Not affecting egress traffic
  Policy Types: Ingress