Before anything changes, confirm the web tier answers:
sh
kubectl exec client -n abyss-1f0iqz6 -- wget -qO- -T 1 market-webClose the namespace for incoming traffic:
sh
kubectl apply -n abyss-1f0iqz6 -f - <<EOF
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: default-deny
spec:
podSelector: {}
policyTypes: [Ingress]
EOF
kubectl exec client -n abyss-1f0iqz6 -- wget -qO- -T 1 market-web
kubectl exec client -n abyss-1f0iqz6 -- nc -zv -w 1 market-db 5432
kubectl describe netpol default-deny -n abyss-1f0iqz6The outsider Pod in other-1f0iqz6 is selected by nothing. Check that it can still be reached from client:
sh
kubectl exec client -n abyss-1f0iqz6 -- nc -zv -w 1 outsider-svc.other-1f0iqz6 80