kubernetes networkpolicy namespaceSelector select when namespace has no labels

Question

I am trying to add a calico network policy to allow my namespace to talk to kube-system namespace. But in my k8s cluster kube-system has no labels attached to it, so I am not able to select pods in there. Below is what I tried but its not working.

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-kube-system
  namespace: advanced-policy-demo
spec:
  podSelector: {}       # select all pods in current namespace.
  policyTypes:
  - Ingress
  - Egress
  ingress:
  - from:
    - namespaceSelector:
        matchLabels: {}
      podSelector:
        matchLabels:
          tier: control-plane
  egress:
  - to:
    - namespaceSelector:
        matchLabels: {}
      podSelector:
        matchLabels:
          tier: control-plane

$ kubectl describe ns kube-system
Name:         kube-system
Labels:       <none>
Annotations:  <none>
Status:       Active

No resource quota.

No resource limits.

I there a way by which I can select a namespace by its name only?

Schreck

Answer 1

What prevents you from creating a new labels for this namespace ?, like this:

kubectl label ns/kube-system calico=enabled

Depredate

for me: ignorance ... not even realised I could label a namespace but hey, now I know! – Lamoureux

Answer 2

Kubernetes has introduced an immutable label for namespace: kubernetes.io/metadata.name, you can use that instead in network policies.

Reference: https://kubernetes.io/docs/concepts/services-networking/network-policies/#targeting-a-namespace-by-its-name

Lucilelucilia

Answer 3

They specifically call that out as a limitation and @Nepomucen has the correct work around solution.

"Targeting of namespaces or services by name (you can, however, target pods or namespaces by their labels, which is often a viable workaround)."

Ref: https://kubernetes.io/docs/concepts/services-networking/network-policies/#what-you-can-t-do-with-network-policy-s-at-least-not-yet

Illfated