I am setting up Network Policy in k8s, but it does not work as my expectation.

My k8s has network policy enabled. It has to namespaces:

- proxy
- jupyter

Under namespace jupyter, it has lots of jupyter pods, and each jupyter pod has a service for it to provide cluster IP. Under namespace proxy, I have a node-proxy forwarding requests to each jupyter. The structure is like this:

- namespace proxy
   - pod node-proxy
- namespace jupyter
   - service a
   - pod a
   - service b
   - pod b
   - ...

I create a network policy like this:

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny
  namespace: jupyter
spec:
  podSelector: {}
  policyTypes:
  - Egress
  - Ingress
  Ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          ns: proxy
    ports:
    - protocol: TCP
      port: 8888

I want every jupyter pod can only be accessed by node-proxy. But when I enable above yaml file, node-proxy cannot access jupyter. Anything wrong?