I try to create a situation which is shown in the picture.

kubectl run frontend --image=nginx --labels="app=frontend" --port=30081 --expose
kubectl run backend --image=nginx --labels="app=backend" --port=30082 --expose
kubectl run database --image=nginx --labels="app=database" --port=30082

I created network policy which should block all ingress and egress access which do not have specific label definition.

kind: NetworkPolicy
apiVersion: networking.k8s.io/v1
metadata:
  name: access-nginx
spec:
  podSelector:
    matchLabels:
     app: frontend
    matchLabels:
      app: backend
    matchLabels:
      app: database
  policyTypes:
  - Ingress
  - Egress
  ingress:
  - from:
    - podSelector:
        matchLabels:
          app: frontend
        matchLabels:
          app: backend
        matchLabels:
          app: database
  egress:
  - to
    - podSelector:
        matchLabels:
          app: frontend
        matchLabels:
          app: backend
        matchLabels:
          app: database
  - ports:
    - port: 53
      protocol: UDP
    - port: 53
      protocol: TCP

I tried to connect to pod frontend without label(command 1) and with correct label(command 2) as is shown below.

• kubectl run busybox --image=busybox --rm -it --restart=Never -- wget -O- http://frontend:30081 --timeout 2
• kubectl run busybox --image=busybox --rm -it --restart=Never --labels=app=frontend -- wget -O- http://frontend:30081 --timeout 2

I expected that first command which do not use label will be blocked and second command will allow communication but after pressed the second command i see output "wget: can't connect to remote host (10.109.223.254): Connection refused". Did I define network policy incorrectly?