Network policy for Egress with matchExpressions not working

General Discussions
1

I am trying to prevent shared namespace accessing to the ingress namespace and using the below networking policy which is not working as expected. The pods in the shared namespace still can connect to the ingress service. Am I using it wrongly?

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: disallow-ingress-egress-policy
  namespace: shared
spec:
  podSelector: {}
  egress:
  - to:
    - ipBlock:
        cidr: 0.0.0.0/0
  - to:
    - namespaceSelector:
        matchExpressions:
        - key: namespace
          operator: NotIn
          values: ["ingress"]
  policyTypes:
  - Egress

Cluster information:

Kubernetes version: 1.29
Cloud being used: eks
CNI and version: vpc-cni

2

Are you sure your namespace ‘ingress’ has a label named ‘namespace’?

3

Yes, it has.

$ kubectl get ns -l namespace=ingress
NAME              STATUS   AGE
ingress  Active   501d