I have installed Calico on EKS from [here](https://raw.githubusercontent.com/aws/amazon-vpc-cni-k8s/master/config/v1.6/calico.yaml).

I have two namespaces, foo and bar, both labeled with a label 'purpose', and containing one app pod each.

When I import the following Ingress-only policy into the foo namespace, it works exactly as expected; other test pods can not connect to foo-app, but bar-app can.

```
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: foo
  namespace: foo
spec:
  podSelector:
    matchLabels:
      app: foo-app
  policyTypes:
  - Ingress
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          purpose: bar
  - from:
    - ipBlock:
        cidr: 0.0.0.0/0
    ports:
    - protocol: TCP
      port: 53
    - protocol: UDP
      port: 53

```

However when I import a policy containing both ingress and egress rules it completely shuts off networking to the pod. I can no longer even ping the foo-app pod IP from bar-app.

```
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: foo
  namespace: foo
spec:
  podSelector:
    matchLabels:
      app: foo-app
  policyTypes:
  - Ingress
  - Egress
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          purpose: bar
  - from:
    - ipBlock:
        cidr: 0.0.0.0/0
    ports:
    - protocol: TCP
      port: 53
    - protocol: UDP
      port: 53
  egress:
  - to:
    - namespaceSelector:
        matchLabels:
          purpose: bar
  - to:
    - ipBlock:
        cidr: 0.0.0.0/0
    ports:
    - protocol: TCP
      port: 53
    - protocol: UDP
      port: 53

```

After removing and systematically re-adding parts of the policy, it is definitely the addition of the `namespaceSelector` entry in the egress that breaks it.

There are no other network policies on the cluster.

If there is not a directly obvious reason as to why this is happening; other than trawling through netfilter rules on worker nodes: Is there any efficient way to debug this?