Build a valid networking.k8s.io/v1 NetworkPolicy without writing YAML by hand. Pick the pods it targets, add Ingress and Egress rules with any combination of podSelector, namespaceSelector, and ipBlock (with optional except:) peers, name TCP/UDP/SCTP ports, and see exactly what the resulting policyTypes semantics mean — including the classic "add an empty ruleset to get default-deny" trick.
policyTypes is what actually flips a direction into deny-by-default. Listing Egress here with no egress rules blocks all outbound traffic for the selected pods; omitting the direction (or leaving policyTypes empty) leaves that direction unaffected.
Deny-all-ingress in a namespace: empty podSelector: {}, policyTypes: [Ingress], no ingress: array.
Allow-all-ingress: empty podSelector: {}, policyTypes: [Ingress], one rule with from: [] (matches every peer) — or just {} as the rule.
ipBlock is namespace-scoped: the except: CIDRs must be inside the cidr:. Pod IPs are cluster-internal, so a 0.0.0.0/0 peer still covers other pods too — combine with a namespaceSelector/podSelector peer when you want on top of cluster traffic.
Peer semantics: inside one from/to element, podSelector AND namespaceSelector are AND-ed. Separate list entries are OR-ed. Ports work the same way: one entry = one (protocol, port) pair, listed entries are OR-ed.