# In k3s how to whitelist specific namespaces to work with traefik?

**URL:** <https://community.traefik.io/t/in-k3s-how-to-whitelist-specific-namespaces-to-work-with-traefik/29962>\
**Category:** Traefik v3 (latest)\
**Tags:** kubernetes-ingress\
**Created:** [July 4, 2026, 9:30am UTC](https://community.traefik.io/t/in-k3s-how-to-whitelist-specific-namespaces-to-work-with-traefik/29962 "2026-07-04T09:30:07Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![SpiderUnderUrBed](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/spiderunderurbed/32/10282_2.png) [@SpiderUnderUrBed](https://community.traefik.io/u/SpiderUnderUrBed)\
**Post date:** [July 4, 2026, 9:30am UTC](https://community.traefik.io/t/in-k3s-how-to-whitelist-specific-namespaces-to-work-with-traefik/29962/1 "2026-07-04T09:30:07Z")

</div>

In k3s how to whitelist specific namespaces to work with traefik? There is an allowCrossNamespace option for traefik, somewhere, helm or just in its plain setup, and I had to have enabled it because there was the UI for one of my services in a different namespace (longhorn), but I dont like the idea of it being open for all namespaces, also that might get messy with multiple ingresses for the future, so is there a way to whitelist specific namepsaces to work cross-namespace?

---

<div class="post-metadata">

**Author:** ![jcabrerazuniga](https://avatars.discourse-cdn.com/v4/letter/j/bc8723/32.png) [@jcabrerazuniga](https://community.traefik.io/u/jcabrerazuniga)\
**Post date:** [August 17, 2026, 7:30pm UTC](https://community.traefik.io/t/in-k3s-how-to-whitelist-specific-namespaces-to-work-with-traefik/29962/2 "2026-08-17T19:30:00Z")

</div>

I will suggest you to look for k3s network policies. I found the next example code in the net:

```auto
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: isolate-and-allow-db-system
  namespace: your-target-namespace
spec:
  podSelector: {} # Selects all pods in this namespace
  policyTypes:
    - Egress
  egress:
    # 1. Allow communication with kube-system (for CoreDNS, etc.)
    - to:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: kube-system
    
    # 2. Allow DNS traffic (UDP/TCP Port 53) for kube-system (if CoreDNS runs there)
    - ports:
        - protocol: UDP
          port: 53
        - protocol: TCP
          port: 53

    # 3. Allow traffic to your External Database IP
    - to:
        - ipBlock:
            cidr: 203.0.113.50/32 # REPLACE with your actual external database IP/CIDR

```

Hope this helps