Struggling with Network Policy

General Discussions
1

Hello,

I’m struggling with a NetworkPolicy.

I’ve a namespace in which I’ve an application that need to be accessed from outside (ingress) of the cluster and access others servers (egress).

Here is my config file :

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: np-X
  namespace: ns-X
spec:
  podSelector:
    matchLabels:
  egress:
  - to:
    - ipBlock:
        cidr: A.B.C.D/32
    - ipBlock:
        cidr: E.F.G.H/32
  ingress:
  - from: []

So for me : everything in Ingress is accepted for all pods in the namespace and only egress to the specifcs ipBlocks are accepted.

Am I wrong or not ?

Regards

2

You can use something like this

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: internal-policy
  namespace: default
spec:
  podSelector:
    matchLabels:
      name: internal
  policyTypes:
  - Egress
  - Ingress
  ingress:
    - {}
  egress:
  - to:
    - podSelector:
        matchLabels:
          name: mysql
    ports:
    - protocol: TCP
      port: 3306

  - to:
    - podSelector:
        matchLabels:
          name: payroll
    ports:
    - protocol: TCP
      port: 8080
 
  - ports:
    - port: 53
      protocol: UDP
    - port: 53
      protocol: TCP
2 Likes
3

Please refer official document to debug