Kubernetes-其他Pod的入口网络策略

Question

I have 2 servcies running in same namespace. Both are working fine as expected. Now, trying to connect serviceB( Label is app: serviceB ) from serviceA( Label is app: serviceA ). Hence, added ingress policy in serviceB as follows to allow traffic from serviceA.

apiVersion: extensions/v1beta1 
kind: NetworkPolicy 
  metadata:   
     name: serviceA-whitelist 
  spec:  
   podSelector:
     matchLabels:
       app: serviceB   
   ingress:
   - from:
     - podSelector:
         matchLabels:
           app: serviceA

Still, it is not working. I tried, log into serviceA as,

kubectl exec -it serviceA-podname bash

NC Command

nc -v -w 2 serviceB 8444

Getting connection timeout.

Am i missing anything?

Answer 1

As itaysk wrote, all traffic should be allowed by default except for created rule to deny all by default. The problem was with egress traffic: ingress was allowed and egress was denied. After adding the rule to egress, all was stabilized.

Answer 2

It started working fine after adding the egress policy with the source.

apiVersion: extensions/v1beta1 
kind: NetworkPolicy 
  metadata:   
     name: serviceB-egress-policy
  spec:  
   podSelector:
     matchLabels:
       app: serviceA   
   egress:
   - to:
     - podSelector:
         matchLabels:
           app: serviceB