unable to connect internet from pod after applying egress network policy in GKE

Question

I have a pod ( kubectl run app1 --image tomcat:7.0-slim ) in GKE after applying the egress network policy apt-get update command unable to connect internet.

Before applying policy:

After applying policy:

This is the policy applied:

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: app2-np
  namespace: default
spec:
  podSelector:
    matchLabels:
      name: app2
  policyTypes:
  - Egress
  - Ingress
  ingress:
  - {}
  egress:
  - to:
    - podSelector:
        matchLabels:
          name: app3
    ports:
    - port: 8080

  - ports:
    - port: 80
    - port: 53
    - port: 443

The Here am able to connect 8080 port of app3 pod in same namespace. Please help in correcting my netpol.

Answer 1

It happens because you are defining the egress rule only for app3 on port 8080, and it will block all internet connect attempts.

If you need to use access internet from some of your pods, you can tag them and create a NetworkPOlicy to permit the internet access.

In the example below, the pods with the tag networking/allow-internet-egress: "true" will be able to reach the internet:

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: internet-egress
spec:
  podSelector:
    matchLabels:
      networking/allow-internet-egress: "true"
  egress:
  - {}
  policyTypes:
  - Egress

Another option is allow by ip blocks, in the example below, a rule will allow the internet access ( 0.0.0.0 ) except for the ipBlocks 10.0.0.0/8

kind: NetworkPolicy
apiVersion: networking.k8s.io/v1
metadata:
  name: allow-internet-only
spec:
  podSelector: {}
  policyTypes:
    - Egress
  egress:
    - to:
      - ipBlock:
        cidr: 0.0.0.0/0
          except:
            - 10.0.0.0/8

Finally, in this site you can visualize your NetworkPolices in a good way to understand what is the exact behaviour.

References:

https://www.stackrox.com/post/2020/01/kubernetes-egress-network-policies/

Kubernets networkpolicy allow external traffic to internet only