Score:0

Allowing going trafic with Egress and Denying it with Ingress in NetworkPolicy in Kubernetes

nl flag

I hope you're all doing well and being safe.

I have two pods A and B in two different namespaces. I wish that pod A in namespace-a has access to every pod on other namespaces so I ve deployed this NetPol from the Kubernetes documentation :

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow_egress
  namespace: namespace-a
spec:
  podSelector:
    matchLabels:
      app: a
  egress:
  - to:
    - namespaceSelector: {}
  policyTypes:
  - Egress

Now for pod B, the wish is to have it recieve traffic from only the namespace in which he is deployed and so I used from the same documentation:

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: deny-ingress
  namespace: namespace-b
spec:
  podSelector: 
    matchLabels:
      app: b
  ingress:
  - from:
    - podSelector: {}
  policyTypes:
  - Ingress

Using this configuration, I still can access the service exposing pod B from pod A. Even though I have specified in the second NetworkPolicy that pod B shouldn't be accepting traffic only from other pods in the same namespace.

Bare in mind that I am trying to simulate two teams that do not know about each other developments, so the team working in pod B don't know what's written by the team in pod A. Is there something I am missing?

Thank you!

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.