I want to deny all egress traffic . So I created this network policy
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: default-deny
spec:
podSelector: {}
policyTypes:
- Egress
And then i applied it to namespace
kubectl -n pps-api-gateway-ci apply -f ~/Documents/networkpolicy.yaml
to test this , I did describe networkpolicy
kubectl -n pps-api-gateway-ci describe networkpolicy
Name: default-deny
Namespace: pps-api-gateway-ci
Created on: 2018-05-29 13:50:52 -0700 PDT
Labels: <none>
Annotations: kubectl.kubernetes.io/last-applied-configuration=
{"apiVersion":"networking.k8s.io/v1","kind":"NetworkPolicy","metadata":
{"annotations":{},"name":"default-deny","namespace":"pps-api-gateway-
ci"},"spec"...
Spec:
PodSelector: <none> (Allowing the specific traffic to all pods in this
namespace)
Allowing ingress traffic:
<none> (Selected pods are isolated for ingress connectivity)
Allowing egress traffic:
<none> (Selected pods are isolated for egress connectivity)
Policy Types: Egressthen i logged into that container
ping www.google.com
PING www.google.com (216.58.217.100): 56 data bytes
64 bytes from 216.58.217.100: icmp_seq=0 ttl=46 time=2.552 ms
64 bytes from 216.58.217.100: icmp_seq=1 ttl=46 time=1.835 ms
64 bytes from 216.58.217.100: icmp_seq=2 ttl=46 time=1.487 ms
64 bytes from 216.58.217.100: icmp_seq=3 ttl=46 time=2.523 ms
64 bytes from 216.58.217.100: icmp_seq=4 ttl=46 time=1.607 ms
64 bytes from 216.58.217.100: icmp_seq=5 ttl=46 time=1.480 msI should not be able to ping if my egress policy is applied.
I am working with kubernetes 1.9.6 version
From the official documentation:
Network policies are implemented by the network plugin, so you must be using a networking solution which supports NetworkPolicy - simply creating the resource without a controller to implement it will have no effect.
A number of networking plugins, including Calico and Weave Net, support using Network Policies, but Flannel, for example, doesn’t.