In short, the pod can only access the host it is on.
I have a k8s-1.15 cluster with 3 nodes and Calico plugin:
There are 2 pods, pod-1 running on master(1.137), and pod-2 running on node1(1.138), when I ping 192.168.1.138 from pod-1(running on 1.137), I got:
[~pod-1] # ping 192.168.1.138
PING 192.168.1.138 (192.168.1.138): 56 data bytesbut if I ping the 1.137 from pod-1(running on 1.137), it succeeded:
[~pod-1] # ping 192.168.1.137
PING 192.168.1.137 (192.168.1.137): 56 data bytes
64 bytes from 192.168.1.137: seq=0 ttl=64 time=0.089 ms
64 bytes from 192.168.1.137: seq=1 ttl=64 time=0.094 msHow should I solve it?
Your question is answered in Issue #2543
this looks to be working as expected, since your network policy doesn't have any egress rules.
If you want to deny egress from pod A, you can add the following section to the NetworkPolicy:
types: - Ingress - EgressThis will tell the policy to apply to both ingress and egress traffic, and all egress from pod A will be denied unless you specify egress rules.
Alternatively, you can create an ingress policy which selects pod B in order to prevent pod A from accessing it.
You can use calicoctl profile to edit the default policy that forbids inbound traffic
calico profile {{ profile_name }} rule add inbound allow from <ip>