My setup: Running EKS 1.14 with Calico and Istio 1.5.

Trying to get the sample bookinfo to run with specific NetworkPolicies.

I've applied a GlobalNetworkPolicy that denies all traffic:

apiVersion: projectcalico.org/v3
kind: GlobalNetworkPolicy
metadata:
  name: default-deny
spec:
  selector: all()
  types:
  - Ingress
  - Egress

I also added a GlobalNetworkPolicy for Istio to namespace and intra-namespace traffic:

apiVersion: projectcalico.org/v3
kind: GlobalNetworkPolicy
metadata:
  name: allow-istio-system-to-ns
spec:
  selector: all()
  namespaceSelector: istio-injection == 'enabled'
  types:
  - Ingress
  - Egress
  ingress:
  - action: Allow
    source:
      selector: all()
      namespaceSelector: projectcalico.org/namespace == 'istio-system'
  - action: Allow
    source:
      selector: all()
      namespaceSelector: istio-injection == 'enabled'
  egress:
  - action: Allow

and a NetworkPolicy allowing all ingress and egress on istio-system

apiVersion: projectcalico.org/v3
kind: NetworkPolicy
metadata:
  name: allow-istio-system-all
  namespace: istio-system
spec:
  selector: all()
  types:
  - Ingress
  - Egress
  ingress:
  - action: Allow 
  egress:
  - action: Allow

And a NetworkPolicy to allow traffic to the ingress-gateway on ports 80 and 443. I know this one is redundant, but I was hoping to cut down the previous one to only necessary ingress.

apiVersion: projectcalico.org/v3
kind: NetworkPolicy
metadata:
  name: allow-istio-ingress-on-80-443
  namespace: istio-system
spec:
  selector: app == 'istio-ingressgateway'
  ingress:
    - action: Allow
      protocol: TCP
      destination:
        ports:
          - 80
          - 443

Also some other, unrelated NetworkPolicies (access to kube-dns, metrics-server). Deploying bookinfo works with and without the policies and same with deploying the Gateway.

The connection between the components works (I can exec into one pod and connect to the others). But when I try to access the productpage via the gateway with the policies I get nothing back, instead of the HTML I get without the policies.

Am I missing some traffic that should be allowed? Should I have policies for the master nodes or for the loadbalancer somewhere else?

Edit: If I allow all ingress into istio-system and into the namespace, it works. So I think I'm just missing some other ingress from the namespace, is there a way to limit it to just the loadbalancer?