<p>Init container with <code>kubectl get pod</code> command is used to get ready status of other pod.</p>

<p>After Egress NetworkPolicy was turned on init container can't access Kubernetes API: <code>Unable to connect to the server: dial tcp 10.96.0.1:443: i/o timeout</code>. CNI is Calico.</p>

<p>Several rules were tried but none of them are working (service and master host IPs, different CIDR masks):</p>

<pre><code>...
  egress:
  - to:
    - ipBlock:
        cidr: 10.96.0.1/32
    ports:
    - protocol: TCP
      port: 443
...
</code></pre>

<p>or using namespace (default and kube-system namespaces):</p>

<pre><code>...
  egress:
  - to:
    - namespaceSelector:
        matchLabels:
          name: default
    ports:
    - protocol: TCP
      port: 443
...
</code></pre>

<p>Looks like <code>ipBlock</code> rules just don't work and namespace rules don't work because kubernetes api is non-standard pod.</p>

<p>Can it be configured? Kubernetes is 1.9.5, Calico is 3.1.1.</p>

<p>Problem still exists with GKE 1.13.7-gke.8 and calico 3.2.7</p>

<p>You need to get the real ip of the master using <code>kubectl get endpoints --namespace default kubernetes</code> and make an egress policy to allow that.</p>
<pre><code>---
kind: NetworkPolicy
apiVersion: networking.k8s.io/v1 
metadata:
  name: allow-apiserver
  namespace: test
spec:
  policyTypes:
  - Egress
  podSelector: {}
  egress:
  - ports:
    - port: 443
      protocol: TCP
    to:
    - ipBlock:
        cidr: x.x.x.x/32
</code></pre>
