<p>Im trying to implement network policy in my kubernetes cluster to isolate my pods in a namespace but still allow them to access the internet since im using Azure MFA for authentication.  </p>

<p>This is what i tried but cant seem to get it working. Ingress is working as expected but these policies blocks all egress. </p>

<pre><code>
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-all
spec:
  podSelector: {}
  policyTypes:
  - Ingress 
</code></pre>

<pre><code>kind: NetworkPolicy
apiVersion: networking.k8s.io/v1
metadata:
  name: grafana-policy
  namespace: default
spec:
  podSelector:
    matchLabels: 
      app: grafana
  ingress:
  - from:
    - podSelector:
       matchLabels: 
        app: nginx-ingress

</code></pre>

<p>Anybody who can tell me how i make above configuration work so i will also allow internet traffic but blocking traffic to other POD's?</p>

<p>Try adding a default deny all network policy on the namespace:</p>
<pre><code>kind: NetworkPolicy
apiVersion: networking.k8s.io/v1
metadata:
  name: default-deny-all
spec:
  podSelector: {}
  policyTypes:
    - Ingress
    - Egress
</code></pre>
<p>Then adding an allow Internet policy after:</p>
<pre><code>kind: NetworkPolicy
apiVersion: networking.k8s.io/v1
metadata:
  name: allow-internet-only
spec:
  podSelector: {}
  policyTypes:
  - Egress
  egress:
  - to:
    - ipBlock:
        cidr: 0.0.0.0/0
        except:
        - 10.0.0.0/8
        - 192.168.0.0/16
        - 172.16.0.0/20
</code></pre>
<p>This will block all traffic except for internet outbound.
In the <code>allow-internet-only</code> policy, there is an exception for all private IPs <em>which will prevent pod to pod communication.</em></p>
<p>You will also have to allow Egress to Core DNS from <code>kube-system</code> if you require DNS lookups, as the <code>default-deny-all</code> policy will block DNS queries.</p>
