<p>I am implementing kubernetes network policy for my app on K3s. I want to allow <code>egress</code> (external call to internet from pod) for port <code>443</code> i.e. <code>https</code> calls <em><strong>only</strong></em> and deny/block all egress calls on <code>80</code> port i.e. <code>http</code>. In short, allow <code>https</code> egress calls and deny <code>http</code> egress calls.<br/>
I am testing this with below <code>custom-dns.yaml</code> file:</p>
<pre><code>apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: foo-deny-egress
spec:
  podSelector:
    matchLabels:
      app: foo
  policyTypes:
  - Egress
  egress:
  # allow DNS resolution
  - ports:
    - port: 443
      protocol: UDP
    - port: 443
      protocol: TCP
</code></pre>
<p>After <code>kubectl apply -f custom-dns.yaml</code> I create and login to pod :<code>kubectl run --restart=Never pod-v1 --image=busybox -i -t -l app=foo</code> and test the http and https url by command:</p>
<ol>
<li><code>wget https://www.google.com</code></li>
<li><code>wget http://drive.google.com/drive/u/0/my-drive</code> <br/><br/></li>
</ol>
<p>Both the wget commands are giving <code>wget: bad address</code> error. <br/><br/>
But when I do not apply this network policy, the same wget commands are working &amp; giving below result from same pod:<br/>
<strong>i.</strong></p>
<pre><code>        wget https://www.google.com
        Connecting to www.google.com (172.217.167.164:443)
        wget: note: TLS certificate validation not implemented
        saving to 'index.html'
        index.html           100% |******************************************************| 15264  0:00:00 ETA
       'index.html' saved
</code></pre>
<p><strong>ii.</strong></p>
<pre><code>wget http://drive.google.com/drive/u/0/my-drive
Connecting to drive.google.com (142.250.192.46:80)
Connecting to drive.google.com (142.250.192.46:443)
wget: note: TLS certificate validation not implemented
Connecting to accounts.google.com (142.250.192.77:443)
saving to 'my-drive'
my-drive             100% |******************************************************| 92019  0:00:00 ETA
'my-drive' saved
</code></pre>
<p><strong>iii.</strong> <code>Telnet</code> to google.com IP <code>172.217.167.164</code> with <code>80</code> &amp; <code>443</code> port happening</p>
<pre><code>#telnet 172.217.166.164 80
Connected to 172.217.166.164
^]q
# telnet 172.217.166.164 443
Connected to 172.217.166.164
^]
</code></pre>
<p><strong>iv.</strong> Similarly <code>Telnet</code> to drive.com IP <code>142.250.192.46</code> with <code>80</code> &amp; <code>443</code> port happening</p>
<p>What am I missing here ?</p>

<ul>
<li><p>networkPolicy you have mentioned in the post just allows https/traffic on 443 but you have not mentioned anything in it to deny http(port 80) traffic.</p>
</li>
<li><p>There are two ways to achieve it :</p>
<ul>
<li>Setup a default deny policy for egress</li>
</ul>
<p>either</p>
<ul>
<li>create another egress policy where you deny egress on port 80</li>
</ul>
</li>
</ul>
