<p>I have a Kubernetes cluster running on Google Kubernetes Engine (GKE) with network policy support enabled.
I created an nginx deployment and load balancer for it:</p>

<pre><code>kubectl run nginx --image=nginx
kubectl expose deployment nginx --port=80 --type=LoadBalancer
</code></pre>

<p>Then I created this network policy to make sure other pods in the cluster won't be able to connect to it anymore:</p>

<pre><code>kind: NetworkPolicy
apiVersion: networking.k8s.io/v1
metadata:
  name: access-nginx
spec:
  podSelector:
    matchLabels:
      run: nginx
  ingress:
  - from:
      - namespaceSelector:
          matchLabels:
            name: kube-system
    ports:
    - protocol: TCP
      port: 80
</code></pre>

<p>Now other pods in my cluster can't reach it (as intended):</p>

<pre><code>kubectl run busybox --rm -ti --image=busybox /bin/sh
If you don't see a command prompt, try pressing enter.
/ # wget --spider --timeout=1 nginx
Connecting to nginx (10.63.254.50:80)
wget: download timed out
</code></pre>

<p>However, it surprised me that using my external browser I also can't connect anymore to it through the load balancer:</p>

<pre><code>open http://$(kubectl get svc nginx --output=jsonpath={.status.loadBalancer.ingress[0].ip})
</code></pre>

<p>If I delete the policy it starts to work again.</p>

<p>So, my question is: how do I block other pods from reaching nginx, but keep access through the load balancer open?</p>

<p>I talked about this in my <a href="https://github.com/ahmetb/kubernetes-networkpolicy-tutorial/blob/a18f9e6e/08-allow-external-traffic.md" rel="nofollow noreferrer">Network Policy recipes repository</a>.</p>
<p>&quot;<em>Allowing EXTERNAL load balancers while DENYING local traffic</em>&quot; is not a use case that makes sense, therefore it's not possible to using network policy.</p>
<p>For <code>Service</code> type=LoadBalancer and <code>Ingress</code> resources to work, you must allow ALL traffic to the pods selected by these resources.</p>
<p>If you REALLY want you can use the <code>from.ipBlock.cidr</code> and <code>from.ipBlock.cidr.except</code> resources to allow traffic from <code>0.0.0.0/0</code> (all IPv4) and then excluding <code>10.0.0.0/8</code> (or whatever private IP range GKE uses).</p>
