<p>I need to block pods communication to each other but I failed to do it.<br />
I installed <a href="https://www.weave.works/docs/net/latest/kubernetes/kube-addon/" rel="nofollow noreferrer">weave plug-in</a> on my <strong>Minikube</strong> (v1.21.0), and started two pods in the same namespace:</p>
<pre><code> kubectl run nginx1 --image=nginx -n ns1
 kubectl run nginx2 --image=nginx -n ns2
</code></pre>
<p><strong>The pods IPs:</strong><br />
<code>nginx1</code> with IP: <code>172.17.0.3</code><br />
<code>nginx2</code> with IP: <code>172.17.0.4</code></p>
<p>I can ping <code>nginx1</code> from <code>nginx2</code> and vice vesra.<br />
I wanted to try to deny it, so I firstly tried to deny all the network with this network policy:</p>
<pre><code>kubectl apply -f - &lt;&lt;EOF
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: netpol1
  namespace: earth
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  - Egress
  ingress: []
  egress: []
EOF
</code></pre>
<p>I still had ping, so I tried this one too:</p>
<pre><code>kubectl apply -f - &lt;&lt;EOF
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: netpol1
  namespace: earth
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  - Egress
  ingress:
  - from:
    - ipBlock:
        cidr: 0.0.0.0/0
        except:
        - 172.17.0.0/16 
  egress:
  - to:
    - ipBlock:
        cidr: 0.0.0.0/0
        except:
        - 172.17.0.0/16
EOF

</code></pre>
<p>I still can ping each pod from within the other pods in the same namespace.<br />
I verified that <code>weave</code> is installed:</p>
<pre><code>NAME                                      READY   STATUS    RESTARTS   AGE
coredns-74ff55c5b-2r5z8                   1/1     Running   0          2d3h
etcd-ip-172-31-37-46                      1/1     Running   0          2d3h
kube-apiserver-ip-172-31-37-46            1/1     Running   0          2d3h
kube-controller-manager-ip-172-31-37-46   1/1     Running   0          2d3h
kube-proxy-787pj                          1/1     Running   0          2d3h
kube-scheduler-ip-172-31-37-46            1/1     Running   0          2d3h
storage-provisioner                       1/1     Running   0          2d3h
weave-net-wd52r                           2/2     Running   1          23m
</code></pre>
<p>I also tried to restart kubelet but I still have access from each pod to the other one.<br />
What can be the reason?</p>

<p>When you specify the Egress and Ingress resources, you do not specify the network protcol. In the <a href="https://kubernetes.io/docs/concepts/services-networking/network-policies/" rel="nofollow noreferrer">kubernetes docs</a> you can see that the protocol can be specified too. Your kubernetes cluster defaults your Egress and Ingress resources to a protocol if you do not specify one.</p>
<p>If you block all TCP or UDP networking, you will find that ping still works just fine. This is because ping uses the ICMP network protocol, not TCP or UDP.</p>
<p>The actual configuration you need depends on your networking plugin. I do not know how to configure Weave to block ICMP.<br />
If you were using Calico, their <a href="https://docs.tigera.io/calico/latest/network-policy/policy-rules/icmp-ping" rel="nofollow noreferrer">docs</a> explain how to handle the ICMP protocol.</p>
