<p>I am fairly new to networkpolicies on Calico. I have created the following NetworkPolicy on my cluster:</p>

<pre><code>apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: nginxnp-po
  namespace: default
spec:
  podSelector:
    matchLabels:
      run: nginxnp
  policyTypes:
    - Ingress
  ingress:
  - from:
    - podSelector:
        matchLabels:
          acces: frontend
    ports: 
      - port: 80
</code></pre>

<p>This is how I read it: All pods that have the selector <code>run=nginxnp</code> are only accessible on port 80 from every pod that has the selector <code>access=frontend</code>.</p>

<p>Here is my nginx pod (with a running nginx in it):</p>

<pre><code>$ kubectl get pods -l run=nginxnp
NAME                      READY   STATUS    RESTARTS   AGE
nginxnp-9b49f4b8d-tkz6q   1/1     Running   0          36h
</code></pre>

<p>I created a busybox container like this:</p>

<pre><code>$ kubectl run busybox --image=busybox --restart=Never --labels=access=frontend -- sleep 3600
</code></pre>

<p>I can see that it matches the selector <code>access=frontend</code>:</p>

<pre><code>$ kubectl get pods -l access=frontend
NAME      READY   STATUS    RESTARTS   AGE
busybox   1/1     Running   0          6m30s
</code></pre>

<p>However when I exec into the busybox pod and try to wget the nginx pod, the connection is still refused.</p>

<p>I also tried setting an egress rule that allows the traffic the other way round, but this didn't do anything as well. As I understood networkpolicies: When no rule is set, nothing is blocked. Hence, when I set no egress rule, egress should not be blocked.</p>

<p>If I delete the networkpolicy it works. Any pointers are highly appreciated.</p>

stiller_leser
<p>There is a typo in the NetworkPolicy template <code>acces: frontend</code> should be <code>access: frontend</code></p>

<pre><code>  ingress:
  - from:
    - podSelector:
        matchLabels:
          acces: frontend
</code></pre>
