<p>I have installed Calico on EKS from <a href="https://raw.githubusercontent.com/aws/amazon-vpc-cni-k8s/master/config/v1.6/calico.yaml" rel="nofollow noreferrer">here</a>.</p>

<p>I have two namespaces, foo and bar, both labeled with a label 'purpose', and containing one app pod each.</p>

<p>When I import the following Ingress-only policy into the foo namespace, it works exactly as expected; other test pods can not connect to foo-app, but bar-app can.</p>

<pre><code>---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: foo
  namespace: foo
spec:
  podSelector:
    matchLabels:
      app: foo-app
  policyTypes:
  - Ingress
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          purpose: bar
  - from:
    - ipBlock:
        cidr: 0.0.0.0/0
    ports:
    - protocol: TCP
      port: 53
    - protocol: UDP
      port: 53
</code></pre>

<p>However when I import a policy containing both ingress and egress rules it completely shuts off networking to the pod. I can no longer even ping the foo-app pod IP from bar-app.</p>

<pre><code>---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: foo
  namespace: foo
spec:
  podSelector:
    matchLabels:
      app: foo-app
  policyTypes:
  - Ingress
  - Egress
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          purpose: bar
  - from:
    - ipBlock:
        cidr: 0.0.0.0/0
    ports:
    - protocol: TCP
      port: 53
    - protocol: UDP
      port: 53
  egress:
  - to:
    - namespaceSelector:
        matchLabels:
          purpose: bar
  - to:
    - ipBlock:
        cidr: 0.0.0.0/0
    ports:
    - protocol: TCP
      port: 53
    - protocol: UDP
      port: 53
</code></pre>

<p>After removing and systematically re-adding parts of the policy, it is definitely the addition of the <code>namespaceSelector</code> entry in the egress that breaks it.</p>

<p>There are no other network policies on the cluster.</p>

<p>If there is not a directly obvious reason as to why this is happening; other than trawling through netfilter rules on worker nodes: Is there any efficient way to debug this?</p>

GDev
<p>I don't think you <a href="https://kubernetes.io/docs/concepts/services-networking/network-policies/" rel="nofollow noreferrer"><code>Network Policy</code></a> is correctly written.</p>

<p>I think you should change</p>

<pre><code>  egress:
  - to:
    - namespaceSelector:
        matchLabels:
          purpose: bar
  - to:
    - ipBlock:
        cidr: 0.0.0.0/0
    ports:
    - protocol: TCP
      port: 53
    - protocol: UDP
      port: 53
</code></pre>

<p>to</p>

<pre><code>  egress:
  - to:
    - namespaceSelector:
        matchLabels:
          purpose: bar
  - to:
    ports:
    - protocol: TCP
      port: 53
    - protocol: UDP
      port: 53
</code></pre>

<p>This is because you might be blocking the DNS which is being used to resolve service names to their IP addresses. You can read a really nice <a href="https://medium.com/@reuvenharrison/an-introduction-to-kubernetes-network-policies-for-security-people-ba92dd4c809d" rel="nofollow noreferrer">Introduction to Kubernetes Network Policies for Security People</a>.</p>

<p>If this is still a problem please provide detailed info about where are the pods running what are the labels and what rules you want to implement.</p>

<p>You can also check some nice examples for Ingress and Egress at GitHub - <a href="https://github.com/ahmetb/kubernetes-network-policy-recipes" rel="nofollow noreferrer">ahmetb/kubernetes-network-policy-recipes</a> and <a href="https://kubernetes.io/docs/tasks/administer-cluster/declare-network-policy/" rel="nofollow noreferrer">Declare Network Policy</a>.</p>
