<p>I was testing the Kubernetes network policy first before trying in a production requirement but unfortunately, I could not make it work yet and looking for a solution.</p>
<p>My test environment is a Kind k8 cluster on WSL.</p>
<p>Trying everything in the namespace &quot;networkpolicy&quot;:</p>
<pre><code>→ kubectl -n networkpolicy get ns networkpolicy
NAME            STATUS   AGE
networkpolicy   Active   174m
</code></pre>
<p>Two pods running in that namespace:</p>
<pre><code>→ kubectl -n networkpolicy get pods --show-labels -o wide
NAME         READY   STATUS    RESTARTS   AGE     IP            NODE                   NOMINATED NODE   READINESS GATES   LABELS
np-busybox   1/1     Running   0          151m    10.244.0.11   selfie-control-plane   &lt;none&gt;           &lt;none&gt;            app=client
np-nginx     1/1     Running   0          9m52s   10.244.0.12   selfie-control-plane   &lt;none&gt;           &lt;none&gt;            app=nginx
</code></pre>
<p>You can see the pod &quot;np-nginx&quot; has the label &quot;app=nginx&quot;</p>
<p>Network policy created with podSelector &quot;app: nginx&quot;</p>
<pre><code>→ kubectl -n networkpolicy describe networkpolicy
Name:         my-networkpolicy
Namespace:    networkpolicy
Created on:   2022-10-08 21:49:16 +0530 IST
Labels:       &lt;none&gt;
Annotations:  &lt;none&gt;
Spec:
  PodSelector:     app=nginx
  Allowing ingress traffic:
    &lt;none&gt; (Selected pods are isolated for ingress connectivity)
  Allowing egress traffic:
    &lt;none&gt; (Selected pods are isolated for egress connectivity)
  Policy Types: Ingress, Egress
</code></pre>
<p>so I think, specifying policy types Ingress and Egress without explicitly specifying any rules under it, means it by default denies any connections. Is that correct?</p>
<p>I tried to curl the Nginx pod IP from the busybox client pod and it is able to connect fine even if the network policy is in place.</p>
<pre><code>→ kubectl -n networkpolicy exec np-busybox -- curl -s 10.244.0.12 | html2text
****** Welcome to nginx! ******
If you see this page, the nginx web server is successfully installed and
working. Further configuration is required.
For online documentation and support please refer to nginx.org.
Commercial support is available at nginx.com.
Thank you for using nginx.
</code></pre>
<p>Is there something wrong with what I tried?</p>

vjwilson
<p>ok, I figured out the solution now.</p>
<p>KIND ships with a simple networking implementation <strong>kindnet</strong> which does not seem to support networkpolicy.</p>
<p>You can change the CNI on your Kind cluster to <strong>Calico</strong>(which does support networkpolicy) as follows:</p>
<p>You can see kindnet and no calico present:</p>
<pre><code>~ → kubectl -n kube-system get all | grep calico
~ →

~ → kubectl -n kube-system get all | grep kindnet
pod/kindnet-mmlgj                                  1/1     Running   4 (2d1h ago)   2d21h
daemonset.apps/kindnet      1         1         1       1            1           &lt;none&gt;                   2d21h
</code></pre>
<p>Get into the docker container:</p>
<pre><code>~ → docker ps -a
CONTAINER ID   IMAGE                  COMMAND                  CREATED      STATUS      PORTS                       NAMES
1beac63b6221   kindest/node:v1.25.2   &quot;/usr/local/bin/entr…&quot;   2 days ago   Up 2 days   127.0.0.1:34235-&gt;6443/tcp   selfie-control-plane

~ → docker exec -it 1beac63b6221 bash
root@selfie-control-plane:/#
</code></pre>
<p>Create the following yaml file with option &quot;disableDefaultCNI&quot; to disable default kindnet of Kind cluster:</p>
<pre><code>root@selfie-control-plane:/# cat &lt;&lt;EOF &gt;/etc/kubernetes/manifests/kind-calico.yaml
kind: Cluster
apiVersion: kind.sigs.k8s.io/v1alpha3
networking:
  disableDefaultCNI: true # disable kindnet
EOF

root@selfie-control-plane:/# exit
exit
</code></pre>
<p>Exit from the container, then Stop and Start the kind cluster docker container</p>
<pre><code>~ → docker stop selfie-control-plane
selfie-control-plane

~ → docker start selfie-control-plane
selfie-control-plane

~ → docker ps -a
CONTAINER ID   IMAGE                  COMMAND                  CREATED      STATUS         PORTS                       NAMES
1beac63b6221   kindest/node:v1.25.2   &quot;/usr/local/bin/entr…&quot;   2 days ago   Up 7 seconds   127.0.0.1:34235-&gt;6443/tcp   selfie-control-plane
~ →
</code></pre>
<p>Install calico CNI plugin now:</p>
<pre><code>~ → kubectl apply -f https://docs.projectcalico.org/manifests/calico.yaml
poddisruptionbudget.policy/calico-kube-controllers created
serviceaccount/calico-kube-controllers created
serviceaccount/calico-node created
configmap/calico-config created
customresourcedefinition.apiextensions.k8s.io/bgpconfigurations.crd.projectcalico.org created
customresourcedefinition.apiextensions.k8s.io/bgppeers.crd.projectcalico.org created
customresourcedefinition.apiextensions.k8s.io/blockaffinities.crd.projectcalico.org created
customresourcedefinition.apiextensions.k8s.io/caliconodestatuses.crd.projectcalico.org created
customresourcedefinition.apiextensions.k8s.io/clusterinformations.crd.projectcalico.org created
customresourcedefinition.apiextensions.k8s.io/felixconfigurations.crd.projectcalico.org created
customresourcedefinition.apiextensions.k8s.io/globalnetworkpolicies.crd.projectcalico.org created
customresourcedefinition.apiextensions.k8s.io/globalnetworksets.crd.projectcalico.org created
customresourcedefinition.apiextensions.k8s.io/hostendpoints.crd.projectcalico.org created
customresourcedefinition.apiextensions.k8s.io/ipamblocks.crd.projectcalico.org created
customresourcedefinition.apiextensions.k8s.io/ipamconfigs.crd.projectcalico.org created
customresourcedefinition.apiextensions.k8s.io/ipamhandles.crd.projectcalico.org created
customresourcedefinition.apiextensions.k8s.io/ippools.crd.projectcalico.org created
customresourcedefinition.apiextensions.k8s.io/ipreservations.crd.projectcalico.org created
customresourcedefinition.apiextensions.k8s.io/kubecontrollersconfigurations.crd.projectcalico.org created
customresourcedefinition.apiextensions.k8s.io/networkpolicies.crd.projectcalico.org created
customresourcedefinition.apiextensions.k8s.io/networksets.crd.projectcalico.org created
clusterrole.rbac.authorization.k8s.io/calico-kube-controllers created
clusterrole.rbac.authorization.k8s.io/calico-node created
clusterrolebinding.rbac.authorization.k8s.io/calico-kube-controllers created
clusterrolebinding.rbac.authorization.k8s.io/calico-node created
daemonset.apps/calico-node created
deployment.apps/calico-kube-controllers created
</code></pre>
<p>Now you cannot curl it and it simply timesout after waiting for long:</p>
<pre><code>→ kubectl -n networkpolicy exec np-busybox -- curl -s 10.244.100.66
.
.
.
</code></pre>
