<p>I wanna deny the container from accessing the public internet.</p>

<p>After a long research, I found <a href="https://github.com/ahmetb/kubernetes-network-policy-recipes/blob/master/14-deny-external-egress-traffic.md" rel="nofollow noreferrer">this example: DENY external egress traffic</a> : </p>

<pre><code>apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: foo-deny-external-egress
spec:
  podSelector:
    matchLabels:
      app: foo
  policyTypes:
  - Egress
  egress:
  - ports:
    - port: 53
      protocol: UDP
    - port: 53
      protocol: TCP
   to:
    - namespaceSelector: {}
</code></pre>

<p>But it does not work. Indeed, I ran <code>wget https://google.com</code> and I got a positive response.
Any hint is apperciated</p>

Abdennour TOUMI
<p>The network policy works fine on calico.
<strong>Network Policy has no effect on cluster using flannel network plugin</strong>.</p>

<blockquote>
  <p>As mentioned on this <a href="https://github.com/coreos/flannel" rel="nofollow noreferrer">link</a> Flannel is focused on networking. For network policy, other projects such as Calico can be used.</p>
</blockquote>

<p><strong>Network policy blocks traffic as expected on  cluster using calico</strong></p>

<p>I have two clusters one using flannel and one using calico and test works as expected on calico.</p>

<p>Logs :</p>

<pre><code>$ kubectl apply -f networkpolicy.yaml
networkpolicy.networking.k8s.io/foo-deny-external-egress created


ubuntu@calico-master-1:~$ kubectl run busybox --image=busybox --restart=Never -- sleep 3600
pod/busybox created


$ kubectl get networkpolicy
NAME                       POD-SELECTOR   AGE
foo-deny-external-egress   run=busybox    30m

$ kubectl exec -it busybox -- /bin/sh
/ # wget https://google.com
Connecting to google.com (74.125.193.102:443)
wget: can't connect to remote host (74.125.193.102): Connection timed out
</code></pre>

<p><strong>On cluster using Flannel creating network policy has no effect</strong></p>

<pre><code>ubuntu@k8s-flannel:~$ kubectl exec -it busybox -- /bin/sh
/ # curl https://google.com
/bin/sh: curl: not found
/ # wget https://google.com
Connecting to google.com (216.58.207.238:443)
wget: note: TLS certificate validation not implemented
Connecting to www.google.com (172.217.20.36:443)
saving to 'index.html'
index.html           100% |*************************************************************************************************************************************************| 12498  0:00:00 ETA
'index.html' saved
</code></pre>

<p>Apply policy</p>

<pre><code>$ kubectl apply -f networkpolicy.yaml
networkpolicy.networking.k8s.io/foo-deny-external-egress created

$ kubectl get networkpolicy
NAME                       POD-SELECTOR   AGE
foo-deny-external-egress   run=busybox    32m
</code></pre>

<p>We can still get to network outside as <strong>network policy does not work on flannel</strong>.</p>

<pre><code>$ kubectl exec -it busybox -- /bin/sh
/ # wget https://google.com
Connecting to google.com (172.217.22.174:443)
wget: note: TLS certificate validation not implemented
Connecting to www.google.com (172.217.20.36:443)
saving to 'index.html'
index.html           100% |*************************************************************************************************************************************************| 12460  0:00:00 ETA
'index.html' saved
</code></pre>
