<p>I have a service that I want to be able to access the internet and noother pods. However, ALL egress rules seem to block all egress.</p>
<pre><code># No NetworkPolicies
kubectl -n mytestnamespace exec service-c-78f784b475-qsdqg -- bin/bash -c 'curl www.google.com'
</code></pre>
<p>With no NetworkPolicy my pod can access the internet. Next I make a Networkpolicy that allows egress to all IP-addresses.</p>
<pre><code>apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-all
  namespace: mytestnamespace
spec:
  podSelector: {}
  policyTypes:
    - Egress
  egress:
    - to:
      - ipBlock:
          cidr: 0.0.0.0/0
</code></pre>
<p>But now curl can no longer access the internet, but WHY??????</p>
<h1>With NetworkPolicies allowing Egress to all IPs!</h1>
<pre><code>kubectl -n mytestnamespace exec service-c-78f784b475-qsdqg -- bin/bash -c 'curl www.google.com'
</code></pre>
<p>Why does this NetworkPolicy block all egress? Makes no sense!</p>

Esben Eickhardt
<p>It turns out that despite opening up to all IP-addresses, the networkpolicy does not allow egress to the DNS pod, which is in another namespace.</p>
<pre><code># Identifying DNS pod
kubectl get pods -A | grep dns

# Identifying DNS pod label
kubectl describe pods -n kube-system coredns-64cfd66f7-rzgwk
</code></pre>
<p>Next I add the dns label to the egress policy:</p>
<pre><code># network_policy.yaml
kind: NetworkPolicy
apiVersion: networking.k8s.io/v1
metadata:
  name: allow-all
  namespace: mytestnamespace
spec:
  podSelector: {}
  policyTypes:
  - Egress
  - Ingress
  egress:
  - to:
    - ipBlock:
        cidr: &quot;0.0.0.0/0&quot;
  - to:
    - namespaceSelector:
        matchLabels:
          kubernetes.io/metadata.name: &quot;kube-system&quot;
    - podSelector:
        matchLabels:
          k8s-app: &quot;kube-dns&quot;
</code></pre>
<p>I apply the network policy and test the curl calls:</p>
<pre><code># Setting up policy
kubectl apply -f network_policy.yaml

# Testing curl call
kubectl -n mytestnamespace exec service-c-78f784b475-qsdqg -- bin/bash -c 'curl www.google.com'
</code></pre>
<p>SUCCESS! Now I can make egress calls, next I just have to block the appropriate IP-addresses in the private network.</p>
