<p>I am running a GKE cluster version 1.17.13-gke.1400.</p>
<p>I have applied the following network policy in my cluster -</p>
<pre><code>apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny
  namespace: default
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  - Egress
</code></pre>
<p>Which should block all communication to or from pods on the default namespace.
However, it does not. As is evident from this test -</p>
<pre><code>$ kubectl run p1 -it  --image google/cloud-sdk
root@p1:/# ping 8.8.8.8
PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.
64 bytes from 8.8.8.8: icmp_seq=1 ttl=114 time=1.14 ms
64 bytes from 8.8.8.8: icmp_seq=2 ttl=114 time=1.21 ms
^C
root@p1:/# curl www.google.com 
&lt;!doctype html&gt;&lt;html itemscope=&quot; ...
</code></pre>
<p>From the <a href="https://kubernetes.io/docs/concepts/services-networking/network-policies/#default-deny-all-ingress-and-all-egress-traffic" rel="noreferrer">docs</a>, seems like this application should be pretty straight forward.
Any help in understanding what I'm doing wrong, or tips for further troubleshooting, will be appreciated.</p>
<p>Thanks,
Nimrod,</p>

Nimrod Fiat
<p>For Network Policies to take effect, your cluster needs to run a network plugin which also enforces them. <a href="https://docs.projectcalico.org/getting-started/kubernetes/" rel="noreferrer">Project Calico</a> or <a href="https://cilium.io/" rel="noreferrer">Cilium</a> are plugins that do so. This is not the default when creating a cluster!</p>
<p>So first, you should check if your cluster is set up accordingly as described in the <a href="https://cloud.google.com/kubernetes-engine/docs/tutorials/network-policy#step_1_create_a_cluster" rel="noreferrer">Google Cloud Network Policies docs</a>. This is somehow abstracted away behind the <code>--enable-network-policy</code> flag.</p>
<p>If it is enabled, you should see some calico pods in the <code>kube-system</code> namespace.</p>
<p><code>kubectl get pods --namespace=kube-system</code></p>
<p>If there is a plugin in place which enforces network policies, you need to make sure to have deployed the network policy in the desired namespace - and check if your test using <code>kubectl run</code> is executed in that namespace, too. You might have some other namespace configured in your kube context and not hit the default namespace with your command.</p>
