<p>I can't find in the official <a href="https://kubernetes.io/docs/concepts/services-networking/network-policies/" rel="nofollow noreferrer">docs</a> whether <code>NetworkPolicy</code> block <code>NodePort</code> ingress traffic.</p>

<pre><code>  ingress:
  - from:
    - podSelector:
        matchLabels:
          role: frontend
</code></pre>

<p>Considering the NetworkPolicy above - is it expected that it'll block any ingress traffic to <code>NodePort</code>-type services within my namespace?</p>

<p>If so, how do I allow such traffic into my namespace? Will <a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.12/#ipblock-v1-networking-k8s-io" rel="nofollow noreferrer"><code>ipBlock</code></a> solve it?</p>

Bernard Halas
<blockquote>
  <p>Do Kubernetes NetworkPolicies block NodePort traffic?</p>
</blockquote>

<p>Not really.</p>

<p>As it says in the <a href="https://kubernetes.io/docs/concepts/services-networking/network-policies/" rel="nofollow noreferrer">docs</a>: "<em>is a specification of how groups of <strong>pods</strong>...</em>".   Basically, they are applied to pods or group of pods. <code>NodePort</code> is defined in Kubernetes as a type of <a href="https://kubernetes.io/docs/concepts/services-networking/service/" rel="nofollow noreferrer">Service</a>.</p>

<p>You can restrict traffic applying the Network Policy to your namespace and specifying <strong>ipBlock</strong> as you mentioned. This will specifically restrict traffic to your pods but not the NodePort. (It may be all that you need)</p>

<p>To restrict traffic to NodePorts you will have to use an alternative external solution and it will really depend on your setup. For example, if you are using a cloud provider like AWS you could use <a href="https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html" rel="nofollow noreferrer">security groups</a>.</p>

<p>Alternatively, GCP provides <a href="https://cloud.google.com/kubernetes-engine/docs/how-to/cloud-armor-backendconfig" rel="nofollow noreferrer">Google Cloud Armor</a> with a Backend Config that allows you to control traffic to a service/ingress.</p>
