<p>I'm running managed cluster with Google Cloud, so it has option to enable <code>NetworkPolicy</code>, and on the backend it uses calico. Problem I have, it looks like I can use only api version <code>networking.k8s.io/v1</code>.</p>

<p>I'm trying to create policy that will disable any internal egress traefik from pod, and allow any ingress + egress to/from external network.</p>

<p>With calico API it will look something like this:</p>

<pre><code>apiVersion: projectcalico.org/v3
kind: NetworkPolicy
metadata:
  name: policy-name
  namespace: namespace-name
spec:
  selector: label == value
  types:
  - Ingress
  - Egress
ingress:
  - action: Allow
    notProtocol: UDP
    destination:
      ports:
      - 53
  - action: Allow
    notProtocol: TCP
    destination:
      ports:
      - 53
  egress:
  - action: Deny
    protocol: UDP
    destination:
      ports:
      - 53
  - action: Deny
    protocol: TCP
    destination:
      ports:
      - 53
</code></pre>

<p>Or negative version of the following policy:</p>

<pre><code>apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: policy-name
  namespace: namespace-name
spec:
  podSelector:
    matchLabels:
      label: value
  policyTypes:
  - Egress
  egress:
  - ports:
    - port: 53
      protocol: UDP
    - port: 53
      protocol: TCP
  - to:
    - namespaceSelector: {}
</code></pre>

<p>So I have 2 questions:
1. is it possible to reproduce rule above with <code>networking.k8s.io/v1</code> API?
2. Can I somehow enable <code>projectcalico.org/v3</code> API on a managed GKE cluster?</p>

Sarkis Arutiunian
<p>Finally after 2 days spend. Appears that to apply configs from API 'projectcalico.org/v3' you have to first install or deploy to your cluster CLI tool <code>calicoctl</code>. Then you can apply your policy with <code>calicoctl apply -f ./policy.yml</code> or if it's deployed to cluster, with alias <code>alias calicoctl="kubectl exec -i -n kube-system calicoctl /calicoctl -- "</code> + <code>cat ./policy.yml | calicoctl apply -f -</code>.</p>

<p>And bellow is working policy that will disable egress to private network and will allow only public:</p>

<pre><code>apiVersion: projectcalico.org/v3
kind: NetworkPolicy
metadata:
  name: policy-name
  namespace: namespace-name
spec:
  selector: label == value
  types:
  - Egress
  egress:
  - action: Allow
    protocol: UDP
    destination:
      ports: [53]
  - action: Allow
    protocol: TCP
    destination:
      ports: [53]
  - action: Deny
    destination:
      nets:
      - 10.0.0.0/8
      - 172.16.0.0/12
      - 192.168.0.0/16
  - action: Allow
</code></pre>
