<p>I have been trying to experiment with the calico network rules and I'm finding it tough to get the ingress and the egress rules to work with <code>order</code> in calico after denying all ingress and egress rules.</p>
<pre><code> kubectl get pods --show-labels
NAME         READY   STATUS    RESTARTS   AGE   LABELS
hello-web3   1/1     Running   0          45m   app=foo
hello-web4   1/1     Running   0          45m   app=bar
hello-web5   1/1     Running   0          15s   app=foobar
hello-web6   1/1     Running   0          4s    app=barbar
</code></pre>
<p>My network policy is as follows</p>
<pre><code>---
apiVersion: projectcalico.org/v3
kind: NetworkPolicy
metadata:
  name: ppdp-default
spec:
  selector: all()
  order: 2000
  types:
  - Ingress
  - Egress
---
apiVersion: projectcalico.org/v3
kind: GlobalNetworkPolicy
metadata:
  name: ppdp-egress-trusted
spec:
  selector: app == 'foo'
  order: 1000
  types:
  - Egress
  egress:
  - action: Allow
    destination:
      selector: app == 'bar'
---
apiVersion: projectcalico.org/v3
kind: GlobalNetworkPolicy
metadata:
  name: ppdp-ingress-trusted
spec:
  selector: app == 'foobar'
  order: 100
  types:
  - Ingress
  ingress:
  - action: Allow
    source:
      selector: app == 'barbar'
</code></pre>
<p>Output for Ingress:</p>
<pre><code>(base) ➜ ✗ kubectl exec --stdin --tty hello-web5 -- sh
/ # ^C
/ # wget -qO- --timeout=2 http://hello-web6:8080
^C
/ # wget -qO- --timeout=2 http://hello-web6:8080
wget: bad address 'hello-web6:8080'
/ # command terminated with exit code 1
---
(base) ➜ ✗ kubectl exec --stdin --tty hello-web6 -- sh
/ # wget -qO- --timeout=2 http://hello-web5:8080
wget: bad address 'hello-web5:8080'
/ # command terminated with exit code 1
</code></pre>
<p>Output for Egress</p>
<pre><code>(base) ➜ ✗ kubectl exec --stdin --tty hello-web3 -- sh
/ # wget -qO- --timeout=2 http://hello-web4:8080
^C
/ # command terminated with exit code 130
</code></pre>
<p>Am I missing anything? Any help would be of great use.</p>
<p>Thanks in advance</p>

user3398900
<blockquote>
<p><strong>In a namespace, I want to deny traffic among all pods in the first place and then allow egress or ingress traffic between specific pods
(matching labels)</strong></p>
</blockquote>
<p>While I don't know why you're using the order or calico network policies the goal described in the comments can be achieved with Kubernetes network policies supported by Calico CNI. I prepared a simple example of how network policies work with those. So let's start with a list of pods that I have created in <code>dev</code> namespace:</p>
<pre class="lang-sh prettyprint-override"><code>➜  ~ kgp -n dev --show-labels -owide

NAME          READY   STATUS    RESTARTS   AGE   IP              NODE       NOMINATED NODE   READINESS GATES   LABELS
centos        1/1     Running   0          30m   10.244.120.68   minikube   &lt;none&gt;           &lt;none&gt;            host=centos
echo-server   1/1     Running   0          30m   10.244.120.69   minikube   &lt;none&gt;           &lt;none&gt;            host=echo-server
</code></pre>
<p>Notice the labels. In my example we are going to allow ingress traffic to <code>echo-server</code> from host named <code>centos</code>. Let's first test if the connections works between those:</p>
<pre><code>[root@centos /]# curl 10.244.120.69:80 -v
* About to connect() to 10.244.120.69 port 80 (#0)
*   Trying 10.244.120.69...
* Connected to 10.244.120.69 (10.244.120.69) port 80 (#0)
&gt; GET / HTTP/1.1
&gt; User-Agent: curl/7.29.0
&gt; Host: 10.244.120.69
&gt; Accept: */*
  &quot;path&quot;: &quot;/&quot;,
  &quot;headers&quot;: {
    &quot;user-agent&quot;: &quot;curl/7.29.0&quot;,
    &quot;host&quot;: &quot;10.244.120.69&quot;,
    &quot;accept&quot;: &quot;*/*&quot;
  &quot;os&quot;: {
    &quot;hostname&quot;: &quot;echo-server&quot;
  },
  &quot;connection&quot;: {}
* Connection #0 to host 10.244.120.69 left intact
</code></pre>
<p>Now let's deny all traffic in that namespace:</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-all
  namespace: dev
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  - Egress
</code></pre>
<p>Once this policy is in place previous test fails:</p>
<pre class="lang-yaml prettyprint-override"><code>➜  ~ keti -n dev centos bash 
[root@centos /]# curl 10.244.120.69:80 -v
* About to connect() to 10.244.120.69 port 80 (#0)
*   Trying 10.244.120.69...
* Connection timed out
* Failed connect to 10.244.120.69:80; Connection timed out
* Closing connection 0
curl: (7) Failed connect to 10.244.120.69:80; Connection timed out
</code></pre>
<p>Let's now apply the ingress policy that will allow us to reach the <code>echo-server</code>. So basically we selects the pod's label that we want the policy to be applied to and the choose which pod ingress traffic is allowed from:</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-echo
  namespace: dev    
spec:
  podSelector:
    matchLabels:
      host: echo-server
  ingress:
    - from:
      - podSelector:
          matchLabels:
            host: centos
</code></pre>
<p>Now since we allowed the traffic towards our <code>echo-server</code>, we might feel tempted to test this straight away but this still won't work. While we allowed the ingress traffic toward <code>echo-server</code> we have to remember that we denied both <code>ingress</code> and <code>egress</code> in our <code>deny-all</code> policy. This means that we have to allow the <code>egress</code> traffic from <code>centos</code> pod:</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: egress-centos
  namespace: dev    
spec:
  podSelector:
    matchLabels:
      host: centos
  egress:
    - to:
      - podSelector:
          matchLabels:
            host: echo-server      
</code></pre>
<p>After that we have successfully allowed traffic for some specific pods in the same namespace while deny every pod that don't match the labels.</p>
