<p>I have a Minikube cluster with Calico running and I am trying to make NetworkPolicies working. Here are my Pods and Services:</p>
<p>First pod (team-a):</p>
<pre><code>apiVersion: v1
kind: Pod
metadata:
  name: team-a
  namespace: orga-1
  labels:
    run: nginx
    app: team-a
spec:
 containers:
   - image: joshrosso/nginx-curl:v2
     imagePullPolicy: IfNotPresent
     name: nginx

---
apiVersion: v1
kind: Service
metadata:
  name: team-a
  namespace: orga-1
spec:
  ports:
   - port: 80
     name: http
     protocol: TCP
     targetPort: 80
  selector:
     app: team-a
</code></pre>
<p>Second pod (team-b):</p>
<pre><code>apiVersion: v1
kind: Pod
metadata:
  name: team-b
  namespace: orga-2
  labels:
    run: nginx
    app: team-b
spec:
 containers:
   - image: joshrosso/nginx-curl:v2
     imagePullPolicy: IfNotPresent
     name: nginx

---
apiVersion: v1
kind: Service
metadata:
  name: team-b
  namespace: orga-2
spec:
  ports:
   - port: 80
     name: http
     protocol: TCP
     targetPort: 80
  selector:
     app: team-b
</code></pre>
<p>When I execute a bash in <code>team-a</code>, I cannot <code>curl</code> orga-2.team-b:</p>
<pre><code>dev@ubuntu:~$ kubectl exec -it -n orga-1 team-a /bin/bash
root@team-a:/# curl google.de
      //Body removed...
root@team-a:/# curl orga-2.team-b
curl: (6) Could not resolve host: orga-2.team-b
</code></pre>
<p>Now I applied a network policy:</p>
<pre><code>kind: NetworkPolicy
apiVersion: networking.k8s.io/v1
metadata:
 name: deny-all-base-rule
 namespace: orga-1
spec:
 podSelector: {}
 policyTypes:
  - Ingress
 ingress: []
</code></pre>
<p>When I now curl google in team-a, it still works. Here are my pods:</p>
<pre><code>kube-system   calico-etcd-hbpqc                           1/1     Running   0          27m
kube-system   calico-kube-controllers-6b86746955-5mk9v    1/1     Running   0          27m
kube-system   calico-node-72rcl                           2/2     Running   0          27m
kube-system   coredns-fb8b8dccf-6j64x                     1/1     Running   1          29m
kube-system   coredns-fb8b8dccf-vjwl7                     1/1     Running   1          29m
kube-system   default-http-backend-6864bbb7db-5c25r       1/1     Running   0          29m
kube-system   etcd-minikube                               1/1     Running   0          28m
kube-system   kube-addon-manager-minikube                 1/1     Running   0          28m
kube-system   kube-apiserver-minikube                     1/1     Running   0          28m
kube-system   kube-controller-manager-minikube            1/1     Running   0          28m
kube-system   kube-proxy-p48xv                            1/1     Running   0          29m
kube-system   kube-scheduler-minikube                     1/1     Running   0          28m
kube-system   nginx-ingress-controller-586cdc477c-6rh6w   1/1     Running   0          29m
kube-system   storage-provisioner                         1/1     Running   0          29m
orga-1        team-a                                      1/1     Running   0          20m
orga-2        team-b                                      1/1     Running   0          7m20s
</code></pre>
<p>and my services:</p>
<pre><code>default       kubernetes             ClusterIP   10.96.0.1       &lt;none&gt;        443/TCP                  29m
kube-system   calico-etcd            ClusterIP   10.96.232.136   &lt;none&gt;        6666/TCP                 27m
kube-system   default-http-backend   NodePort    10.105.84.105   &lt;none&gt;        80:30001/TCP             29m
kube-system   kube-dns               ClusterIP   10.96.0.10      &lt;none&gt;        53/UDP,53/TCP,9153/TCP   29m
orga-1        team-a                 ClusterIP   10.101.4.159    &lt;none&gt;        80/TCP                   8m37s
orga-2        team-b                 ClusterIP   10.105.79.255   &lt;none&gt;        80/TCP                   7m54s
</code></pre>
<p>The kube-dns endpoint is available, also the service.</p>
<p>Why is my network policy not working <strong>and</strong> why is the curl to the other pod not working?</p>

ItFreak
<p>Please run </p>

<pre><code>curl team-a.orga-1.svc.cluster.local
curl team-b.orga-2.svc.cluster.local
verify entries in 'cat /etc/resolf.conf'
</code></pre>

<p>If you can reach your pods than please follow this <a href="https://docs.projectcalico.org/v3.5/getting-started/kubernetes/tutorials/advanced-policy" rel="nofollow noreferrer">tutorial</a></p>

<p>Deny all ingress traffic:</p>

<pre><code>apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-ingress
  namespace: orga-1
spec:
  podSelector:
    matchLabels: {}
  policyTypes:
  - Ingress
</code></pre>

<p>and Allow ingress traffic to Nginx:</p>

<pre><code>apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: access-nginx
  namespace: orga-1
spec:
  podSelector:
    matchLabels:
      run: nginx
  ingress:
    - from:
      - podSelector:
          matchLabels: {}
</code></pre>

<p>Below you can find more information about:</p>

<ul>
<li><a href="https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-s-dns-policy" rel="nofollow noreferrer">Pod’s DNS Policy</a>,</li>
<li><a href="https://kubernetes.io/docs/concepts/services-networking/network-policies/" rel="nofollow noreferrer">Network Policies</a></li>
</ul>

<p>Hope this help.</p>
