<p>Is a network policy applicable to pods of a daemonset? I have a default deny network policy for all ingress and egress for all pods. However, it does not seem to seem to be applied for pods belonging to the daemonset.</p>
<pre><code>apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  - Egress
</code></pre>

Parvathy Mohan
<p><code>netpol</code> is applicable for the pods spawned under <code>daemonset</code>. For <code>netpol</code> they are just pods like the one deployed by deployments or <code>rs</code>.</p>
<p>If you do the description of the <code>netpol</code> you provided, it says its applicable for <code>namespace=default</code>.</p>
<pre><code>Name:         default-deny
Namespace:    default
Created on:   2021-07-21 17:59:56 -0500 CDT
Labels:       &lt;none&gt;
Annotations:  &lt;none&gt;
Spec:
  PodSelector:     &lt;none&gt; (Allowing the specific traffic to all pods in this namespace)
  Allowing ingress traffic:
    &lt;none&gt; (Selected pods are isolated for ingress connectivity)
  Allowing egress traffic:
    &lt;none&gt; (Selected pods are isolated for egress connectivity)
  Policy Types: Ingress, Egress
</code></pre>
<p>and <code>netpol</code> is a namespaced resource:</p>
<pre><code>NAME                              SHORTNAMES   APIVERSION                             NAMESPACED   KIND
networkpolicies                   netpol       networking.k8s.io/v1                   true         NetworkPolicy
</code></pre>
<p>This means your <code>daemonset</code> is created under some different namespace.</p>
<p>Here is one example:</p>
<p>Created a daemon set:</p>
<pre><code>kubectl get pod -n jackops  -o wide
NAME          READY   STATUS    RESTARTS   AGE   IP               NODE    NOMINATED NODE   READINESS GATES
curl          1/1     Running   0          53m   10.233.75.51     node2   &lt;none&gt;           &lt;none&gt;
dummy-2b9qv   1/1     Running   0          50m   10.233.75.4      node2   &lt;none&gt;           &lt;none&gt;
dummy-tx9rl   1/1     Running   0          50m   10.233.102.149   node1   &lt;none&gt;           &lt;none&gt;
</code></pre>
<p>Verified that curl is working without netpol:</p>
<pre><code>k exec -it curl -n jackops   -- curl -m 5  10.233.75.4 -I
HTTP/1.1 200 OK
Server: nginx/1.23.3
Date: Tue, 07 Feb 2023 17:13:05 GMT
Content-Type: text/html
Content-Length: 615
Last-Modified: Tue, 13 Dec 2022 15:53:53 GMT
Connection: keep-alive
ETag: &quot;6398a011-267&quot;
Accept-Ranges: bytes
</code></pre>
<p>Applied the below netpol:</p>
<pre><code>apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny
  namespace: jackops
spec:
  podSelector: {}
  policyTypes:
  - Ingress
</code></pre>
<p>Now, the connection is not going through:</p>
<pre><code>k exec -it curl -n jackops   -- curl -m 5  10.233.75.4 -I
curl: (28) Connection timed out after 5001 milliseconds
command terminated with exit code 28
</code></pre>
<p>About, knowing who is the parent of an object:</p>
<pre><code>kubectl get pod -n jackops  dummy-2b9qv -ojsonpath='{.metadata.ownerReferences}'
[{&quot;apiVersion&quot;:&quot;apps/v1&quot;,&quot;blockOwnerDeletion&quot;:true,&quot;controller&quot;:true,&quot;kind&quot;:&quot;DaemonSet&quot;,&quot;name&quot;:&quot;dummy&quot;,&quot;uid&quot;:&quot;cba5c840-672a-4ad8-830f-03993e32117a&quot;}]
</code></pre>
