<p>Hello amazing community.</p>
<p>I hope somebody can help to understand this concept to build some strong understanding of kubernetes in azure and networking.</p>
<p>I have azure kubernetes cluster.
Network Type(plugin) is: Azure CNI
Network Policy: Azure</p>
<p>I just run the following yaml file to deploy 2 pods running ubuntu:</p>
<p>ubuntu-app-a</p>
<pre><code>apiVersion: apps/v1
kind: Deployment
metadata:
  name: ubuntu-app-a-deployment
  labels:
    app: ubuntu-app-a
spec:
  replicas: 1
  selector:
    matchLabels:
      app: ubuntu-app-a
  template:
    metadata:
      labels:
        app: ubuntu-app-a
    spec:
      containers:
        - name: ubuntu-app-b
          image: ubuntu
          command: [&quot;/bin/sh&quot;]
          args: [&quot;-c&quot;, &quot;sleep infinity&quot;]
      restartPolicy: Always 
---
apiVersion: v1
kind: Service
metadata:
  name: ubuntu-app-a-clusterip-service
  labels:
    app: ubuntu-app-a
spec:
  type: ClusterIP
  selector:
    app: ubuntu-app-a
  ports:
    - port: 80
      targetPort: 80

---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: ubuntu-app-b-network
spec:
  podSelector:
    matchLabels:
      app: ubuntu-app-b
  ingress:
  - from:
    - podSelector:
        matchLabels:
          app: ubuntu-app-a
</code></pre>
<p>ubuntu-app-b</p>
<pre><code>apiVersion: apps/v1
kind: Deployment
metadata:
  name: ubuntu-app-b-deployment
  labels:
    app: ubuntu-app-b
spec:
  replicas: 1
  selector:
    matchLabels:
      app: ubuntu-app-b
  template:
    metadata:
      labels:
        app: ubuntu-app-b
    spec:
      containers:
        - name: ubuntu-app-b
          image: ubuntu
          command: [&quot;/bin/sh&quot;]
          args: [&quot;-c&quot;, &quot;sleep infinity&quot;]
      restartPolicy: Always 
---
apiVersion: v1
kind: Service
metadata:
  name: ubuntu-app-b-clusterip-service
  labels:
    app: ubuntu-app-b
spec:
  type: ClusterIP
  selector:
    app: ubuntu-app-b
  ports:
    - port: 80
      targetPort: 80
</code></pre>
<p>Once both pods were up and running, i bashed into <code>app-a</code> and <code>ping</code> the <code>app-b</code>.</p>
<p>So far here everything is good and it is what i am expecting. All the pods can communicate to each other in the same vnet and namespace.</p>
<p>But I was curious about restricting the internal communication of those pods by using network security group and control the inbound and outbound traffic.</p>
<p>For example, I would like only the app-a to be able to ping app-b and not the other way around.</p>
<p>I have been reading in microsoft documentation but I got confused as they were advising to do not play with subnets as this could cause internal issues in the cluster.</p>
<p>So I was wondering how I can set a more restring internal communication in my cluster?</p>
<p>If anyone can help me with this or direct me into the right path I will be grateful.</p>
<p>Thank you so much in advance</p>

Nayden Van
<p>By default in Kubernetes all network traffic is allowed. So every pod can communicate with every other pod/service within the same cluster. NetworkPolicies are pretty much Firewalls in order to restrict traffic between pods. NetworkPolicies are enforced by the CNI (Container Network Interface), which in your case is Azure CNI, but Azure has two different Policy enforcement methods (depending on your needs, but those are rather &quot;special&quot; cases most of the time). The only notable difference is that Calico supports Global Netpols whereas Azure NPM only supports Namespace-wide policies.</p>
<p>As with most objects in Kubernetes, NetworkPolicies work with some sort of selectors, aka which pods should be targeted by it.</p>
<hr />
<p>For best practice reasons, all traffic should be denied (if you have several teams or a big cluster running). You can achieve this by creating the following resources in every Application Namespace.</p>
<pre><code>apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-all
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  - Egress
</code></pre>
<p>With this in place no pods would be able to communicate with each other, so your <code>ping</code> should fail.</p>
<hr />
<p>Once you've blocked all ingress and egress traffic, you can explicitly allow traffic from desired pods. Now we have to allow Pod A Egress Traffic to Pod B, and allow Ingress Traffic from Pod A in Pod B. You were already in the right path with your Network Policy. The following should work as desired.</p>
<pre><code>---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: ubuntu-app-b-network
spec:
  podSelector:
    matchLabels:
      app: ubuntu-app-b
  ingress:
  - from:
    - podSelector:
        matchLabels:
          app: ubuntu-app-a
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: ubuntu-app-a-network
spec:
  podSelector:
    matchLabels:
      app: ubuntu-app-a
  egress:
  - to:
    - podSelector:
        matchLabels:
          app: ubuntu-app-b
</code></pre>
<p>Let me know if this works for you, If not I'll quickly recreate your situation.</p>
