<p>By default pods can communicate with each other in Kubernetes, which is unwanted should a pod be compromised. We want to use <strong>NetworkPolicies</strong> to control inbound (ingress) and outbound (egress) traffic to/from pods.</p>
<p>Specifically pods should ONLY be able to:</p>
<ul>
<li>Egress: Call services on the internet</li>
<li>Ingress: Receive requests from the <strong>Nginx-ingress controller</strong></li>
<li>Ingress: Send logs via <strong>promtail</strong> to <strong>Loki</strong></li>
</ul>
<h2>What I have tried</h2>
<h2>1. Denying all ingress and egress</h2>
<p>This is the default policy that we want to gradually open up. It blocks all ingress and egress.</p>
<pre><code>kind: NetworkPolicy
apiVersion: networking.k8s.io/v1
metadata:
  name: default-deny-all
  namespace: mynamespace
spec:
  podSelector: {}
  policyTypes:
    - Ingress
    - Egress
</code></pre>
<h2>2. Opening egress to internet only</h2>
<p>We allow egress only to IP-adresses that are not reserved for <strong>private networks</strong> according to <a href="https://en.wikipedia.org/wiki/Private_network#Private_IPv4_addresses" rel="nofollow noreferrer">wikipedia</a>.</p>
<pre><code>kind: NetworkPolicy
apiVersion: networking.k8s.io/v1
metadata:
  name: egress-allow-internet-only
  namespace: mynamespace
spec:
  podSelector: {}
  policyTypes:
  - Egress
  egress:
  - to:
    - ipBlock:
        cidr: 0.0.0.0/0
        except:
        - 10.0.0.0/8
        - 172.16.0.0/12
        - 192.168.0.0/16
</code></pre>
<h2>3. Opening Ingress from ingress controller and loki</h2>
<p>We have deployed the standard <strong>NginX Ingress Controller</strong> in namespace <strong>default</strong>, and it has the lable <strong>app.kubernetes.io/name=ingress-nginx</strong>. We have also deployed the standard <strong>loki-grafana stack</strong> to the <strong>default</strong> namespace, which uses <strong>promtail</strong> to transfer logs to <strong>Loki</strong>. Here I allow pods to recieve ingress from the <strong>promtail</strong> and <strong>ingress-nginx</strong> pods.</p>
<pre><code>apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: ingress-allow-ingress-controller-and-promptail
  namespace: mynamespace
spec:
  podSelector: {}
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          kubernetes.io/metadata.name=default
    - podSelector:
        matchLabels:
          app.kubernetes.io/name=ingress-nginx
  - from:
    - namespaceSelector:
        matchLabels:
          kubernetes.io/metadata.name=default
    - podSelector:
        matchLabels:
          app.kubernetes.io/name=promtail
</code></pre>
<h2>So, does this configuration look right?</h2>
<p>I am new to Kubernetes, so I hope you guys can help point me in the right direction. Does this configuration do what I intent it to do, or have I missed something? E.g. is it enough that I have just blocked <strong>egress</strong> within the <strong>private network</strong> to ensure that the pods are isolated from each other, or should I also make the ingress configuration as I have done here?</p>

Esben Eickhardt
<p>I have compared your Ingress with <a href="https://kubernetes.io/docs/concepts/services-networking/network-policies/#allow-all-ingress-traffic" rel="nofollow noreferrer">K8 Doc</a> and Egress with this <a href="https://stackoverflow.com/a/57845666/19230181">SO</a>  and <a href="https://kubernetes.io/docs/concepts/services-networking/network-policies/#default-deny-all-ingress-and-all-egress-traffic" rel="nofollow noreferrer">deny Both ingress and Egress</a> seems to be correct.The only thing we need to do is check whether all the name space is given correct or not. Seems to be correct as per your YAML file.</p>
<p>But kubernetes pods use the DNS server inside Kubernetes; due to this DNS server being blocked, we need to define more specific IP ranges to allow DNS lookups. Follow this <a href="https://stackoverflow.com/a/57204119/19230181">SO</a> to define <a href="https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-s-dns-config" rel="nofollow noreferrer">DNS config</a> at pod levels and to get curl calls with domain names allow Egress to Core DNS from kube-system(by adding a namespace selecter (kube-system) and a pod selector (dns pods)).</p>
<h3>How to identify dns pod</h3>
<pre><code># Identifying DNS pod
kubectl get pods -A | grep dns

# Identifying DNS pod label
kubectl describe pods -n kube-system coredns-64cfd66f7-rzgwk
</code></pre>
<h2>Adding DNS pod to NetworkPolicy</h2>
<pre><code>kind: NetworkPolicy
apiVersion: networking.k8s.io/v1
metadata:
  name: egress-allow-internet-only
  namespace: mynamespace
spec:
  podSelector: {}
  policyTypes:
  - Egress
  egress:
  - to:
    - ipBlock:
        cidr: 0.0.0.0/0
        except:
        - 10.0.0.0/8
        - 172.16.0.0/12
        - 192.168.0.0/16
  - to:
    - namespaceSelector:
        matchLabels:
          kubernetes.io/metadata.name: &quot;kube-system&quot;
    - podSelector:
        matchLabels:
          k8s-app: &quot;kube-dns&quot;
</code></pre>
