<p>I'm having trouble setting up a Network Policy that looks fine to me. Here are the 2 pods in the same namespace</p>
<pre><code>k get po --show-labels
NAME                         READY   STATUS    RESTARTS   AGE   LABELS
nfs-server-ccb8d5ff6-7rtr4   1/1     Running   0          22h   role=nfs-server
nginx-jpm-549b69bf68-x5hd7   1/1     Running   0          21h   app=nginx-jpm
</code></pre>
<p>And I'm restricting traffic to the nfs-server pod using the following network policy spec:</p>
<pre><code>spec:
  podSelector:
    matchLabels:
      role: nfs-server
  policyTypes:
  - Ingress
  - Egress
  ingress:
  # Allow inbound from nginx-jpm on all ports
  - from:
    - podSelector:
        matchLabels:
          app: nginx-jpm
  egress:
  # Allow outbound DNS traffic inside the cluster (kube-system namespace is not labelled)
  - to:
    - namespaceSelector: {}
    ports:
    - protocol: &quot;UDP&quot;
      port: 53
</code></pre>
<p>I exec into the nginx pod and am unable to connect to the nfs-server pod</p>
<pre><code>root@nginx-jpm-549b69bf68-x5hd7:/# telnet nfs-server.jenkinsrepo.svc.cluster.local 111
Trying 172.22.117.55...
If I delete the network policy, it works then
root@nginx-jpm-549b69bf68-x5hd7:/# telnet nfs-server.jenkinsrepo.svc.cluster.local 111
Trying 172.22.117.55...
Connected to nfs-server.jenkinsrepo.svc.cluster.local.
Escape character is '^]'.
</code></pre>
<p>Is there something I've missed in my network policy? There is no other network policy in the namespace.</p>

Jason Stanley
<p>Since you have <code>podSelector</code> which selects pods with <code>role: nfs-server</code> label, the egress rule gets applied to only those pods and hence egress is blocked from nginx pod. You should probably create a separate network policy for egress only to cluster DNS which applies to all pods.</p>
