<p>I walked through the code in a 3 node K8 cluster and doesn't seem like I am able to block the flow of traffic using networkpolicy on a deployment pod.</p>
<p>Here is the the output from the exercise.</p>
<pre><code>user@myk8master:~$ kubectl get deployment,svc,networkpolicy
NAME                 TYPE        CLUSTER-IP   EXTERNAL-IP   PORT(S)   AGE
service/kubernetes   ClusterIP   X.X.X.X    &lt;none&gt;        443/TCP   20d
user@myk8master:~$
user@myk8master:~$
user@myk8master:~$ kubectl create deployment nginx --image=nginx
deployment.apps/nginx created
user@myk8master:~$ kubectl expose deployment nginx --port=80
service/nginx exposed
user@myk8master:~$ kubectl run busybox --rm -ti --image=busybox -- /bin/sh
If you don't see a command prompt, try pressing enter.
/ # wget --spider --timeout=1 nginx
Connecting to nginx (X.X.X.X:80)
remote file exists
/ # exit
Session ended, resume using 'kubectl attach busybox -c busybox -i -t' command when the pod is running
pod &quot;busybox&quot; deleted
user@myk8master:~$
user@myk8master:~$
user@myk8master:~$ vi network-policy.yaml
user@myk8master:~$ cat network-policy.yaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: access-nginx
spec:
  podSelector:
    matchLabels:
      app: nginx
  ingress:
  - from:
    - podSelector:
        matchLabels:
          access: &quot;true&quot;

user@myk8master:~$
user@myk8master:~$
user@myk8master:~$ kubectl apply -f network-policy.yaml
networkpolicy.networking.k8s.io/access-nginx created
user@myk8master:~$
user@myk8master:~$
user@myk8master:~$ kubectl run busybox --rm -ti --image=busybox -- /bin/sh
If you don't see a command prompt, try pressing enter.
/ # wget --spider --timeout=1 nginx
Connecting to nginx (10.100.97.229:80)
remote file exists. &lt;&lt;&lt;&lt;  THIS SHOULD NOT WORK 
</code></pre>
<blockquote>
<p>I followed all the steps as is, but it seems like I am unable to block the traffic even with networkpolicy defined.</p>
</blockquote>
<p>Can someone please help and let me know if I am doing something dumb here?</p>

Shyam
<p>As described in the <a href="https://kubernetes.io/docs/concepts/services-networking/network-policies/" rel="nofollow noreferrer">documentation</a> , restricting client access should work by using a network plugin. Because of some conflict or glitch it may not restrict the access. So try to reinstall/reconfigure.</p>
<p>You can also try another method like blocking them in <a href="https://docs.nginx.com/nginx/admin-guide/security-controls/controlling-access-proxied-tcp/" rel="nofollow noreferrer">NGINX</a></p>
<p>You can restrict Access by IP Address. NGINX can allow or deny access based on a particular IP address or the range of IP addresses of client computers. To allow or deny access, use the allow and deny directives inside the stream context or a server block:</p>
<pre><code> stream {
     #...
     server {
       listen 12345;
       deny   192.168.1.2;
       allow  192.168.1.1/24;
       allow  2001:0db8::/32;
       deny   all;
     }
   }
</code></pre>
<p>Limiting the Number of TCP Connections. You can limit the number of simultaneous TCP connections from one IP address:</p>
<pre><code> stream {
   #...
   limit_conn_zone $binary_remote_addr zone=ip_addr:10m;
   #...
  }
</code></pre>
<p>you can also limit bandwidth and ip range etc.,Using NGINX is more flexible.</p>
<p>Refer to the <a href="https://kubernetes.io/docs/concepts/extend-kubernetes/compute-storage-net/network-plugins/" rel="nofollow noreferrer">link</a> for more information about network plugins.</p>
