<p>When enabling only egress network policies, all readiness and liveness checks fail after pods are restarted.</p>
<p>This is what I see when describing the pod:</p>
<p>Warning  Unhealthy  115s (x7 over 2m55s)  kubelet,   Readiness probe failed: Get <a href="http://10.202.158.105:80/health/ready" rel="noreferrer">http://10.202.158.105:80/health/ready</a>: dial tcp 10.202.158.105:80: connect: connection refused
Warning  Unhealthy  115s (x7 over 2m55s)  kubelet,   Liveness probe failed: Get <a href="http://10.202.158.105:80/health/live" rel="noreferrer">http://10.202.158.105:80/health/live</a>: dial tcp 10.202.158.105:80: connect: connection refused</p>
<p>Immediately, if I disable the policies, the health checks will resume functioning. If the pod is already healthy before applying the network policies, it will continue to work.</p>
<p>I've also tried to whitelist every namespace with this policy:</p>
<pre><code>apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-ingress-all
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  ingress:
  - from:
    - namespaceSelector: {}
    ports:
    - protocol: TCP
      port: 80
    - protocol: TCP
      port: 8080
</code></pre>
<p>I'm having a hard time finding any guidance on how to resolve this. Is there an egress policy that would need enabled to allow kubelet to monitor the pods health checks?</p>
<p>The pod is running inside of Azure Kubernetes Services and using Calico networking.</p>

nbrink
<p>It looks like the kube-probe uses the .1 address of each <a href="https://kubernetes.io/docs/concepts/cluster-administration/networking/#the-kubernetes-network-model" rel="nofollow noreferrer">pod cidr</a> in AKS. I believe that will be the address the linux bridge is assigned on the agent pool VM, so the host chooses it as the cheapest route to the pods.</p>
<p>There is no pod with this address so I can't see how it can be matched by a selector, unless AKS has some magic built in to their <a href="https://learn.microsoft.com/en-us/azure/aks/use-network-policies#network-policy-options-in-aks" rel="nofollow noreferrer">implementation</a>.</p>
<pre><code>kubectl get pods --all-namespaces -o json \
  | jq -r '.items[] | [ .status.podIP, .metadata.name ] | join(&quot;\t&quot;)'
</code></pre>
<p>The policy could be made to work with a specific rule for the source <code>.1</code> IP of all the pod CIDR's.</p>
<pre><code>kubectl get nodes -o json \
  | jq '.items[] | [ .metadata.name, .spec.podCIDR ]'
[
  &quot;aks-agentpool-12345678-vmss000000&quot;,
  &quot;10.212.0.0/24&quot;
]
[
  &quot;aks-agentpool-12345678-vmss000001&quot;,
  &quot;10.212.1.0/24&quot;
]
</code></pre>
<p>So that would be an <code>ipBlock</code> for each node:</p>
<pre><code>  ingress:
  - from:
    - ipBlock:
        cidr: 10.212.0.1/32
    - ipBlock:
        cidr: 10.212.1.1/32
</code></pre>
<p>Which is a bit horrible as it's per cluster and per node pool configuration. I only dabble with AKS so there might be a better solution. If you can't find anything else I'd file a bug on <a href="https://github.com/Azure/AKS/" rel="nofollow noreferrer">https://github.com/Azure/AKS/</a></p>
