<p>I'm facing a weird issue on setting up egress network policy on my kube cluster.</p>
<p>Basically I want my pod A to access only pod B.</p>
<p>I have two pods:</p>
<ol>
<li>hello-k8s-deploy</li>
<li>nginx</li>
</ol>
<p>The hello-k8s-deploy pod expose an API on port <code>8080</code> via NodePort.
My nginx pod is simply an image to access the API.</p>
<p>So let's try logging in to the nginx pod and access that API exposed by the hello-k8s-deploy pod.</p>
<p><a href="https://i.stack.imgur.com/wQquJ.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/wQquJ.png" alt="enter image description here" /></a></p>
<p>Above shows that the API responded back with message starts with <code>Hello K8s!</code></p>
<p>Now let's apply the network policy on my nginx pod so it can access only this API, nothing else.</p>
<p><strong>Network policy:</strong></p>
<pre><code>apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: test-network-policy
  namespace: app
spec:
  podSelector:
    matchLabels:
      run: nginx
  egress:
    - to:
      - podSelector:
          matchLabels:
            app: hello-k8s-deploy
  policyTypes:
   - Egress
</code></pre>
<p>Above policy will be applied to pod with label <code>run: nginx</code></p>
<p>And the rule is allow traffic to pod with label  <code>app: hello-k8s-deploy</code></p>
<p>Let's validate it by looking at the definition of both of the pods nginx and hello-k8s-deploy</p>
<p><strong>nginx:</strong></p>
<p><a href="https://i.stack.imgur.com/g3jWz.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/g3jWz.png" alt="enter image description here" /></a></p>
<p><strong>hello-k8s-deploy</strong></p>
<p><a href="https://i.stack.imgur.com/07lWX.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/07lWX.png" alt="enter image description here" /></a></p>
<p>As we can see both labels are matching the Network policy.</p>
<p>After I applied the network policy and access the nginx again I expect to work the same and get a response from the API but I'm getting the below error.</p>
<p><a href="https://i.stack.imgur.com/LmT7N.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/LmT7N.png" alt="enter image description here" /></a></p>
<p><strong>Take note that:</strong></p>
<ol>
<li>All of the resources are in the same namespace <code>app</code></li>
<li>My network addon is weave-net which has support for network policy as per documentation.</li>
<li>I even tried to specify the namespace selector and add port 8080.</li>
</ol>

Ruelos Joel
<p>I finally resolved the issue, basically the problem I was getting is <code>could not resolve host hello-k8s-svc</code>. It means k8s is trying to connect using this host and resolving through dns name (service name).</p>
<p>And since my pod is only allowing egress to hello-k8s-deploy, it's failing as it also needs to connect to kube-dns for resolving the dns. So before you apply an egress make sure the pod or all pods in your namespace are allowing to connect to kube-dns for dns resolution.</p>
<p>The fix is simply creating an egress resource to all pods to connect to kube-dns on top of your pod specific egress configuration.</p>
<pre><code>apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-all-egress
spec:
  podSelector: {}
  egress:
  - to:
    - namespaceSelector:
        matchLabels:
          networking/namespace: kube-system
      podSelector:
        matchLabels:
          k8s-app: kube-dns
    ports:
    - protocol: TCP
      port: 53
    - protocol: UDP
      port: 53
  policyTypes:
  - Egress
</code></pre>
<p>In my case I labeled the kube-system namespace:</p>
<pre><code> kubectl label namespace kube-system networking/namespace=kube-system
</code></pre>
