<p>If I have a set of deployments that are connected using a NetworkPolicy ingress. It's work! However, if I have to connect from outside (IP got from kubectl get ep), I have to set another ingress to the endpoint? or egress policy?</p>
<pre><code>apiVersion: apps/v1
kind: Deployment
metadata:
  namespace: nginx
  annotations:
    kompose.cmd: ./kompose convert
    kompose.version: 1.22.0 (955b78124)
  creationTimestamp: null
  labels:
    io.kompose.service: nginx
  name: nginx
spec:
  replicas: 1
  selector:
    matchLabels:
      io.kompose.service: nginx
  strategy: {}
  template:
    metadata:
      annotations:
        kompose.cmd: ./kompose convert
        kompose.version: 1.22.0 (955b78124)
      creationTimestamp: null
      labels:
        io.kompose.network/nginx: &quot;true&quot;
        io.kompose.service: nginx
    spec:
      containers:
        - image: nginx
          name: nginx
          ports:
            - containerPort: 8000
          resources: {}
      restartPolicy: Always
status: {}
---
apiVersion: apps/v1
kind: Deployment
metadata:
  namespace: mariadb
  annotations:
    kompose.cmd: ./kompose convert
    kompose.version: 1.22.0 (955b78124)
  creationTimestamp: null
  labels:
    io.kompose.service: mariadb
  name: mariadb
spec:
  replicas: 1
  selector:
    matchLabels:
      io.kompose.service: mariadb
  strategy: {}
  template:
    metadata:
      annotations:
        kompose.cmd: ./kompose convert
        kompose.version: 1.22.0 (955b78124)
      creationTimestamp: null
      labels:
        io.kompose.network/nginx: &quot;true&quot;
        io.kompose.service: mariadb
    spec:
      containers:
        - image: mariadb
          name: mariadb
          ports:
            - containerPort: 5432
          resources: {}
      restartPolicy: Always
status: {}
...
</code></pre>
<p>You can see more code here <a href="http://pastie.org/p/2QpNHjFdAK9xj7SYuZvGPf" rel="nofollow noreferrer">http://pastie.org/p/2QpNHjFdAK9xj7SYuZvGPf</a></p>
<p>Endpoints:</p>
<pre><code>kubectl get ep -n nginx
NAME       ENDPOINTS             AGE
mariadb  192.168.112.203:5432  2d2h
nginx     192.168.112.204:8000  42h
</code></pre>
<p>Services:</p>
<pre><code>NAME       TYPE       CLUSTER-IP     EXTERNAL-IP  PORT(S)         AGE
mariadb ClusterIP  10.99.76.78    &lt;none&gt;       5432/TCP        2d2h
nginx     NodePort   10.111.176.21  &lt;none&gt;       8000:31604/TCP  42h
</code></pre>
<p>Tests from server:</p>
<pre><code>If I do curl 10.111.176.21:31604 -- No answer
If I do curl 192.168.112.204:8000 -- No answer
If I do curl 192.168.112.204:31604 -- No answer
If I do curl 10.0.0.2:8000 or 31604 -- No answer
10.0.0.2 is a worker node IP.
</code></pre>
<p><strong>UPDATED</strong> If I do <code>kubectl port-forward nginx-PODXXX 8000:8000</code>
I can access it from HTTP://localhost:8000</p>
<p>So What's I am wrong in on?</p>

sincorchetes
<p>It looks like you're using the <a href="https://kubernetes.io/docs/concepts/services-networking/network-policies/" rel="nofollow noreferrer">Network Policy</a> <em>as</em> an ingress for incoming traffic, but what you probably want to be using is an <a href="https://kubernetes.io/docs/concepts/services-networking/ingress-controllers/" rel="nofollow noreferrer">Ingress Controller</a> to manage <a href="https://kubernetes.io/docs/concepts/services-networking/ingress/" rel="nofollow noreferrer">Ingress</a> traffic.</p>
<p>Egress is for traffic flowing outbound from your services within your cluster to external sources. Ingress is for external traffic to be directed to specific services within your cluster.</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: my-app-ingress
  annotations:
    nginx.ingress.kubernetes.io/rewrite-target: /
spec:
  rules:
    - host: my-example.site.tld
      http:
        paths:
          - path: /
            backend:
              serviceName: nginx
              servicePort: 5432
</code></pre>
