<p><strong>The Problem</strong></p>
<p>I've defined a kubernetes <code>egress</code> rule from pod <code>test-1</code> to a specific pod <code>test-2</code>, but this rule blocks also blocks traffic from <code>test-1</code> to <code>test-2</code>:</p>
<ol>
<li>I've created two pods: <code>test-1</code> and <code>test-2</code></li>
<li>I've created a networkpolicy that allows only <code>egress</code> traffic from <code>test-1</code> to <code>test-2</code></li>
<li>I've tried to call <code>test-2</code> from <code>test-1</code> by <code>curl test-2</code>. But this call is blocked!</li>
<li>I've checked the selectors</li>
</ol>
<p>Both selectors return the expected pod:</p>
<pre><code>kubectl describe networkpolicies test-1-policy
kubectl get pod --selector app.kubernetes.io/name=test-1
kubectl get pod --selector app.kubernetes.io/name=test-2
</code></pre>
<p>When I remove the <code>networkpolicy</code> the connect by <code>curl test-2</code> works.</p>
<p><strong>My Question: What did I miss?</strong></p>
<p><strong>Here's how to reproduce the problem</strong></p>
<ol>
<li>Paste yaml into file <code>deployment.yaml</code> (see below)</li>
<li>Deploy demo <code>kubectl apply -f deployment.yaml</code></li>
<li>Exec into pod: <code>kubectl exec --stdin --tty $(kubectl get pod -l app.kubernetes.io/name=test-1 -o jsonpath=&quot;{.items[0].metadata.name}&quot;) -- /bin/bash</code></li>
<li>Call request in pod: <code>curl test-2</code> =&gt; <strong>request is blocked</strong></li>
<li>Remove networkpolicy: <code>kubectl delete networkpolicy test-1-policy</code></li>
<li>Exec in pod and call request =&gt; <strong>request is executed</strong></li>
</ol>
<p>Here's the complete yaml:</p>
<pre><code>apiVersion: apps/v1
kind: Deployment
metadata:
  name: test-1
  labels:
    app.kubernetes.io/name: test-1
spec:
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/name: test-1
  template:
    metadata:
      labels:
        app.kubernetes.io/name: test-1
    spec:
      containers:
        - name: nginx
          image: nginx
          ports:
            - name: http
              containerPort: 80
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: test-2
  labels:
    app.kubernetes.io/name: test-2
spec:
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/name: test-2
  template:
    metadata:
      labels:
        app.kubernetes.io/name: test-2
    spec:
      containers:
        - name: nginx
          image: nginx
          ports:
            - name: http
              containerPort: 80
---
apiVersion: v1
kind: Service
metadata:
  name: test-1
  labels:
    app.kubernetes.io/name: test-1
spec:
  type: ClusterIP
  ports:
    - port: 80
      targetPort: http
      name: http
  selector:
    app.kubernetes.io/name: test-1
---
apiVersion: v1
kind: Service
metadata:
  name: test-2
  labels:
    app.kubernetes.io/name: test-2
spec:
  type: ClusterIP
  ports:
    - port: 80
      targetPort: http
      name: http
  selector:
    app.kubernetes.io/name: test-2
---
kind: NetworkPolicy
apiVersion: networking.k8s.io/v1
metadata:
  name: test-1-policy
spec:
  podSelector:
    matchLabels:
      app.kubernetes.io/name: test-1
  policyTypes:
    - Ingress
    - Egress
  ingress: []
  egress:
    - to:
        - podSelector:
            matchLabels:
              app.kubernetes.io/name: test-2
      ports:
        - port: 80
          protocol: TCP
</code></pre>

Matthias M
<p>The dns <code>egress</code> rule is missing:</p>
<p>When you add the <code>egress</code> rules for <code>port 53</code> everything works as expected:</p>
<pre><code>  egress:
    - ports:
      - port: 53
        protocol: UDP
      - port: 53
        protocol: TCP
</code></pre>
<p><a href="https://github.com/ahmetb/kubernetes-network-policy-recipes/blob/master/11-deny-egress-traffic-from-an-application.md" rel="nofollow noreferrer">https://github.com/ahmetb/kubernetes-network-policy-recipes/blob/master/11-deny-egress-traffic-from-an-application.md</a></p>
