title: Kubernetes network policy egress ports
body: <p>I have the following network policy for restricting access to a frontend service page: </p>
  
  <pre><code>apiVersion: networking.k8s.io/v1
  kind: NetworkPolicy
  metadata:
    namespace: namespace-a
    name: allow-frontend-access-from-external-ip
  spec:
    podSelector:
      matchLabels:
        app: frontend-service
    ingress:
      - from:
          - ipBlock:
              cidr: 0.0.0.0/0
          ports:
            - protocol: TCP
              port: 443
    egress:
      - to:
          - ipBlock:
              cidr: 0.0.0.0/0
          ports:
            - protocol: TCP
              port: 443
  </code></pre>
  
  <p>My question is: can I enforce HTTPS with my egress rule (port restriction on 443) and if so, how does this work? Assuming a client connects to the frontend-service, the client chooses a random port on his machine for this connection, how does Kubernetes know about that port, or is there a kind of port mapping in the cluster so the traffic back to the client is on port 443 and gets mapped back to the clients original port when leaving the cluster?</p>