I'm going through examples from a book on Kubernetes and I'm probably missing something.
There is a code snippet which should create a NetworkService which should allow inbound traffic on :8080 from pods with app=nginx-1 and, if I understood correctly, should deny any other traffic:
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: nginx-2-networkpolicy
spec:
podSelector:
matchLabels:
app: nginx-2
policyTypes:
- Ingress
ingress:
- from:
- podSelector:
matchLabels:
app: nginx-1
ports:
- protocol: TCP
port: 8080
It seems to be doing what I expect:
$ kubectl describe networkpolicies.networking.k8s.io nginx-2-networkpolicy
Name: nginx-2-networkpolicy
Namespace: default
Created on: 2022-09-19 23:29:14 +0100 BST
Labels: <none>
Annotations: <none>
Spec:
PodSelector: app=nginx-2
Allowing ingress traffic:
To Port: 8080/TCP
From:
PodSelector: app=nginx-1
Not affecting egress traffic
Policy Types: Ingress
Here are the pods:
$ kubectl get pods -o wide --show-labels
NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES LABELS
nginx-1 1/1 Running 0 5m20s 10.68.0.71 gke-test-gke-cluster-default-pool-f94145bd-0ddl <none> <none> app=nginx-1
nginx-2 1/1 Running 0 5m14s 10.68.0.72 gke-test-gke-cluster-default-pool-f94145bd-0ddl <none> <none> app=nginx-2
However, I'm still able to reach nginx-2 on ports other than 8080:
$ kubectl exec nginx-1 -- curl 10.68.0.72:80
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0<!DOCTYPE html>
<html>
<head>
<title>Welcome to nginx!</title>
...
Why isn't traffic on :80 blocked ? In the book, this results in a timeout. I tried denying all ingress traffic, but requests still go through. Looks like the policy just isn't applied; selector looks good to me, not sure what else I'm doing wrong.