Hi team, I have one more doubt where I think the video lecture is not in sync w . . .

Mayur Sharma:
Hi team,

I have one more doubt where I think the video lecture is not in sync with kubernetes documentation for Network Policy. Timeline: 5:30 (I could be wrong, please correct me)

In " 104. Develop network policies" video, it is mentioned that if only podSelector is defined under ingress:from element, then the connection is allowed from all the pods from all the namespaces.
I found this statement contradictory with the documentation of network policy, quoting it here,
podSelector: This selects particular Pods in the same namespace as the NetworkPolicy which should be allowed as ingress sources or egress destinations.”
Source - https://kubernetes.io/docs/concepts/services-networking/network-policies/#networkpolicy-resource

I tried the above doubt with following scenario,

  1. created the nginx pod in default namespace and expose its pod at 80 with label role: app
  2. Then I created the busybox container in other namespace with label access: app and try to connect to service nginx.default (Success)
  3. Then I created the netpol, with below content
  4. Then I again when I repeated #2, it FAILED (success if I access it from same namespace)
    {code}
    apiVersion: http://networking.k8s.io/v1|networking.k8s.io/v1
    kind: NetworkPolicy
    metadata:
    name: test-network-policy
    namespace: default
    spec:
    podSelector:
    matchLabels:
    role: app
    policyTypes:
  • Ingress
    ingress:
  • from:
    • podSelector:
      matchLabels:
      access: app
      {code}
      Please correct me if I understood anything wrongly.

Thanks!

lagisetti sambasiva rao:
Hi Mayur, looks like you missed to add namespaceselector in network-policy yaml file, Here is 2 tasks you needs to correct it, i tried to reproduce the issue in my local tested , its worked for me.

lagisetti sambasiva rao:

  1. Add the lablel to nasmespace in 2nd step 2. then add the same label in namespace selector in network policy file.

lagisetti sambasiva rao:
kubectl create ns dev
kubectl label ns dev env=dev

lagisetti sambasiva rao:
apiVersion: http://networking.k8s.io/v1|networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: test-netpol
namespace: default
spec:
podSelector:
matchLabels:
role: app
policyTypes:

  • Ingress
  • Egress
    ingress:
  • from:
    • namespaceSelector:
      matchLabels:
      env: dev
    • podSelector:
      matchLabels:
      access: app