The network policy works fine on calico.
Network Policy has no effect on cluster using flannel network plugin.
As mentioned on this link Flannel is focused on networking. For network policy, other projects such as Calico can be used.
Network policy blocks traffic as expected on cluster using calico
I have two clusters one using flannel and one using calico and test works as expected on calico.
Logs :
$ kubectl apply -f networkpolicy.yaml
networkpolicy.networking.k8s.io/foo-deny-external-egress created
ubuntu@calico-master-1:~$ kubectl run busybox --image=busybox --restart=Never -- sleep 3600
pod/busybox created
$ kubectl get networkpolicy
NAME POD-SELECTOR AGE
foo-deny-external-egress run=busybox 30m
$ kubectl exec -it busybox -- /bin/sh
/ # wget https://google.com
Connecting to google.com (74.125.193.102:443)
wget: can't connect to remote host (74.125.193.102): Connection timed out
On cluster using Flannel creating network policy has no effect
ubuntu@k8s-flannel:~$ kubectl exec -it busybox -- /bin/sh
/ # curl https://google.com
/bin/sh: curl: not found
/ # wget https://google.com
Connecting to google.com (216.58.207.238:443)
wget: note: TLS certificate validation not implemented
Connecting to www.google.com (172.217.20.36:443)
saving to 'index.html'
index.html 100% |*************************************************************************************************************************************************| 12498 0:00:00 ETA
'index.html' saved
Apply policy
$ kubectl apply -f networkpolicy.yaml
networkpolicy.networking.k8s.io/foo-deny-external-egress created
$ kubectl get networkpolicy
NAME POD-SELECTOR AGE
foo-deny-external-egress run=busybox 32m
We can still get to network outside as network policy does not work on flannel.
$ kubectl exec -it busybox -- /bin/sh
/ # wget https://google.com
Connecting to google.com (172.217.22.174:443)
wget: note: TLS certificate validation not implemented
Connecting to www.google.com (172.217.20.36:443)
saving to 'index.html'
index.html 100% |*************************************************************************************************************************************************| 12460 0:00:00 ETA
'index.html' saved
apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: default-deny-all-egress spec: podSelector: {} policyTypes: - Egress
i.e exclude the DNS port 53 as well?? – DT. Jan 30 '20 at 17:52