Ingress and egress rules in Kubernetes - Commands & Configuration

Introduction

Ingress and egress rules control the traffic coming into and going out of your Kubernetes pods. They help keep your applications safe by allowing only the right network connections.

When you want to allow web traffic to reach your app but block other unwanted traffic.

When your app needs to connect to a database outside the cluster and you want to allow only that connection.

When you want to block all internet access from your pods except to specific services.

When you want to limit which pods can talk to each other inside the cluster.

When you want to monitor or control network traffic for security or compliance.

Config File - network-policy.yaml

network-policy.yaml

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-web-ingress
  namespace: default
spec:
  podSelector:
    matchLabels:
      app: my-app
  policyTypes:
  - Ingress
  - Egress
  ingress:
  - from:
    - ipBlock:
        cidr: 0.0.0.0/0
    ports:
    - protocol: TCP
      port: 80
  egress:
  - to:
    - ipBlock:
        cidr: 10.0.0.0/24
    ports:
    - protocol: TCP
      port: 5432

This NetworkPolicy allows incoming traffic on port 80 (HTTP) from anywhere to pods labeled app: my-app in the default namespace. It also allows outgoing traffic from these pods to IP addresses in the 10.0.0.0/24 range on port 5432 (commonly used by PostgreSQL).

podSelector selects the pods this policy applies to. policyTypes defines that both ingress and egress rules are set. ingress and egress sections define allowed incoming and outgoing traffic respectively.

Commands

This command applies the network policy to your Kubernetes cluster, creating rules for ingress and egress traffic for the selected pods.

Terminal

kubectl apply -f network-policy.yaml

Expected Output

networkpolicy.networking.k8s.io/allow-web-ingress created

This command shows the details of the applied network policy to verify it is created correctly.

Terminal

kubectl get networkpolicy allow-web-ingress -o yaml

Expected Output

apiVersion: networking.k8s.io/v1

kind: NetworkPolicy

metadata:

  name: allow-web-ingress

  namespace: default

spec:

  podSelector:

    matchLabels:

      app: my-app

  policyTypes:

  - Ingress

  - Egress

  ingress:

  - from:

    - ipBlock:

        cidr: 0.0.0.0/0

    ports:

    - protocol: TCP

      port: 80

  egress:

  - to:

    - ipBlock:

        cidr: 10.0.0.0/24

    ports:

    - protocol: TCP

      port: 5432

→

-o yaml - Shows the full details of the network policy in YAML format

This command provides a human-readable summary of the network policy, showing which pods it applies to and the allowed ingress and egress rules.

Terminal

kubectl describe networkpolicy allow-web-ingress

Expected Output

Name:         allow-web-ingress

Namespace:    default

Labels:       <none>

Annotations:  <none>



PodSelector:  app=my-app

PolicyTypes:  Ingress, Egress



Ingress:

  From:

    IPBlock: 0.0.0.0/0

  Ports:

    TCP:80



Egress:

  To:

    IPBlock: 10.0.0.0/24

  Ports:

    TCP:5432

Key Concept

If you remember nothing else from this pattern, remember: ingress rules control incoming traffic to pods, egress rules control outgoing traffic from pods.

Common Mistakes

Not specifying podSelector in the NetworkPolicy

Without podSelector, the policy does not apply to any pods, so no traffic is controlled.

Always include podSelector to target the pods you want to control.

Assuming NetworkPolicy allows all traffic by default

When any NetworkPolicy selects a pod, all other traffic is blocked unless explicitly allowed.

Explicitly allow all needed ingress and egress traffic in your policy.

Using incorrect port numbers or protocols

Traffic will be blocked if ports or protocols do not match the actual service ports.

Double-check port numbers and protocols match your application requirements.

Summary

Create a NetworkPolicy YAML file to define ingress and egress rules for selected pods.

Apply the policy using kubectl apply to enforce traffic rules.

Verify the policy with kubectl get and kubectl describe commands.

Practice

1. What do Ingress rules control in Kubernetes NetworkPolicies?

easy

A. CPU resource limits for pods

B. Incoming traffic to pods

C. Storage access for pods

D. Outgoing traffic from pods

Solution

1. Step 1: Understand the role of Ingress rules

   Ingress rules specify which incoming network traffic is allowed to reach the pods.

2. Step 2: Differentiate from Egress rules

   Egress rules control outgoing traffic, not incoming.

3. Final Answer:

   Incoming traffic to pods -> Option B

4. Quick Check:

   Ingress = Incoming traffic [OK]

Hint: Ingress means incoming traffic control [OK]

Common Mistakes:

• Confusing ingress with egress
• Thinking ingress controls resource limits
• Mixing network traffic with storage access

2. Which of the following is the correct syntax to allow all incoming traffic from pods in namespace frontend using a NetworkPolicy ingress rule?

easy

A. ingress:
- from:
- namespaceSelector:
matchLabels:
name: frontend

B. egress:
- to:
- namespaceSelector:
matchLabels:
name: frontend

C. ingress:
- to:
- namespaceSelector:
matchLabels:
name: frontend

D. egress:
- from:
- namespaceSelector:
matchLabels:
name: frontend

Solution

1. Step 1: Identify ingress rule syntax

   Ingress rules use ingress: with from: to specify allowed sources.

2. Step 2: Confirm namespaceSelector usage

   Using namespaceSelector with matchLabels is correct to select pods in a namespace.

3. Final Answer:

   ingress: - from: - namespaceSelector: matchLabels: name: frontend -> Option A

4. Quick Check:

   Ingress uses 'from' to allow incoming traffic [OK]

Hint: 'ingress' with 'from' allows incoming traffic sources [OK]

Common Mistakes:

• Using 'to' instead of 'from' in ingress
• Confusing ingress with egress syntax
• Misplacing namespaceSelector under egress

3. Given this NetworkPolicy snippet, what traffic is allowed?

egress:
  - to:
    - ipBlock:
        cidr: 10.0.0.0/24
        except:
        - 10.0.0.5/32

medium

A. All outgoing traffic to 10.0.0.0/24 except 10.0.0.5

B. All incoming traffic from 10.0.0.0/24 except 10.0.0.5

C. All outgoing traffic to 10.0.0.5 only

D. All incoming traffic from 10.0.0.5 only

Solution

1. Step 1: Analyze egress rule with ipBlock

   The rule allows outgoing traffic to IPs in 10.0.0.0/24 except 10.0.0.5.

2. Step 2: Confirm direction and exceptions

   Egress means outgoing traffic; 'except' excludes 10.0.0.5 from allowed IPs.

3. Final Answer:

   All outgoing traffic to 10.0.0.0/24 except 10.0.0.5 -> Option A

4. Quick Check:

   Egress with ipBlock except excludes IPs [OK]

Hint: Egress 'to' with ipBlock allows excepted IPs blocked [OK]

Common Mistakes:

• Confusing ingress with egress direction
• Misreading 'except' as allowed IP
• Mixing incoming and outgoing traffic

4. You wrote this NetworkPolicy egress rule but pods still cannot reach external IPs:

egress:
  - from:
    - ipBlock:
        cidr: 0.0.0.0/0

What is the error?

medium

A. NetworkPolicy must not have egress rules

B. CIDR 0.0.0.0/0 is invalid

C. Missing 'ports' section

D. Egress rules use 'to', not 'from'

Solution

1. Step 1: Check egress rule syntax

   Egress rules specify destinations with 'to', not 'from'. Using 'from' is invalid here.

2. Step 2: Understand correct usage

   Correct egress syntax uses 'to' to define allowed outgoing IP blocks.

3. Final Answer:

   Egress rules use 'to', not 'from' -> Option D

4. Quick Check:

   Egress uses 'to' for destinations [OK]

Hint: Egress rules always use 'to' keyword [OK]

Common Mistakes:

• Using 'from' in egress rules
• Assuming CIDR 0.0.0.0/0 is invalid
• Thinking ports are always required

5. You want to restrict pods to only receive traffic from pods in the same namespace and send traffic only to a specific external IP range 192.168.1.0/24. Which NetworkPolicy configuration achieves this?

hard

A. ingress:
- from:
- podSelector: {}
egress:
- from:
- ipBlock:
cidr: 192.168.1.0/24

B. ingress:
- from:
- namespaceSelector: {}
egress:
- to:
- ipBlock:
cidr: 10.0.0.0/24

C. ingress:
- from:
- podSelector: {}
egress:
- to:
- ipBlock:
cidr: 192.168.1.0/24

D. ingress:
- to:
- podSelector: {}
egress:
- to:
- ipBlock:
cidr: 192.168.1.0/24

Solution

1. Step 1: Configure ingress to allow same-namespace pods

   Using podSelector: {} allows traffic from all pods in the same namespace.

2. Step 2: Configure egress to allow only specific external IP range

   Egress uses to with ipBlock for 192.168.1.0/24 to restrict outgoing traffic.

3. Final Answer:

   ingress: - from: - podSelector: {} egress: - to: - ipBlock: cidr: 192.168.1.0/24 -> Option C

4. Quick Check:

   Ingress 'from' podSelector + Egress 'to' ipBlock [OK]

Hint: Ingress uses 'from' podSelector; egress uses 'to' ipBlock [OK]

Common Mistakes:

• Using 'from' in egress rules
• Using namespaceSelector instead of podSelector for ingress
• Mixing 'to' and 'from' keywords incorrectly