NetworkPolicy explainer
See what a NetworkPolicy allows in plain words, and test whether one pod can reach another.
Runs locally. Nothing you paste leaves this tab.
Test a connection
Rules to remember
- Pods are open until a policy selects them. Once any policy selects a pod for Ingress or Egress, only what some policy allows gets through.
- Policies add up. There is no deny rule: you cannot block what another policy allows.
- A connection needs both sides: egress allowed from the source and ingress allowed to the destination.
- Items in a
fromortolist are OR. Selectors inside the same item are AND. - Every namespace has the label
kubernetes.io/metadata.name, so you can select a namespace by name. - Policies need a CNI that enforces them (Azure NPM, Calico, Cilium). Without one they are silently ignored.
kubectl get networkpolicy -A
kubectl run tmp --rm -it --image=nicolaka/netshoot -n prod -l app=web -- curl -m 3 api:8080