Kubernetes NetworkPolicy无法覆盖全量出口允许策略，特定Pod仍可访问外网

Kubernetes NetworkPolicy的核心生效逻辑是：只要有任意一个选中目标Pod的NetworkPolicy允许某类流量，该流量就会被放行。

你当前的allow-default和allow-egress两个Policy的podSelector都是{}，会选中命名空间内所有Pod（包括带app: localstack-server标签的Pod），且这两个Policy都明确允许了所有出站流量（allow-egress甚至直接允许了0.0.0.0/0的IP段）。因此，即使你新增了针对该Pod的无Egress规则的Policy，也无法覆盖已存在的允许规则——只要有允许规则生效，流量就会被放行。

要实现阻止app: localstack-server Pod的所有出站流量，需要先让现有允许所有流量的Policy不选中该Pod，再应用你的拒绝策略。

步骤1：修改现有允许Policy，排除目标Pod #

修改allow-default的podSelector，添加否定匹配规则：

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-default
  namespace: sample-namespace
spec:
  podSelector:
    matchExpressions:
    - key: app
      operator: NotIn
      values:
      - localstack-server
  policyTypes:
  - Ingress
  - Egress
  egress:
  - to:
    - podSelector: {}
  ingress:
  - from:
    - podSelector: {}

修改allow-egress的podSelector，同样添加否定匹配：

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-egress
  namespace: sample-namespace
spec:
  podSelector:
    matchExpressions:
    - key: app
      operator: NotIn
      values:
      - localstack-server
  policyTypes:
  - Egress
  egress:
  - to:
    - podSelector: {}
    - ipBlock:
        cidr: 0.0.0.0/0
  - ports:
    - port: 53
      protocol: UDP
    - port: 53
      protocol: TCP

步骤2：应用你的拒绝策略 #

保持你原有的psp-localstack-default-deny-egress Policy不变，重新应用：

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: psp-localstack-default-deny-egress
  namespace: sample-namespace
spec:
  podSelector:
    matchLabels:
      app: localstack-server
  policyTypes:
  - Egress

验证效果 #

此时，app: localstack-server Pod只会被psp-localstack-default-deny-egress选中，该Policy未定义任何允许的Egress规则，因此所有出站流量都会被拒绝。你可以再次执行curl www.example.com验证是否无法访问。

内容的提问来源于stack exchange，提问作者Vishwanath Joshi