Question

A namespace 'payments' has no NetworkPolicies. You apply a single NetworkPolicy that selects all pods in the namespace, sets 'policyTypes: [Ingress]', and defines one ingress rule allowing traffic only from pods labeled 'app=frontend'. After applying it, the payments pods can no longer reach the external billing API on the internet, even though the ingress rule seems unrelated to outbound traffic. What is the actual cause of the broken outbound connectivity?

Accepted Answer

Because 'policyTypes' includes only Ingress, egress traffic remains completely unaffected, so the outage must be caused by something other than this policy.

Answer

Defining any NetworkPolicy that selects the pods automatically applies a default-deny to both ingress and egress regardless of the policyTypes field.

Answer

The ingress rule's podSelector 'app=frontend' also filters return traffic for outbound connections, dropping the API responses.

Answer

NetworkPolicies require an explicit egress allow-all rule whenever any ingress rule is defined, otherwise egress is denied.