client in abyss-1qv82ep can reach everything. Restrict it to market-web only:
sh
kubectl apply -n abyss-1qv82ep -f - <<EOF
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: client-egress
spec:
podSelector:
matchLabels:
app: client
policyTypes: [Egress]
egress:
- to:
- podSelector:
matchLabels:
app: market-web
EOF
kubectl exec client -n abyss-1qv82ep -- wget -qO- -T 1 market-web
kubectl exec client -n abyss-1qv82ep -- nslookup market-webAdd the DNS rule as a second item in the egress list and apply again:
yaml
- to:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: kube-system
ports:
- port: 53
protocol: UDPsh
kubectl exec client -n abyss-1qv82ep -- wget -qO- -T 1 market-web
kubectl exec client -n abyss-1qv82ep -- wget -qO- -T 1 market-api:8080/healthz