What is Kubernetes Network Policy Egress?

Question

Accepted Answer

**Egress Policy** — control outbound traffic from Pods.

```yaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-egress
  namespace: production
spec:
  podSelector:
    matchLabels:
      app: myapp
  policyTypes:
  - Egress
  egress:
  # Allow DNS
  - to:
    - namespaceSelector: {}
    ports:
    - protocol: UDP
      port: 53
    - protocol: TCP
      port: 53
  # Allow PostgreSQL in same namespace
  - to:
    - podSelector:
        matchLabels:
          app: postgres
    ports:
    - protocol: TCP
      port: 5432
  # Allow external API
  - to:
    - ipBlock:
        cidr: 104.16.0.0/12  # Cloudflare
    ports:
    - protocol: TCP
      port: 443
  # Block all other egress
  # (implicit deny-all when policyTypes includes Egress)
```

```bash
# Commands
kubectl get networkpolicy -n production
kubectl describe networkpolicy allow-egress -n production

# Test egress
kubectl exec -it my-pod -- wget -qO- https://api.example.com  # Should work
kubectl exec -it my-pod -- curl http://random-site.com  # Should fail
kubectl exec -it my-pod -- nslookup postgres  # Should work

# Check NetworkPolicy status
kubectl get networkpolicy -n production -o wide
kubectl describe networkpolicy -n production
```

**Egress Rules:**
- to: destination selector.
- ports: allowed ports.
- ipBlock: CIDR ranges.
- namespaceSelector: cross-namespace.

**Best Practices:**
- Always allow DNS egress.
- Use ipBlock for external services.
- Test with deny-all first.

DevOps: What is Kubernetes Network Policy Egress?