Example Documentation: NetworkPolicy Troubleshooting
Goal
Break a working connection with default-deny and then allow it again step by step.
What Is Done
Frontend and backend work first without policies. Default-deny then blocks traffic. DNS egress and backend traffic are allowed separately afterwards.
Typical Commands
kubectl apply -f manifests/00-workloads.yaml
kubectl exec -n netpol-troubleshooting deploy/frontend -- wget -qO- http://backend:8080
kubectl apply -f manifests/10-default-deny.yaml
kubectl apply -f manifests/20-allow-dns.yaml
kubectl apply -f manifests/30-allow-backend.yaml
Validate Success
- Access works before default-deny.
- Access fails after default-deny.
- Access works again after DNS and backend allowances.
Common Mistakes
- Only backend ingress is allowed, but frontend egress is forgotten.
- DNS is not allowed.
- The CNI plugin does not support NetworkPolicies.