DEV Community

Cheedge Lee
Cheedge Lee

Posted on

Typo caused difference in NetworkPolicy yaml file

Check following two networkpolicy yaml file, np1.yaml and np2.yaml:

# np1.yaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: np
  namespace: space1
spec:
  podSelector: {}
  policyTypes:
  - Egress
  egress:
  - to:
    - namespaceSelector:
        matchLabels:
          kubernetes.io/metadata.name: space2
    ports:
    - port: 53
      protocol: UDP
    - port: 53
      protocol: TCP
Enter fullscreen mode Exit fullscreen mode
# np2.yaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: np
  namespace: space1
spec:
  podSelector: {}
  policyTypes:
  - Egress
  egress:
  - to:
     - namespaceSelector:
        matchLabels:
         kubernetes.io/metadata.name: space2
  - ports:
    - port: 53
      protocol: TCP
    - port: 53
      protocol: UDP
Enter fullscreen mode Exit fullscreen mode

Looks similar, but a tiny typo here caused some different results.
If we check carefully will find that in the np2.yaml, it gives two separated restrictions on egress:

  1. allows traffic to all pods in the namespace space2 without specifying any ports.
  2. allows traffic to any destination on ports 53 (TCP and UDP) -- DNS traffic.

The "-" indicates separate rules in YAML. In the np1.yaml, the two rules are logically OR: Traffic matches if it satisfies either the first rule (namespace match) or the second rule (ports match).

While in the np2.yaml, the to and ports are part of a single rule, which requires traffic to satisfy both constraints (namespace match and port match), literally it's an AND relationship.

In Summary, in np1.yaml it has two rules: egress.to and egress.ports; in np2.yaml there only one rule: egress.to, but under to field, there is a egress.to.ports field.

Postmark Image

Speedy emails, satisfied customers

Are delayed transactional emails costing you user satisfaction? Postmark delivers your emails almost instantly, keeping your customers happy and connected.

Sign up

Top comments (0)

Image of Docusign

🛠️ Bring your solution into Docusign. Reach over 1.6M customers.

Docusign is now extensible. Overcome challenges with disconnected products and inaccessible data by bringing your solutions into Docusign and publishing to 1.6M customers in the App Center.

Learn more