K8s network policy restrict egress for one endpoint only-CodePudding

The

ping is a networking utility used to test the reachability of a remote host over Internet Protocol (IP). The ping utility does so by sending out a series of Internet Control Message Protocol (ICMP) echo request packets to a remote host.

You cannot probe a specific port with ping command because ICMP belongs to layer-3 IP layer, not layer-4 transport layer (e.g., TCP/UDP).

In order to ping a specific port of a remote host, you need to use layer-4 transport protocols which have a notion of port numbers, with many command-line tools like:

paping 140.224.232.236 -p 8080 -c 3

nmap -p 80 -sT www.google.com

tcpping www.google.com

CodePudding user response：

You are allowing egress traffic to port 8088 over TCP, not ICMP. Ping won't work with that applied.

If you want to allow a non-TPC nor UDP protocol using vanilla's Kubernetes API for network policies, then you need to omit the port definition.

You can also use a network policy API of Calico for this matter.

That gives more flexibility when it comes to configuring Network Policies in your cluster.