Egress from a payment Pod must be denied except DNS and one externa…

Question

Egress from a payment Pod must be denied except DNS and one external payment gateway IP. What NetworkPolicy pattern fits?

Accepted Answer

Apply egress policyTypes with allows for DNS and an ipBlock for the payment gateway CIDR only. — Egress default-deny is a locked outbound mail slot: poke holes only for DNS and that payment IP via ipBlock. Ingress-only policies, ExternalName Services, and privileged mode don't carve those holes correctly.

Answer

Use only an ingress NetworkPolicy; egress to the internet is never restricted by NetworkPolicies.

Answer

Set the Service type to ExternalName so all other egress is automatically blocked.

Answer

Add privileged: true on the Pod to bypass egress NetworkPolicies for payment traffic.

Egress from a payment Pod must be denied except DNS and one external payment gateway IP. What NetworkPolicy pattern fits?

Short Explanation

Full Explanation