Egress NetworkPolicy rules block pod outbound traffic. Fix by reviewing policy selectors, adding proper egress rules for DNS and external services.
Fixes EGRESS_BLOCKED
kubectl get networkpolicies -n <namespace>
kubectl describe networkpolicy -n <namespace> <policy-name>kubectl get networkpolicies -n <namespace>kubectl describe networkpolicy -n <namespace> <policy-name>NetworkPolicy blocking egress, connection timeout, access denied
NetworkPolicies can isolate pods by blocking ingress and egress traffic. When egress is blocked, pods can't reach external services, databases, or APIs.
kubectl get networkpolicies -n <namespace>
kubectl describe networkpolicy -n <namespace> <policy-name>egress:
- to:
- namespaceSelector: {}
podSelector:
matchLabels:
k8s-app: kube-dns
ports:
- protocol: UDP
port: 53
- protocol: TCP
port: 53egress:
- to:
- ipBlock:
cidr: 0.0.0.0/0
except:
- 169.254.169.254/32
ports:
- protocol: TCP
port: 443kubectl run test --rm -it --image=alpine -- wget https://example.comkubectl run debug --rm -it --image=nicolaka/netshoot -- sh
# Inside: curl, wget, dig, etc.Always allow DNS in egress policies. Deny rules are easier than allow rules.