title: Kubernetes NetworkPolicy allow loadbalancer
body: <p>I have a Kubernetes cluster running on Google Kubernetes Engine (GKE) with network policy support enabled.
  I created an nginx deployment and load balancer for it:</p>
  
  <pre><code>kubectl run nginx --image=nginx
  kubectl expose deployment nginx --port=80 --type=LoadBalancer
  </code></pre>
  
  <p>Then I created this network policy to make sure other pods in the cluster won't be able to connect to it anymore:</p>
  
  <pre><code>kind: NetworkPolicy
  apiVersion: networking.k8s.io/v1
  metadata:
    name: access-nginx
  spec:
    podSelector:
      matchLabels:
        run: nginx
    ingress:
    - from:
        - namespaceSelector:
            matchLabels:
              name: kube-system
      ports:
      - protocol: TCP
        port: 80
  </code></pre>
  
  <p>Now other pods in my cluster can't reach it (as intended):</p>
  
  <pre><code>kubectl run busybox --rm -ti --image=busybox /bin/sh
  If you don't see a command prompt, try pressing enter.
  / # wget --spider --timeout=1 nginx
  Connecting to nginx (10.63.254.50:80)
  wget: download timed out
  </code></pre>
  
  <p>However, it surprised me that using my external browser I also can't connect anymore to it through the load balancer:</p>
  
  <pre><code>open http://$(kubectl get svc nginx --output=jsonpath={.status.loadBalancer.ingress[0].ip})
  </code></pre>
  
  <p>If I delete the policy it starts to work again.</p>
  
  <p>So, my question is: how do I block other pods from reaching nginx, but keep access through the load balancer open?</p>