kubernetes networking_error ai_generated true

connection refused / connection timed out due to NetworkPolicy

ID: kubernetes/k8s-network-policy-block

Also available as: JSON · Markdown
85%Fix Rate
85%Confidence
55Evidence
2023-01-01First Seen

Version Compatibility

VersionStatusIntroducedDeprecatedNotes
8 active — — —

Root Cause

NetworkPolicy is blocking traffic between pods. Once a NetworkPolicy selects a pod, all non-allowed traffic is denied by default.

generic

Workarounds

  1. 92% success Add allow rules for the required traffic: create ingress/egress rules matching the source/destination pods 
    kubectl get networkpolicy -n <ns> -o yaml, then add podSelector/namespaceSelector rules for allowed traffic

    Sources: https://kubernetes.io/docs/concepts/services-networking/network-policies/

  2. 85% success Verify the CNI plugin supports NetworkPolicy (not all do) 
    Calico, Cilium, and Weave support NetworkPolicy; Flannel does NOT by default

    Sources: https://kubernetes.io/docs/concepts/cluster-administration/addons/#networking-and-network-policy

Dead Ends

Common approaches that don't work:

  1. Delete all NetworkPolicies in the namespace 70% fail

    Removes security controls — exposes all pods to unrestricted network access

  2. Use hostNetwork: true to bypass NetworkPolicy 85% fail

    Bypasses all network isolation — major security risk and port conflicts

Error Chain

Leads to:
Preceded by:
Frequently confused with: