Support different service port and container ports for network policies?

[evandam]

What happened:

Following up on aws/amazon-vpc-cni-k8s#3181 since it was closed and the comment recommended opening a new issue.

I have pretty much the same question: When using NetworkPolicies to restrict access to pods by selectors/namespaces, is it possible to have differing port numbers between service ports and container ports? The main functionality I'm looking for is to deny ingress traffic between namespaces. However, it feels unrealistic to assume that every service in the cluster uses the same mapping of service port number to container port.

Environment:

• Kubernetes version (use kubectl version): v1.33.5-eks-3cfe0ce
• CNI Version: v1.19.6-eksbuild.1
• OS (e.g: cat /etc/os-release):
• Kernel (e.g. uname -a):

[jaydeokar]

@evandam Can you help with the sample network policy that you are applying in the cluster for this use case ?
Thanks

[evandam]

Hey @jaydeokar, I ended up dropping this for a bit but I believe this was the gist of a policy I was trying to use:

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: test
  namespace: namespace-a
spec:
  podSelector:
    matchLabels:
      app.kubernetes.io/name: my-app
  policyTypes:
    - Ingress
  ingress:
    - from:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: namespace-b

I have a feeling it might just be an issue of the documentation being out of date 🤷‍♂️ I'll share more info if I'm able to, but unfortunately I don't have an EKS cluster with Network Policies enabled to test out.

Thank you!