title: How to allow access to kubernetes api using egress network policy?
body: <p>Init container with <code>kubectl get pod</code> command is used to get ready status of other pod.</p>
  
  <p>After Egress NetworkPolicy was turned on init container can't access Kubernetes API: <code>Unable to connect to the server: dial tcp 10.96.0.1:443: i/o timeout</code>. CNI is Calico.</p>
  
  <p>Several rules were tried but none of them are working (service and master host IPs, different CIDR masks):</p>
  
  <pre><code>...
    egress:
    - to:
      - ipBlock:
          cidr: 10.96.0.1/32
      ports:
      - protocol: TCP
        port: 443
  ...
  </code></pre>
  
  <p>or using namespace (default and kube-system namespaces):</p>
  
  <pre><code>...
    egress:
    - to:
      - namespaceSelector:
          matchLabels:
            name: default
      ports:
      - protocol: TCP
        port: 443
  ...
  </code></pre>
  
  <p>Looks like <code>ipBlock</code> rules just don't work and namespace rules don't work because kubernetes api is non-standard pod.</p>
  
  <p>Can it be configured? Kubernetes is 1.9.5, Calico is 3.1.1.</p>
  
  <p>Problem still exists with GKE 1.13.7-gke.8 and calico 3.2.7</p>