Question

You apply a NetworkPolicy in the 'payments' namespace that selects all pods and sets 'policyTypes: [Egress]' with an empty egress rules array to establish a default-deny-egress posture. Immediately afterward, application pods start failing with errors resolving service names, though they were previously healthy. You must keep the default-deny-egress baseline but restore functionality. What is the correct fix?

Accepted Answer

Add an egress rule allowing traffic to the kube-system namespace's CoreDNS pods on UDP and TCP port 53

Answer

Change the policyTypes to include only Ingress so egress is no longer restricted

Answer

Add an egress rule allowing all traffic to 0.0.0.0/0 on port 53 only for TCP

Answer

Recreate the CoreDNS Deployment so it registers new EndpointSlices that bypass the NetworkPolicy