Question

A team runs a Pod labeled app=payments in the finance namespace that must reach an external payment gateway on port 443 by hostname. A default-deny egress NetworkPolicy is already in place for the namespace. After applying an egress policy allowing traffic to the gateway's IP block on port 443, the application still fails with name resolution errors, though direct IP connectivity tests to the gateway succeed. What must be added to the egress policy to fix this?

Accepted Answer

An egress rule allowing UDP and TCP to port 53 toward the kube-system namespace where CoreDNS runs

Answer

An ingress rule on the CoreDNS Pods allowing traffic from the finance namespace

Answer

An egress rule allowing all traffic to 0.0.0.0/0 on port 443 only

Answer

A podSelector matching CoreDNS Pods in the same finance namespace on port 53