Question

A platform engineer applies a default-deny egress NetworkPolicy to the 'payments' namespace to tighten security. After the policy is applied, the pods can no longer reach an external API by hostname, and application logs show 'name resolution failed' errors. Pod-to-pod IP connectivity that uses raw IP addresses still works. What is the most likely cause and correct fix?

Accepted Answer

The default-deny egress policy also blocks DNS traffic to CoreDNS; add an egress rule allowing UDP/TCP port 53 to the kube-system DNS pods.

Answer

NetworkPolicies cannot control DNS; the issue is a CoreDNS crash and the policy is unrelated, so restart the CoreDNS deployment.

Answer

The CNI plugin does not support egress policies, so switching to a different Service type will restore name resolution.

Answer

The policy needs an ingress rule permitting port 53 so that DNS responses can return to the pods.