NetworkPolicy Egress and DNS
A default-deny egress policy blocks port 53 along with everything else, so DNS stops working and every symptom points at DNS rather than at the policy you just wrote. Worse, adding an explicit allow rule for the service you wanted does not fix it, because the client still cannot resolve the name. This reproduces the whole sequence and then fixes it properly.
Services and Networking Guide 37 of 44 Intermediate
- Kubernetes1.36.4
- Runtimecontainerd 2.2.6
- CNICalico v3.32.1
- TimeAbout 16 min
- Reviewed23 August 2026
Written against the versions above. NetworkPolicies are enforced by the CNI plugin. This cluster runs Calico; on a cluster whose CNI does not implement them - plain flannel, for instance - every policy here is accepted by the API server and enforces nothing at all, which is a far more dangerous failure than the one this guide is about.
| Server Name | IP Address | OS | Roles | CPU | RAM | HDD |
|---|---|---|---|---|---|---|
| CKA1001 | 192.168.0.175 | Ubuntu 26.04 LTS | Control Plane Node | 2 Core | 4 GB | 50 GB |
| CKA1001-NODE01 | 192.168.0.176 | Ubuntu 26.04 LTS | Worker Node | 2 Core | 4 GB | 50 GB |
| CKA1001-NODE02 | 192.168.0.177 | Ubuntu 26.04 LTS | Worker Node | 2 Core | 4 GB | 50 GB |
| CKA1001-NODE03 | 192.168.0.178 | Ubuntu 26.04 LTS | Worker Node | 2 Core | 4 GB | 50 GB |
Before you start
- A cluster with a CNI that enforces NetworkPolicy. Calico here.
- The session creates namespace
ckad-np, a Deploymentapiwith a Service, and aclientPod labelledrole=clientthat the policies target.
-
Two Pods that can talk
-
Deny all egress
-
Allowing the API does not help
-
The DNS exception every egress policy needs