NetworkPolicy Egress and DNS

Services and Networking / Guide 37 of 44 / Intermediate

• Kubernetes1.36.4
• Cluster4 nodes
• Runtimecontainerd 2.2.6
• CNICalico v3.32.1
• TimeAbout 16 min

NetworkPolicies are enforced by the CNI plugin. This cluster runs Calico; on a cluster whose CNI does not implement them - plain flannel, for instance - every policy here is accepted by the API server and enforces nothing at all, which is a far more dangerous failure than the one this guide is about.

This guide includes

Use this when a policy is applied and everything breaks, including the traffic you explicitly allowed. This matters because a default-deny egress rule blocks port 53 as well, so name resolution dies first and the allow rule you added never gets used.

• confirming two Pods can talk with no policies present, which is the Kubernetes default
• denying all egress and watching both the request and the lookup fail
• adding the obvious allow rule for the backend, and finding it does not help
• adding the DNS exception every egress policy needs, on both UDP and TCP 53

Before you start

• A cluster with a CNI that enforces NetworkPolicy. Calico here.
• The session creates namespace ckad-np, a Deployment api with a Service, and a client Pod labelled role=client that the policies target.

1. 1

   Two Pods that can talk

2. 2

   Deny all egress

3. 3

   Allowing the API does not help

4. 4

   The DNS exception every egress policy needs

Official sources

• Network Policies
• Declare Network Policy
• Default deny all egress traffic