Is Netpol allowing a pod to use DNS?

Network Policies (NetPol) in Kubernetes control the traffic flow at the IP address or port level for Pods. They do not inherently allow or block DNS resolution. DNS resolution is usually handled by CoreDNS or kube-dns within the Kubernetes cluster and typically uses UDP on port 53.

Here's a breakdown of how NetPol impacts DNS:

1. NetPol Doesn't Directly Handle DNS:

- NetPol operates on network layer 3 and 4, primarily dealing with IP addresses, ports, and protocols (TCP and UDP). DNS resolution works at the application layer, converting domain names to IP addresses.

2. How DNS Works in Kubernetes:

- When a Pod needs to resolve a hostname, it typically queries the cluster's DNS service (e.g., CoreDNS) on the cluster's DNS service IP at port 53 using UDP. This DNS service then handles the resolution, possibly querying external DNS servers for domains outside the cluster.

3. How NetPol Affects DNS Indirectly:

- If your NetPol rules restrict outgoing UDP traffic on port 53, your Pod will not be able to resolve domain names. This is because it won’t be able to send DNS queries to the cluster’s DNS server.

4. NetPol Rules Example for Allowing DNS:

- To ensure that a pod can perform DNS lookups, you need to make sure that outgoing traffic from the Pod to the cluster’s DNS service at port 53 UDP is allowed.

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-dns-access
spec:
  podSelector:
    matchLabels:
      app: your-app
  policyTypes:
  - Egress
  egress:
  - to:
    - namespaceSelector:
        matchLabels:
          k8s-app: kube-dns
    ports:
    - port: 53
        protocol: UDP

5. Key Points:

- The podSelector in the NetworkPolicy targets the pods you want to apply this policy to, e.g., pods with the label app: your-app.

- You need to allow Egress traffic (outgoing traffic) to the cluster's DNS service, which is identified with the namespace selector which usually will be "kube-system" and will have the label k8s-app: kube-dns (this may vary depending on your cluster’s DNS configuration).

- Ensure the destination port is 53 and protocol is UDP.

In conclusion, while NetPol does not handle DNS directly, it can block DNS resolution if your egress rules are not properly configured to allow traffic to the cluster’s DNS server on UDP port 53. Make sure to configure your NetPol rules to allow the pods to reach the DNS service within your cluster.

Learn more about this