Kubernetes / Services, DNS & Traffic Routing
Investigate a network policy blocking backend or DNS egress
A Pod can become isolated for egress while still answering inbound health checks. Inspect all policies selecting it.
Environment and inputs: Kubernetes · kubectl with supported client/server versions and delegated RBAC. Examples use namespace app unless noted. Check context, namespace, APIs and provider support first.
Start with this check
Confirm the environment and replace sample objects, namespaces, images, paths and hosts with approved targets. Share only relevant, sanitized output. Follow the workload owner’s process for changes.
kubectl -n app get networkpolicy -o yamlRead the result
Policies are additive within their defined semantics and require an enforcing network plugin. DNS and backend flows may need separate allowed destinations and protocols.
Resolve and verify
Compare Pod and namespace selectors with the actual destination, port and reply path. Request a narrow policy correction and validate permitted and denied flows.
Before changing production
Do not delete all policies or assume absence of one apparent deny rule means traffic is unrestricted.