kubernetes network_error ai_generated true

连接被拒绝：拨号tcp 10.96.0.10:53：连接被拒绝（由于NetworkPolicy）

connection refused: dial tcp 10.96.0.10:53: connect: connection refused (due to NetworkPolicy)

ID: kubernetes/networkpolicy-blocking-dns

其他格式: JSON · Markdown 中文 · English
88%修复率
86%置信度
1证据数
2024-04-01首次发现

版本兼容性

版本状态引入弃用备注
Calico v3.27.2 active — — —
Cilium v1.15.0 active — — —
Kubernetes v1.28.5 active — — —
Kubernetes v1.29.1 active — — —

根因分析

NetworkPolicy阻止了Pod到CoreDNS服务的DNS流量（端口53），可能是入站或出站规则，导致DNS解析失败。

English

A NetworkPolicy is blocking DNS traffic (port 53) from the pod to the CoreDNS service, either by ingress or egress rules, preventing DNS resolution.

generic

官方文档

https://kubernetes.io/docs/concepts/services-networking/network-policies/

解决方案

  1. Add an egress rule to allow DNS traffic in the pod's namespace: `kubectl edit networkpolicy <policy-name>` and add under egress: `- ports: [{port: 53, protocol: UDP}, {port: 53, protocol: TCP}]` and ensure the destination includes the kube-system namespace or the CoreDNS pod selector.
  2. Test connectivity to CoreDNS: `kubectl run -it --rm debug --image=busybox -- sh` then run `nslookup kubernetes.default.svc.cluster.local`. If it fails, inspect NetworkPolicies in the namespace: `kubectl describe networkpolicy -n <namespace>`

无效尝试

常见但无效的做法:

  1. Restart the pod or delete and recreate it 95% 失败

    The NetworkPolicy is still in place, so restarting the pod will result in the same DNS failure. The policy must be modified.

  2. Disable all NetworkPolicies by deleting them 60% 失败

    This is a security risk and defeats the purpose of network segmentation. A targeted fix is better, e.g., adding a policy that allows DNS.