# 连接被拒绝：拨号tcp 10.96.0.10:53：连接被拒绝（由于NetworkPolicy）

- **ID:** `kubernetes/networkpolicy-blocking-dns`
- **领域:** kubernetes
- **类别:** network_error
- **验证级别:** ai_generated
- **修复率:** 88%

## 根因

NetworkPolicy阻止了Pod到CoreDNS服务的DNS流量（端口53），可能是入站或出站规则，导致DNS解析失败。

## 版本兼容性

| 版本 | 状态 | 引入 | 弃用 |
|------|------|------|------|
| Calico v3.27.2 | active | — | — |
| Cilium v1.15.0 | active | — | — |
| Kubernetes v1.28.5 | active | — | — |
| Kubernetes v1.29.1 | active | — | — |

## 解决方案

1. ```
   Add an egress rule to allow DNS traffic in the pod's namespace: `kubectl edit networkpolicy <policy-name>` and add under egress: `- ports: [{port: 53, protocol: UDP}, {port: 53, protocol: TCP}]` and ensure the destination includes the kube-system namespace or the CoreDNS pod selector.
   ```
2. ```
   Test connectivity to CoreDNS: `kubectl run -it --rm debug --image=busybox -- sh` then run `nslookup kubernetes.default.svc.cluster.local`. If it fails, inspect NetworkPolicies in the namespace: `kubectl describe networkpolicy -n <namespace>`
   ```

## 无效尝试

- **Restart the pod or delete and recreate it** — The NetworkPolicy is still in place, so restarting the pod will result in the same DNS failure. The policy must be modified. (95% 失败率)
- **Disable all NetworkPolicies by deleting them** — This is a security risk and defeats the purpose of network segmentation. A targeted fix is better, e.g., adding a policy that allows DNS. (60% 失败率)