After applying an egress default-deny NetworkPolicy, Pods can no longer resolve Service DNS names. What allow is missing?
Select an answer to reveal the explanation.
Short Explanation
Egress deny without a DNS hole is like sealing the phone book cabinet—Pods can't look up names. Open egress to CoreDNS/kube-dns on port 53. RBAC and random ingress port 80 won't restore resolution.
Full Explanation
Egress NetworkPolicies that deny outbound traffic must still permit DNS to the cluster DNS service/Pods (commonly UDP/TCP 53) or name resolution fails. Broad ingress on port 80, hostNetwork workarounds, and RBAC Role changes do not fix DNS blocked by egress policy.