kubernetes - k8s 导出网络策略不适用于 dns

Question

我添加了这个 NetworkPolicy 来阻止所有导出但允许 DNS。

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-all-egress
  namespace: {{ $namespace }}
spec:
  podSelector: {}
  egress:
  - to:
    - namespaceSelector:
        matchLabels:
          networking/namespace: kube-system
      podSelector:
        matchLabels:
          k8s-app: kube-dns
    ports:
    - protocol: TCP
      port: 53
    - protocol: UDP
      port: 53
  policyTypes:
  - Egress

但是，此规则适用的服务出现此错误: Could not lookup srv records on _origintunneld._tcp.argotunnel.com: lookup _origintunneld._tcp.argotunnel.com on 10.2.0.10:53: read udp 10.32.1.179:40784->10.2.0.10:53: i/o timeout这个 IP (10.2.0.10) 属于 kube-dns 服务，它有一个带有 k8s-app=kube-dns 的 pod标签并在 kube-system 命名空间中，标签为 networking/namespace=kube-system .
如果我删除了 pod 选择器和命名空间选择器，那么导出策略将起作用并且我没有收到错误消息
这有效但不安全，因为它不限于 kube-dns pod:

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-all-egress
  namespace: {{ $namespace }}
spec:
  podSelector: {}
  egress:
  - to:
    ports:
    - protocol: TCP
      port: 53
    - protocol: UDP
      port: 53
  policyTypes:
  - Egress

kube-system 命名空间 yaml: kubectl get namespace kube-system -o yaml

apiVersion: v1
kind: Namespace
metadata:
  creationTimestamp: "2020-07-30T22:08:25Z"
  labels:
    networking/namespace: kube-system
  name: kube-system
  resourceVersion: "4084751"
  selfLink: /api/v1/namespaces/kube-system
  uid: b93e68b0-7899-4f39-a3b8-e0e12e4008ee
spec:
  finalizers:
  - kubernetes
status:
  phase: Active

Answer 1

我遇到了同样的问题。对我来说，这是因为我的集群上启用了 NodeLocal DNSCache。