<p>I am currently setting the 'dnsPolicy' configuration in the pod spec to 'Default' so that the pod can inherit the node's DNS configuration. </p>

<p>While this is good, it requires a re-build/re-deploy of the Docker container in order for the policy to effect and it is limited at the pod level.</p>

<p>Is there a similar policy that can be applied cluster-wide? Such that deployment of new pods onto the cluster will automatically inherit the nodes DNS configuration because of the cluster-wide policy? </p>

<p>There isn't really a supported way to do this cluster-wide. One reason is that your <code>coredns</code> or <code>kube-dns</code> use <code>dnsPolicy: Default</code> and not the default <code>dnsPolicy: ClusterFirst</code> so changing it cluster-wide might affect your <code>coredns/kube-dns</code> pods.</p>

<p>There is, however a more complicated approach that you can use with <a href="https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/" rel="nofollow noreferrer">Dynamic Admission Controllers</a>. In particular, using a <a href="https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#mutatingadmissionwebhook" rel="nofollow noreferrer">MutatingAdmissionWebhook</a> that you can use to modify the pods with certain annotations to have <code>dnsPolicy: Default</code>. For example, <a href="https://istio.io/" rel="nofollow noreferrer">Istio</a> uses this to inject the Envoy sidecar. This is a good <a href="https://medium.com/ibm-cloud/diving-into-kubernetes-mutatingadmissionwebhook-6ef3c5695f74" rel="nofollow noreferrer">document</a> that describes how to build your own MutatingAdmissionWebhook.</p>

<p>Similar question: <a href="https://serverfault.com/questions/928257/is-there-a-way-to-change-the-default-dnspolicy-without-modifying-every-podspec">https://serverfault.com/questions/928257/is-there-a-way-to-change-the-default-dnspolicy-without-modifying-every-podspec</a></p>
