<p>I have an AKS cluster (Azure CNI) which I'm trying to implement NetworkPolicies on. I've created the network policy which is</p>
<pre><code>apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: myserver
spec:
  podSelector:
    matchLabels:
      service: my-server
  policyTypes:
  - Ingress
  - Egress
  ingress:
  - from:
    - podSelector:
        matchLabels:
          service: myotherserver
    - podSelector:
        matchLabels:
          service: gateway
    - podSelector:
        matchLabels:
          service: yetanotherserver
    ports:
     - port: 8080
       protocol: TCP
  egress:
    - to:
      ports:
       - port: 53
         protocol: UDP
       - port: 53
         protocol: TCP
       - port: 5432
         protocol: TCP
       - port: 8080
         protocol: TCP
</code></pre>
<p>but when I apply the policy I'm seeing recurring messages that the host name cannot be resolved. I've installed dnsutils on the myserver pod; and can see the DNS requests are timing out; and I've also tried installing tcpdump on the same pod; and I can see requests going from myserver to kube-dns. I'm not seeing any responses coming back.</p>
<p>If I delete the networkpolicy DNS comes straight back; so I'm certain there's an issue with my networkpolicy but can't find a way to allow the DNS traffic. If anyone can shed any light on where I'm going wrong it would be greatly appreciated!</p>

<p>Solution which does not require a <code>name</code> label to the target namespace. It's necessary to define a <code>namespaceSelector</code> as well as a <code>podSelector</code>. The default <code>namespaceSelector</code> will target the pod's own namespace.</p>
<pre><code>apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-dns-access
  namespace: &lt;your-namespacename&gt;
spec:
  podSelector:
    matchLabels: {}
  policyTypes:
  - Egress
  egress:
  - to:
    - namespaceSelector:
        matchLabels:
          kubernetes.io/metadata.name: kube-system
      podSelector:
        matchLabels:
          k8s-app: kube-dns
    ports:
    - protocol: UDP
      port: 53
</code></pre>
<p>EDIT: Changed namespaceSelector to only target <code>kube-system</code> namespace based on the <code>kubernetes.io/metadata.name</code> label. This assumes you have automatic labeling enabled. <a href="https://kubernetes.io/docs/concepts/overview/_print/#automatic-labelling" rel="noreferrer">https://kubernetes.io/docs/concepts/overview/_print/#automatic-labelling</a></p>
<p>If you don't have this feature enabled, the next best thing is to define an allow-all <code>namespaceSelector</code> along with the <code>podSelector</code>.</p>
