<p>How can egress from a Kubernetes pod be limited to only specific FQDN/DNS with Azure CNI Network Policies?</p>
<p>This is something that can be achieved with:</p>
<p>Istio</p>
<pre><code>apiVersion: config.istio.io/v1alpha2
kind: EgressRule
metadata:
  name: googleapis
  namespace: default
spec:
  destination:
      service: &quot;*.googleapis.com&quot;
  ports:
      - port: 443
        protocol: https
</code></pre>
<p>Cilium</p>
<pre><code>apiVersion: &quot;cilium.io/v2&quot;
kind: CiliumNetworkPolicy
metadata:
  name: &quot;fqdn&quot;
spec:
  endpointSelector:
    matchLabels:
      app: some-pod
  egress:
  - toFQDNs:
    - matchName: &quot;api.twitter.com&quot;  
  - toEndpoints:
    - matchLabels:
        &quot;k8s:io.kubernetes.pod.namespace&quot;: kube-system
        &quot;k8s:k8s-app&quot;: kube-dns
    toPorts:
    - ports:
      - port: &quot;53&quot;
        protocol: ANY
      rules:
        dns:
        - matchPattern: &quot;*&quot;
</code></pre>
<p>OpenShift</p>
<pre><code>apiVersion: network.openshift.io/v1
kind: EgressNetworkPolicy
metadata:
  name: default-rules 
spec:
  egress: 
  - type: Allow
    to:
      dnsName: www.example.com
  - type: Deny
    to:
      cidrSelector: 0.0.0.0/0
</code></pre>
<p>How can something similar be done with Azure CNI Network Policies?</p>

<p>ATM network policies with FQDN/DNS rules are not supported on AKS.</p>
<p>If you use Azure CNI &amp; Azure Policy Plugin you get the default Kubernetes Network Policies.</p>
<p>If you use Azure CNI &amp; Calico Policy Plugin you get advanced possibilities like Global Network Polices but not the FQDN/DNS one. This is a paid feature on Calico Cloud unfortunately.</p>
