Skip to content

fix(networkpolicy): use UDP/53 for DNS egress instead of named port - #19073

Merged
Jayclifford345 merged 3 commits into
grafana:mainfrom
fmlecpac:patch-1
Sep 9, 2025
Merged

fix(networkpolicy): use UDP/53 for DNS egress instead of named port#19073
Jayclifford345 merged 3 commits into
grafana:mainfrom
fmlecpac:patch-1

Conversation

@fmlecpac

Copy link
Copy Markdown
Contributor

Hello,

What this PR does / why we need it:
The current NetworkPolicy template allows DNS egress using the named port dns.
However, not all clusters define a DNS service port with that name. This can cause the policy to block DNS traffic.

This PR replaces the named port with the standard numeric port 53/UDP, ensuring DNS resolution works consistently across clusters that use standard port for DNS service.

Which issue(s) this PR fixes:
N/A

Special notes for your reviewer:
Should we make it configurable? (especially for clusters with a DNS service not on port 53)

Checklist

  • Reviewed the CONTRIBUTING.md guide (required)
  • Documentation added
  • Tests updated
  • Title matches the required conventional commits format, see here
    • Note that Promtail is considered to be feature complete, and future development for logs collection will be in Grafana Alloy. As such, feat PRs are unlikely to be accepted unless a case can be made for the feature actually being a bug fix to existing behavior.
  • Changes that require user attention or interaction to upgrade are documented in docs/sources/setup/upgrade/_index.md
  • If the change is deprecating or removing a configuration option, update the deprecated-config.yaml and deleted-config.yaml files respectively in the tools/deprecated-config-checker directory. Example PR
Signed-off-by: fmlecpac <168742771+fmlecpac@users.noreply.github.com>
@fmlecpac
fmlecpac requested a review from a team as a code owner August 31, 2025 14:37
@CLAassistant

CLAassistant commented Aug 31, 2025

Copy link
Copy Markdown

CLA assistant check
All committers have signed the CLA.

Signed-off-by: fmlecpac <168742771+fmlecpac@users.noreply.github.com>
Comment thread production/helm/loki/templates/ciliumnetworkpolicy.yaml
@fmlecpac

Copy link
Copy Markdown
Contributor Author

Added 53/TCP too.

@jkroepke jkroepke left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@Jayclifford345
Jayclifford345 merged commit 4cbbc4f into grafana:main Sep 9, 2025
81 checks passed
felix0102 pushed a commit to felix0102/loki that referenced this pull request Aug 2, 2026
…rafana#19073)

Signed-off-by: fmlecpac <168742771+fmlecpac@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

4 participants