Conversation
We know that the service that has the Prometheus scraping annotation might by the DNS service in the cluster (for example, the `coredns` workload on an EKS cluster). In this case, adding a network policy to allow metrics-scraping-traffic would block the DNS ingress traffic, which would block DNS in the cluster. We don;t want this, and we can't tell for sure which workload is the DNS in the cluster, so whenever we create a network policy to allow Prometheus to scrape metrics, we also allow port 53 (DNS) on the same network policy
omris94
approved these changes
Jun 3, 2025
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
We know that the service with the Prometheus scraping annotation might be the cluster’s DNS service - for example, the coredns workload in an EKS cluster.
If we add a network policy that only allows metrics scraping, it could unintentionally block DNS ingress traffic, effectively breaking DNS resolution within the cluster.
To avoid this, and since we can't always definitively identify which workload handles DNS, we ensure that any network policy allowing Prometheus to scrape metrics also permits traffic on port 53 (DNS) within the same policy.
Testing
Describe how this can be tested by reviewers. Be specific about anything not tested and reasons why. If this library has unit and/or integration testing, tests should be added for new functionality and existing tests should complete without errors.
Please include any manual steps for testing end-to-end or functionality not covered by unit/integration tests.
Also include details of the environment this PR was developed in (language/platform/browser version).
Checklist