The Recommended default deny policy should allow DNS over TCP

[wallrj]

The Calico documentation currently contains the following paragraph and sample default deny policy, which allows DNS over UDP to kube-dns from Pods in all namespaces.

I think it should also allow DNS over TCP.

As an alternative best practice we recommend to use the following example, which applies a default-deny behaviour to all non-system pods. The policy also allows access kube-dns, which simplifies per pod policies since you don't need to duplicate the DNS rules in every policy.

apiVersion: projectcalico.org/v3
kind: GlobalNetworkPolicy
metadata:
  name: deny-app-policy
spec:
  namespaceSelector: has(projectcalico.org/name) && projectcalico.org/name not in {"kube-system", "calico-system", "calico-apiserver"}
  types:
  - Ingress
  - Egress
  egress:
  # allow all namespaces to communicate to DNS pods
  - action: Allow
    protocol: UDP
    destination:
      selector: 'k8s-app == "kube-dns"'
      ports:
      - 53

The coredns in my Kind cluster is certainly configured to allow DNS over TCP:

$ kubectl get svc -n kube-system kube-dns
NAME       TYPE        CLUSTER-IP   EXTERNAL-IP   PORT(S)                  AGE
kube-dns   ClusterIP   10.96.0.10   <none>        53/UDP,53/TCP,9153/TCP   6m59s

$ kubectl run dig --attach --rm --restart=Never --image nixery.dev/dnsutils -- dig @kube-dns.kube-system.svc.cluster.local kubernetes.default.svc.cluster.local. A +tcp

; <<>> DiG 9.18.19 <<>> @kube-dns.kube-system.svc.cluster.local kubernetes.default.svc.cluster.local. A +tcp
; (1 server found)
;; global options: +cmd
;; Got answer:
;; WARNING: .local is reserved for Multicast DNS
;; You are currently testing what happens when an mDNS query is leaked to DNS
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 53329
;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
;; WARNING: recursion requested but not available

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
; COOKIE: bb4d0b9fc7279ae9 (echoed)
;; QUESTION SECTION:
;kubernetes.default.svc.cluster.local. IN A

;; ANSWER SECTION:
kubernetes.default.svc.cluster.local. 4 IN A    10.96.0.1

;; Query time: 10 msec
;; SERVER: 10.96.0.10#53(kube-dns.kube-system.svc.cluster.local) (TCP)
;; WHEN: Wed Nov 15 09:57:05 UTC 2023
;; MSG SIZE  rcvd: 129

pod "dig" deleted

xref:

• Network Policy Recommendations cert-manager/website#1344 (comment)

[matthewdupre]

Agreed, DNS over TCP should generally be allowed wherever DNS over UDP is.