Amazon EKS — Networking Issues

Networking Issues

DNS resolution failures, pod-to-pod connectivity problems, and security group misconfigurations.

---

DNS Debugging

# Test DNS from inside a pod
$ kubectl run dns-test --image=busybox:1.28 --rm -it -- nslookup kubernetes.default
Server:    172.20.0.10
Address 1: 172.20.0.10 kube-dns.kube-system.svc.cluster.local

Name:      kubernetes.default
Address 1: 172.20.0.1

# If DNS fails, check CoreDNS
$ kubectl get pods -n kube-system -l k8s-app=kube-dns
$ kubectl logs -n kube-system -l k8s-app=kube-dns

---

Common DNS Issues

Symptom	Cause	Fix
nslookup times out	CoreDNS pods down	Restart CoreDNS
Can’t resolve external names	Missing upstream DNS	Check CoreDNS ConfigMap
Intermittent DNS failures	CoreDNS overloaded	Increase CoreDNS replicas
ndots:5 causing slow lookups	Default search domain lookups	Set ndots: 2 in pod DNS config

---

Pod-to-Pod Connectivity

# Test connectivity between pods
$ kubectl exec pod-a -- curl -s http://<pod-b-ip>:8080

# Check if VPC CNI is healthy
$ kubectl get pods -n kube-system -l k8s-app=aws-node
$ kubectl logs -n kube-system -l k8s-app=aws-node

# Check network policies
$ kubectl get networkpolicies --all-namespaces

---

Security Group Checklist

Rule	Direction	Port	Purpose
Cluster SG → Node SG	Inbound	443	API server to kubelet
Node SG → Cluster SG	Inbound	443	Kubelet to API server
Node SG → Node SG	Inbound	All	Pod-to-pod traffic
Node SG → 0.0.0.0/0	Outbound	443	ECR, S3, CloudWatch

---

Common Mistakes

Mistake	Impact
Restrictive security groups	Pods can’t communicate
Missing NAT gateway for private subnets	No outbound internet
Not checking CoreDNS logs	DNS failures go unnoticed

---

What’s Next?

Disk problems: Storage Issues.