{"record":{"id":"b559a99ce02c99e6","repo":"cilium/cilium","slug":"egress-to-domainnames-is-not-supported-since-l7-pr","errorCode":null,"errorMessage":"egress.to.domainNames is not supported since L7 proxy is disabled","messagePattern":"egress\\.to\\.domainNames is not supported since L7 proxy is disabled","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/k8s/cluster_network_policy.go","lineNumber":335,"sourceCode":"\t\t\t\tswitch {\n\t\t\t\tcase rule.Pods != nil:\n\t\t\t\t\tegress.L3 = types.Selectors{kcnpParseNamespacedPod(clusterName, *rule.Pods)}\n\t\t\t\tcase rule.Namespaces != nil:\n\t\t\t\t\tegress.L3 = types.ToSelectors(\n\t\t\t\t\t\tapi.NewESFromK8sLabelSelector(labels.LabelSourceK8sKeyPrefix, kcnpProcessNamespaceSelector(rule.Namespaces)))\n\t\t\t\tcase rule.Nodes != nil:\n\t\t\t\t\tif !option.Config.EnableNodeSelectorLabels {\n\t\t\t\t\t\treturn nil, errors.New(\"egress.to.nodes is not supported since node selector labels are disabled\")\n\t\t\t\t\t}\n\t\t\t\t\tegress.L3 = kcnpProcessNodeSelector(clusterName, rule.Nodes)\n\t\t\t\tcase rule.Networks != nil:\n\t\t\t\t\tegress.L3 = kcnpParseCIDRSelectors(rule.Networks)\n\t\t\t\tcase rule.DomainNames != nil:\n\t\t\t\t\tif verdict != types.Allow {\n\t\t\t\t\t\treturn nil, errors.New(\"egress.to.domainNames is only supported for egress.action=Accept\")\n\t\t\t\t\t}\n\t\t\t\t\tif !option.Config.EnableL7Proxy {\n\t\t\t\t\t\treturn nil, errors.New(\"egress.to.domainNames is not supported since L7 proxy is disabled\")\n\t\t\t\t\t}\n\t\t\t\t\tl3, dnsL4, err := kcnpParseFQDNSelectors(rule.DomainNames)\n\t\t\t\t\tif err != nil {\n\t\t\t\t\t\treturn nil, err\n\t\t\t\t\t}\n\t\t\t\t\tegress.L3 = l3\n\t\t\t\t\t// To allow FQDNs, we need to explicitly add an additional L3 and L4 selector\n\t\t\t\t\t// that allows DNS requests for the specified FQDNs.\n\t\t\t\t\tdnsEgress := &types.PolicyEntry{\n\t\t\t\t\t\tIngress: false,\n\t\t\t\t\t\tVerdict: types.Allow,\n\t\t\t\t\t\t// TODO: Make this configurable\n\t\t\t\t\t\tL3: types.ToSelectors(api.NewESFromLabels(labels.ParseSelectLabel(\"k8s-app=kube-dns\"))),\n\t\t\t\t\t\tL4: api.PortRules{{\n\t\t\t\t\t\t\tPorts: []api.PortProtocol{\n\t\t\t\t\t\t\t\t{Port: \"dns\"},\n\t\t\t\t\t\t\t\t{Port: \"dns-tcp\"},\n\t\t\t\t\t\t\t},","sourceCodeStart":317,"sourceCodeEnd":353,"githubUrl":"https://github.com/cilium/cilium/blob/ac7b90affa4baf0642e6685319d56907b3a73a6d/pkg/k8s/cluster_network_policy.go#L317-L353","documentation":"ParseClusterNetworkPolicy returns this error when an egress rule uses 'to.domainNames' while the L7 proxy support is disabled (--enable-l7-proxy=false). FQDN-based egress rules require the DNS/L7 proxy to resolve domain names to IPs dynamically.","triggerScenarios":"A policy with egress.to.domainNames and an Allow verdict is parsed while option.Config.EnableL7Proxy is false (also implied by DNS proxy being unavailable).","commonSituations":"Clusters running with L7 proxy disabled (e.g. no Envoy/proxy sidecar desired, reduced-footprint installs); policies authored on clusters with L7 proxy enabled then deployed elsewhere.","solutions":["Enable L7 proxy support (--enable-l7-proxy=true) on the agent","Rewrite the rule to use toCIDR / service selectors instead of domainNames","Remove the domainNames section if FQDN egress control is not needed"],"exampleFix":"// before (L7 proxy disabled)\negress:\n- to:\n  - domainNames:\n      matchName: api.example.com\n// after: CIDR-based egress\negress:\n- toCIDR:\n    - 203.0.113.0/24","handlingStrategy":"validation","validationCode":"// Confirm L7 proxy is enabled before applying FQDN rules\nif hasDomainNames(policy) && !l7ProxyEnabled {\n    return fmt.Errorf(\"to.domainNames requires --enable-l7-proxy=true\")\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Verify --enable-l7-proxy=true on clusters using FQDN policies","Use toCIDR where proxy support is unavailable","Keep feature flags consistent across environments"],"tags":["network-policy","fqdn","l7-proxy","feature-flag"],"backgroundTag":"feature-disabled","analyzedSha":"ac7b90affa4baf0642e6685319d56907b3a73a6d","analyzedAt":"2026-08-31T18:27:15.868Z","schemaVersion":2},"datasetVersion":"2026-08-31T22:30:34.772Z"}