cilium/cilium · error

egress.to.domainNames is not supported since L7 proxy is dis

Error message

egress.to.domainNames is not supported since L7 proxy is disabled

What it means

ParseClusterNetworkPolicy returns this error when an egress rule uses 'to.domainNames' while the L7 proxy support is disabled (--enable-l7-proxy=false). FQDN-based egress rules require the DNS/L7 proxy to resolve domain names to IPs dynamically.

Source

Thrown at pkg/k8s/cluster_network_policy.go:335

				switch {
				case rule.Pods != nil:
					egress.L3 = types.Selectors{kcnpParseNamespacedPod(clusterName, *rule.Pods)}
				case rule.Namespaces != nil:
					egress.L3 = types.ToSelectors(
						api.NewESFromK8sLabelSelector(labels.LabelSourceK8sKeyPrefix, kcnpProcessNamespaceSelector(rule.Namespaces)))
				case rule.Nodes != nil:
					if !option.Config.EnableNodeSelectorLabels {
						return nil, errors.New("egress.to.nodes is not supported since node selector labels are disabled")
					}
					egress.L3 = kcnpProcessNodeSelector(clusterName, rule.Nodes)
				case rule.Networks != nil:
					egress.L3 = kcnpParseCIDRSelectors(rule.Networks)
				case rule.DomainNames != nil:
					if verdict != types.Allow {
						return nil, errors.New("egress.to.domainNames is only supported for egress.action=Accept")
					}
					if !option.Config.EnableL7Proxy {
						return nil, errors.New("egress.to.domainNames is not supported since L7 proxy is disabled")
					}
					l3, dnsL4, err := kcnpParseFQDNSelectors(rule.DomainNames)
					if err != nil {
						return nil, err
					}
					egress.L3 = l3
					// To allow FQDNs, we need to explicitly add an additional L3 and L4 selector
					// that allows DNS requests for the specified FQDNs.
					dnsEgress := &types.PolicyEntry{
						Ingress: false,
						Verdict: types.Allow,
						// TODO: Make this configurable
						L3: types.ToSelectors(api.NewESFromLabels(labels.ParseSelectLabel("k8s-app=kube-dns"))),
						L4: api.PortRules{{
							Ports: []api.PortProtocol{
								{Port: "dns"},
								{Port: "dns-tcp"},
							},

View on GitHub (pinned to ac7b90affa)

Solutions

1. Enable L7 proxy support (--enable-l7-proxy=true) on the agent
2. Rewrite the rule to use toCIDR / service selectors instead of domainNames
3. Remove the domainNames section if FQDN egress control is not needed

Example fix

// before (L7 proxy disabled)
egress:
- to:
  - domainNames:
      matchName: api.example.com
// after: CIDR-based egress
egress:
- toCIDR:
    - 203.0.113.0/24

// Confirm L7 proxy is enabled before applying FQDN rules
if hasDomainNames(policy) && !l7ProxyEnabled {
    return fmt.Errorf("to.domainNames requires --enable-l7-proxy=true")
}

When it happens

Trigger: A policy with egress.to.domainNames and an Allow verdict is parsed while option.Config.EnableL7Proxy is false (also implied by DNS proxy being unavailable).

Common situations: Clusters running with L7 proxy disabled (e.g. no Envoy/proxy sidecar desired, reduced-footprint installs); policies authored on clusters with L7 proxy enabled then deployed elsewhere.

Related errors

• cannot unmarshal nil into RuleIPOrCIDR
• egress.to.nodes is not supported since node selector labels
• egress.to.domainNames is only supported for egress.action=Ac
• L7 rules can not be used when a port is 0
• authenticating failed by the always-fail auth handler

AI-assisted analysis of cilium/cilium@ac7b90affa (2026-08-31). Data as JSON: /api/errors/b559a99ce02c99e6. Report an issue: GitHub.