So I created a VPC-native GKE cluster. My Pod address range is and my Service address range is

From a pod on my cluster I can’t resolve google.internal dns names. This seems to be caused by the fact that I can’t reach the service subnet from the pod subnet:

root@mypod-0:/# ifconfig|grep eth0 -A 1
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1460
        inet  netmask  broadcast
root@mypod-0:/# head -n 1 /etc/resolv.conf
root@mypod-0:/# ping -c 1 -W 1
PING ( 56(84) bytes of data.

--- ping statistics ---
1 packets transmitted, 0 received, 100% packet loss, time 0ms


I have a firewall rule that allow all from What am I missing here ?

  • Can you let me know if you are not able to resolve only the google.internal DNS? if you are able to resolve to any other address except that. I would recommend trying to telnet 53 and it should be connect without any issue. This being said, the icmp packets are not allowed for kube-dns and it should be able resolve to any other address without any issue. – Nathan Nasser Dec 13 '19 at 4:36
  • At the moment I have switched back to the "legacy" networking mode since I was blocked by that. I might have time to build another cluster with VPC native later today. – vinni_f Dec 13 '19 at 14:24
  • Also, I am using the default VPC without any alteration. It might be the root of my problem. – vinni_f Dec 13 '19 at 14:24
  • on a newly created cluster that's odd, try changing your "/etc/resolv.conf" into "", if this single pod works, then the issue is most likely on "kube-dns" – Frank Dec 22 '19 at 5:01

You should follow the DNS rules stated below:




This says that that if DNS service name is then pods should have IP, …….

You use IPs It will not work.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.