Why Your AKS Pod Can't Reach the Internet

It's a classic AKS afternoon: the app deploys, the pod is Running, and it cannot reach a thing outside the cluster. Before you blame the application, know that this is almost always one of three suspects. Check them in order.

1. Egress routing changed under you. The default outbound path can be overridden by a NAT gateway, a user-defined route sending traffic to an Azure Firewall, a peering setup that forces everything through a hub network. When that firewall doesn't allow the destination, the pod goes dark. Tell: the failure is the whole cluster, not one pod, and it often starts the day the network team "tidied up" routing.

2. A NetworkPolicy is denying egress. The moment you apply your first NetworkPolicy to a namespace, anything not explicitly allowed is denied, and people forget that egress needs allowing too, including DNS. Tell: pods in one namespace fail while others are fine.

3. DNS is the thing actually broken. "Can't reach the internet" is frequently "can't resolve the name." If CoreDNS is unhealthy, throttled, or being blocked by the same NetworkPolicy above, every outbound call fails at lookup. Tell: a raw IP works but a hostname doesn't.

The fast diagnosis: from inside the pod, try a known IP versus a hostname. IP works but name fails → DNS. Both fail → routing or NetworkPolicy. Then check whether it's cluster-wide (egress/firewall) or namespace-scoped (policy).

The pod is almost never the problem. It's the path. AKS gives you a lot of control over that path, which is exactly why it's the first place to look.