Problem

I'm implementing a multi-tenant architecture in Kubernetes and trying to enforce strict isolation between tenants.

So far, I've achieved:

• Network isolation using Cilium as the CNI
• Host-level isolation using gVisor

However, I'm facing challenges with DNS isolation.

Currently, any Pod can resolve services in other namespaces via CoreDNS, even if the Pods cannot communicate with each other due to network isolation. This breaks the multi-tenancy model I’m aiming for.

Expected Behavior

Ideally, I want CoreDNS to return NXDOMAIN for any DNS query targeting services in namespace X if the query does not originate from namespace X.

In short:

Cross-namespace service discovery should be blocked at the DNS level.

Question

Is it currently possible to achieve this kind of namespace-based DNS access control with CoreDNS?

If not, would it be feasible to write a CoreDNS plugin that:

• Uses the source Pod's namespace (from metadata or request context)
• Compares it with the target service namespace
• Returns NXDOMAIN if they differ

I'd appreciate any guidance or suggestions.

Thanks in advance!