Microsoft Defender publisher is failing to due to the Failed to register a new certificate with TLS12, error dial tcp: lookup 7c726abc-b5b0-4d63-b7fa-19fbb818be15.oms.opinsights.azure.com on 10.0.0.10:53: no such host in our private AKS cluster

Question

We are facing an error message in our private AKS cluster under the kube-system namespace , where the microsoft-defender-publisher-ds is in crashback loop state and its not in the running state and the memory usage is also extremely high in our AKS cluster .
Please find the below error message for one of the daemon set running in one of the nodes .

"Failed to register a new certificate with TLS12, error Post "https://7c726abc-b5b0-4d63-b7fa-19fbb818be15.oms.opinsights.azure.com/AgentService.svc/LinuxAgentTopologyRequest":

dial tcp: lookup 7c726abc-b5b0-4d63-b7fa-19fbb818be15.oms.opinsights.azure.com on 10.0.0.10:53: no such host" componentName=Publisher

Answer 1

Hello Rajesh Mohan,

This issue is caused by DNS resolution failure inside your private AKS cluster. Specifically, the microsoft-defender-publisher-ds pod is unable to resolve the Log Analytics endpoint (*.oms.opinsights.azure.com) via the internal DNS (10.0.0.10). This is why you see the error:

dial tcp: lookup 7c726abc-b5b0-4d63-b7fa-19fbb818be15.oms.opinsights.azure.com on 10.0.0.10:53: no such host

The reason for this is because your AKS cluster is private and likely using Azure CNI with a custom VNet and restricted outbound access. This setup blocks the Defender agent from reaching required public FQDNs like *.oms.opinsights.azure.com, *.agentsvc.azure-automation.net and *.azure-automation.net

Why?

Ans- These endpoints are required by Microsoft Defender for Containers to register with Azure Monitor and fetch its configuration.

How to fix it then?

Ans- Add NAT Gateway and DNS Resolution

Ensure the cluster subnet has a NAT Gateway. This is required for outbound internet access (since your AKS is private).

# Create NAT Gateway and attach a Public IP

az network public-ip create \

  --resource-group <your-rg> \

  --name natPublicIP \

  --sku Standard \

  --allocation-method Static \

  --location <region>

az network nat gateway create \

  --resource-group <your-rg> \

  --name aksNatGateway \

  --location <region> \

  --public-ip-addresses natPublicIP \

  --idle-timeout 10

# Attach NAT Gateway to the AKS subnet

az network vnet subnet update \

  --resource-group <your-rg> \

  --vnet-name <your-vnet> \

  --name <your-aks-subnet> \

  --nat-gateway aksNatGateway

You can run the below command to verify your AKS private DNS zone is linked to your VNet-

az network private-dns zone list \

  --resource-group MC_<rg>_<aksname>_<region> \

  --query "[?contains(name, 'azmk8s.io')].name" -o tsv

and then check if VNet is linked or not

az network private-dns link vnet list \

  --resource-group MC_<rg>_<aksname>_<region> \

  --zone-name <output from above>

If not linked, run

az network private-dns link vnet create \

  --resource-group MC_<rg>_<aksname>_<region> \

  --zone-name <private-dns-zone> \

  --name aks-dns-link \

  --virtual-network <aks-vnet-id> \

  --registration-enabled false

Done. Now you can verify DNS Resolution. For this example, I have a test VM from where I will do a nslookup. It should work, i.e if you get an IP address, DNS is working.

Once DNS and outbound connectivity are working, restart the Publisher pods

kubectl delete pod -n kube-system -l componentName=Publisher

They should now pull config and register with Defender successfully.

MS doc for the same