All new HNS endpoints are getting allocated state 3 and even kubernetes.default is not getting resolved from these containers.

k exec -it pws-new16 -n calico-demo -- powershell
apiVersion: v1
Windows PowerShell
Copyright (C) Microsoft Corporation. All rights reserved.

PS C:> nslookup kubernetes.default
DNS request timed out.
timeout was 2 seconds.
Server: UnKnown
Address: 100.80.0.10

DNS request timed out.
timeout was 2 seconds.
DNS request timed out.
timeout was 2 seconds.
PS C:> ping 8.8.8.8

Pinging 8.8.8.8 with 32 bytes of data:
Request timed out.

Ping statistics for 8.8.8.8:
Packets: Sent = 1, Received = 0, Lost = 1 (100% loss),

================

Calico - 3.30.3

System Info:

Kernel Version: 10.0.20348.3453
OS Image: Windows Server 2022 Standard
Operating System: windows
Architecture: amd64
Container Runtime Version: containerd://1.7.28
Kubelet Version: v1.31.6
Kube-Proxy Version: v1.31.6

---

Calico-felix logs

========

PS C:>
PS C:> Get-HnsEndpoint | Where-Object {$_.IPAddress -eq "100.97.47.77"} | Select Name, State, VirtualNetworkName, GatewayAddress

Name State VirtualNetworkName GatewayAddress

---

91a0ccd3034a15de35d735ddd6345d4fc5b525023f1f34fce2054ab395ac38ee_Calico 3 Calico 100.97.47.65

PS C:> Get-HnsEndpoint | Where-Object {$_.IPAddress -eq "100.97.47.77"} | Select Name, State, VirtualNetworkName, GatewayAddress

Name State VirtualNetworkName GatewayAddress

---

91a0ccd3034a15de35d735ddd6345d4fc5b525023f1f34fce2054ab395ac38ee_Calico 3 Calico 100.97.47.65

PS C:> ^C
PS C:>
PS C:>
PS C:> Get-HnsEndpoint | Where-Object { $_.IPAddress -eq "100.97.47.77" } | Format-List *

ActivityId : CA157C8C-53FA-4E6C-8D83-AB66CB15BF57
AdditionalParams :
CreateProcessingStartTime : 134051801323244814
DNSServerList : 100.80.0.10
DNSSuffix : calico-demo.svc.cluster.local,svc.cluster.local,cluster.local
EncapOverhead : 50
GatewayAddress : 100.97.47.65
Health : @{LastErrorCode=0; LastUpdateTime=134051801323217573}
ID : 2B4A35BF-04AF-4F25-8668-D231DF67AB4E
IPAddress : 100.97.47.77
InterfaceConstraint : @{InterfaceGuid=00000000-0000-0000-0000-000000000000}
MacAddress : 0E-2A-64-61-2f-4d
Name : 91a0ccd3034a15de35d735ddd6345d4fc5b525023f1f34fce2054ab395ac38ee_Calico
Namespace : @{ID=763FF3AE-F966-4CB9-854E-B63B4DF4C640; IsDefault=False}
Policies : {@{ExceptionList=System.Object[]; Type=OutBoundNAT}, @{DestinationPrefix=100.80.0.0/12; NeedEncap=True; Type=ROUTE}, @{PA=10.117.0.143; Type=PA}, @{Destinations=System.Object[]; Type=OutBoundNAT}...}
PrefixLength : 26
Resources : @{AdditionalParams=; AllocationOrder=18; Allocators=System.Object[]; Health=; ID=CA157C8C-53FA-4E6C-8D83-AB66CB15BF57; PortOperationTime=0; State=1; SwitchOperationTime=0; VfpOperationTime=0;
parentId=CA79BA6A-AC17-40ED-97A2-C0BB0CCEAA44}
SharedContainers : {91a0ccd3034a15de35d735ddd6345d4fc5b525023f1f34fce2054ab395ac38ee, 931a24bc19da5f58bff47a338014e2ae7ace4f5af8f630d995103bb6b1f7dc21}
StartTime : 134051801328533038
State : 3
Type : Overlay
Version : 38654705669
VirtualNetwork : 2f44c5a0-697c-4555-b697-c9f22d157116
VirtualNetworkName : Calico

Start with the reproduced PowerShell commands for kubernetes.default, 8.8.8.8, and Get-HnsEndpoint, then inspect the endpoint's State, Resources.State, policies, and DNSServerList alongside the Calico-felix logs. Done means identifying why new HNS endpoints remain in state 3 and restoring DNS resolution and outbound connectivity from the Windows containers.