From afe009637a1aa4577ff972fa0de08314e9e89a9b Mon Sep 17 00:00:00 2001 From: Claude Bot Date: Fri, 16 Oct 2026 07:51:19 +0200 Subject: [PATCH] fix(talos): host DNS asks k8s-gateway first containerd pulls in-house images from gitea.renner.uno in the host network namespace, through Talos host DNS. Its only upstream was the UDM (from DHCP), so every node-level pull of an in-cluster registry depended on an external DNS. A ResolverConfig document lists k8s-gateway (10.96.0.11) first and the UDM second. It replaces the DHCP nameservers. Talos host DNS tries upstreams in order and moves on after an error or SERVFAIL/REFUSED (internal/pkg/dns/dns.go); a silent upstream costs the 2 s proxy read timeout (coredns plugin/pkg/proxy), inside the 4.5 s per-query deadline, so a cold node still resolves through the UDM until Cilium and k8s-gateway are up. Dry run on k8s-1: applies without reboot. Co-Authored-By: Claude Opus 5.5 --- kubernetes/talos/patches/site-homelab.yaml | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/kubernetes/talos/patches/site-homelab.yaml b/kubernetes/talos/patches/site-homelab.yaml index f0607281..4f790a2d 100644 --- a/kubernetes/talos/patches/site-homelab.yaml +++ b/kubernetes/talos/patches/site-homelab.yaml @@ -51,3 +51,13 @@ kind: RoutingRuleConfig name: "1001" src: 10.244.0.0/16 table: "47" +--- +# Host DNS asks k8s-gateway first, so containerd resolves in-cluster names +# (gitea.renner.uno) in the cluster. The UDM answers while k8s-gateway is not +# reachable yet; Talos moves on after a 2 s read timeout. This list replaces +# the nameservers from DHCP. +apiVersion: v1alpha1 +kind: ResolverConfig +nameservers: + - address: 10.96.0.11 + - address: 10.2.40.1