fix(otbr): let otbr reach its Thread radio and the Ubuntu archive

The namespace baseline denies both, so the container cannot install socat at startup and crash-loops; the spinel link to slzb-thread:6638 would be denied next (S28-48). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-11-08 10:47:14 +01:00
1 changed files with 40 additions and 0 deletions
@@ -541,6 +541,46 @@ spec:
            - port: "443"
              protocol: TCP
 ---
+# otbr: the SLZB-06P7 Thread radio (spinel over TCP) and the Ubuntu archive,
+# from which the container installs socat at startup.
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: otbr-egress
+  namespace: home-assistant
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: otbr
+  egress:
+    # rules.dns lets Cilium learn the toFQDNs mapping
+    - toEndpoints:
+        - matchLabels:
+            "k8s:io.kubernetes.pod.namespace": kube-system
+            k8s-app: kube-dns
+      toPorts:
+        - ports:
+            - port: "53"
+              protocol: UDP
+            - port: "53"
+              protocol: TCP
+          rules:
+            dns:
+              - matchPattern: "*"
+    - toFQDNs:
+        - matchName: "slzb-thread.renner.uno"
+      toPorts:
+        - ports:
+            - port: "6638"
+              protocol: TCP
+    - toFQDNs:
+        - matchName: "archive.ubuntu.com"
+        - matchName: "security.ubuntu.com"
+      toPorts:
+        - ports:
+            - port: "80"
+              protocol: TCP
+---
 # mqtt-account-controller: credential delivery to deliver.esp32 targets in mqtt-accounts.yaml.
 apiVersion: cilium.io/v2
 kind: CiliumNetworkPolicy