feat(coredns): restrict kube-dns-lb ingress to the internal networks #1590

2026-11-07T10:19:50Z

claude-bot commented

2026-11-07 10:19:50 +00:00

Adds coredns-ingress, the first policy on the CoreDNS pods:

fromEntities: cluster on all ports: pods, nodes, kubelet probes, Prometheus
all 17 client CIDR groups on 53/UDP+TCP, per the approved matrix ("all internal networks")

Selecting the pods makes them default-deny for ingress, so a missing rule here breaks DNS cluster-wide. Merge this one last and on its own, then verify in-cluster resolution and resolution through 10.2.99.83 / fd99::83.

kube-dns-lb is ETP=Local. Server-side dry-run passes and the kustomization renders.

Refs S28-19

🤖 Generated with Claude Code

Adds `coredns-ingress`, the first policy on the CoreDNS pods: - `fromEntities: cluster` on all ports: pods, nodes, kubelet probes, Prometheus - all 17 client CIDR groups on 53/UDP+TCP, per the approved matrix ("all internal networks") Selecting the pods makes them default-deny for ingress, so a missing rule here breaks DNS cluster-wide. Merge this one last and on its own, then verify in-cluster resolution and resolution through 10.2.99.83 / fd99::83. `kube-dns-lb` is ETP=Local. Server-side dry-run passes and the kustomization renders. Refs S28-19 🤖 Generated with [Claude Code](https://claude.com/claude-code)

claude-bot added 1 commit 2026-11-07 10:19:51 +00:00

feat(coredns): restrict kube-dns-lb ingress to the internal networks

ci/woodpecker/pr/ci-manifests-test Pipeline was successful

Details

ci/woodpecker/pr/ci-scripts-test Pipeline was successful

Details

37dc17065d

CoreDNS had no policy, so kube-dns-lb answered any source. The new CNP
allows the whole cluster on every port and the internal client networks
on 53/UDP+TCP. Selecting the pods makes them default-deny for ingress.

Refs S28-19

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

k.renner merged commit 43861d34c1 into main

2026-11-07 10:31:17 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: konairius/homelab#1590