From dbdc3cda4b7eb7da0c15893f432aa1b1528afb60 Mon Sep 17 00:00:00 2001 From: Konstantin Renner Date: Thu, 25 Jun 2026 20:08:21 +0200 Subject: [PATCH] feat(ingress): allow netbird-ingress peer to forward DNS over TCP/53 Mesh peers resolve renner.uno via the kube-dns LoadBalancer (kube-dns-lb, fd99::83 / 10.2.99.83) through the netbird-ingress routing peer, now that the old 10.2.40.53 / LXC-260 gateway DNS path is decommissioned. The kube-dns-lb Service exposes 53 on both UDP and TCP; add TCP so large or truncated DNS answers aren't dropped by the egress policy. Co-Authored-By: Claude Opus 4.8 (1M context) --- .../network-policies/ingress-isolation.yaml | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/kubernetes/infrastructure/network-policies/ingress-isolation.yaml b/kubernetes/infrastructure/network-policies/ingress-isolation.yaml index 1adc265f..fe0d96e3 100644 --- a/kubernetes/infrastructure/network-policies/ingress-isolation.yaml +++ b/kubernetes/infrastructure/network-policies/ingress-isolation.yaml @@ -68,7 +68,11 @@ spec: protocol: TCP - port: "8000" protocol: TCP - # Allow DNS resolution + # DNS — both the pod's own resolution AND forwarded mesh queries to + # the kube-dns LoadBalancer (kube-dns-lb, fd99::83 / 10.2.99.83), + # which is how mesh peers resolve renner.uno → Traefik VIP now that + # the old 10.2.40.53 / LXC-260 gateway path is decommissioned. TCP + # included because the LB exposes 53/tcp for large/truncated answers. - toEndpoints: - matchLabels: "k8s:io.kubernetes.pod.namespace": kube-system @@ -77,6 +81,8 @@ spec: - ports: - port: "53" protocol: UDP + - port: "53" + protocol: TCP # NetBird control + data plane (netbird.renner.uno, external) - toEntities: - world -- 2.54.0