1 changed files with 7 additions and 1 deletions
@@ -68,7 +68,11 @@ spec:
              protocol: TCP
            - port: "8000"
              protocol: TCP
-    # Allow DNS resolution
+    # DNS — both the pod's own resolution AND forwarded mesh queries to
+    # the kube-dns LoadBalancer (kube-dns-lb, fd99::83 / 10.2.99.83),
+    # which is how mesh peers resolve renner.uno → Traefik VIP now that
+    # the old 10.2.40.53 / LXC-260 gateway path is decommissioned. TCP
+    # included because the LB exposes 53/tcp for large/truncated answers.
    - toEndpoints:
        - matchLabels:
            "k8s:io.kubernetes.pod.namespace": kube-system
@@ -77,6 +81,8 @@ spec:
        - ports:
            - port: "53"
              protocol: UDP
+            - port: "53"
+              protocol: TCP
    # NetBird control + data plane (netbird.renner.uno, external)
    - toEntities:
        - world