Keep provisioner DNS egress in network policy

2026-07-28 17:51:13 +02:00 · 2026-07-28 17:51:13 +02:00 · d2c59fbf5e
commit d2c59fbf5e
parent 816c5c3773
1 changed files with 4 additions and 4 deletions
--- a/sso-mfa/k8s/identity-provisioner/deployment.yaml
+++ b/sso-mfa/k8s/identity-provisioner/deployment.yaml
@ -86,6 +86,10 @@ spec:
        - podSelector:
            matchLabels: {app.kubernetes.io/name: lldap}
      ports: [{protocol: TCP, port: 17170}]
+    - to:
+        - namespaceSelector:
+            matchLabels: {kubernetes.io/metadata.name: kube-system}
+      ports: [{protocol: UDP, port: 53}, {protocol: TCP, port: 53}]
 ---
 apiVersion: networking.k8s.io/v1
 kind: Ingress
@ -112,10 +116,6 @@ spec:
  tls:
    - hosts: [kc.coulomb.social]
      secretName: kc-tls
-    - to:
-        - namespaceSelector:
-            matchLabels: {kubernetes.io/metadata.name: kube-system}
-      ports: [{protocol: UDP, port: 53}, {protocol: TCP, port: 53}]
 ---
 apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy