From d2c59fbf5e84e3b5bcdc8ace4e0cf2aab5b74fc8 Mon Sep 17 00:00:00 2001
From: tegwick <bernd.worsch@gmail.com>
Date: Tue, 28 Jul 2026 17:51:13 +0200
Subject: [PATCH] Keep provisioner DNS egress in network policy

---
 sso-mfa/k8s/identity-provisioner/deployment.yaml | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/sso-mfa/k8s/identity-provisioner/deployment.yaml b/sso-mfa/k8s/identity-provisioner/deployment.yaml
index 201915d..d961329 100644
--- a/sso-mfa/k8s/identity-provisioner/deployment.yaml
+++ b/sso-mfa/k8s/identity-provisioner/deployment.yaml
@@ -86,6 +86,10 @@ spec:
         - podSelector:
             matchLabels: {app.kubernetes.io/name: lldap}
       ports: [{protocol: TCP, port: 17170}]
+    - to:
+        - namespaceSelector:
+            matchLabels: {kubernetes.io/metadata.name: kube-system}
+      ports: [{protocol: UDP, port: 53}, {protocol: TCP, port: 53}]
 ---
 apiVersion: networking.k8s.io/v1
 kind: Ingress
@@ -112,10 +116,6 @@ spec:
   tls:
     - hosts: [kc.coulomb.social]
       secretName: kc-tls
-    - to:
-        - namespaceSelector:
-            matchLabels: {kubernetes.io/metadata.name: kube-system}
-      ports: [{protocol: UDP, port: 53}, {protocol: TCP, port: 53}]
 ---
 apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy