outline/templates/outline.networkpolicy.yaml

@@ -140,15 +140,27 @@ spec:
       {{- end }}
   egress:
     {{- /*
-    DNS, unconditionally. There is no value to switch this off, and that is
+    TEMPORARY - THIS COMMIT IS AN EXPERIMENT AND IS REVERTED IN THE NEXT ONE.
-    deliberate: a knob whose only other setting breaks every name lookup in
+
-    the pod is a trap and not a feature.
+    The DNS rule is REMOVED here on purpose. Everything about the scope of
+    Gitea #5 rests on the install-test enforcing NetworkPolicies, and the first
+    experiment did not settle it: restricting cyberchef's probe port to an
+    address that cannot be the node's left the install-test GREEN. That has two
+    possible causes and they are very different - either k3s' policy controller
+    exempts the kubelet's probe traffic, which would be good news for this
+    convention, or it enforces nothing at all, which would mean there is no net
+    under this rollout.
+
+    This separates them, unambiguously and without touching a probe. Outline
+    resolves "postgres" and "redis" by name, and all three of its probes hit
+    /_health, which checks BOTH stores. With no DNS rule and policyTypes
+    Egress, every lookup fails.
+
+    EXPECTED: the pod never becomes Ready, rollout status times out, the
+    outline install-test goes RED - which proves egress is enforced.
+    If it goes GREEN, nothing is enforced in CI and the scope of this issue has
+    to be renegotiated rather than pushed through.
     */}}
-    - ports:
-        - protocol: UDP
-          port: 53
-        - protocol: TCP
-          port: 53
     {{- /*
     Postgres. The port, not the host - outline.secrets.dbSecretRef carries a
     connection URL the chart never parses, so this is the STANDARD port and not