outline/templates/outline.networkpolicy.yaml

@@ -140,27 +140,15 @@ spec:
       {{- end }}
   egress:
     {{- /*
-    TEMPORARY - THIS COMMIT IS AN EXPERIMENT AND IS REVERTED IN THE NEXT ONE.
-
-    The DNS rule is REMOVED here on purpose. Everything about the scope of
-    Gitea #5 rests on the install-test enforcing NetworkPolicies, and the first
-    experiment did not settle it: restricting cyberchef's probe port to an
-    address that cannot be the node's left the install-test GREEN. That has two
-    possible causes and they are very different - either k3s' policy controller
-    exempts the kubelet's probe traffic, which would be good news for this
-    convention, or it enforces nothing at all, which would mean there is no net
-    under this rollout.
-
-    This separates them, unambiguously and without touching a probe. Outline
-    resolves "postgres" and "redis" by name, and all three of its probes hit
-    /_health, which checks BOTH stores. With no DNS rule and policyTypes
-    Egress, every lookup fails.
-
-    EXPECTED: the pod never becomes Ready, rollout status times out, the
-    outline install-test goes RED - which proves egress is enforced.
-    If it goes GREEN, nothing is enforced in CI and the scope of this issue has
-    to be renegotiated rather than pushed through.
+    DNS, unconditionally. There is no value to switch this off, and that is
+    deliberate: a knob whose only other setting breaks every name lookup in
+    the pod is a trap and not a feature.
     */}}
+    - ports:
+        - protocol: UDP
+          port: 53
+        - protocol: TCP
+          port: 53
     {{- /*
     Postgres. The port, not the host - outline.secrets.dbSecretRef carries a
     connection URL the chart never parses, so this is the STANDARD port and not