coilyco-flight-deck/infrastructure

Watch

fix: stop cluster-wide DNSConfigForming warnings #591

New issue

Closed

opened 2026-07-23 04:35:49 +00:00 by coilyco-ops · 2 comments

coilyco-ops commented

2026-07-23 04:35:49 +00:00

Owner

Problem

Kubelet has emitted DNSConfigForming warnings across many unrelated pods for more than 10 days because the node resolver supplies more nameservers than Kubernetes permits in a pod resolver configuration.

The warnings affect system and application namespaces, which makes event-based health review noisy and risks silently dropping a resolver that a workload expects.

Scope

Identify the resolver file k3s passes to pods.
Converge a Kubernetes-safe resolver configuration with no more than the supported nameserver count.
Preserve the DNS paths required for ordinary internet, LAN, and tailnet name resolution.
Put the resolver choice in tracked host configuration rather than a hand edit.

Acceptance

Newly created pods do not receive DNSConfigForming warnings.
CoreDNS and representative application pods resolve internet, LAN, and tailnet names.
The node keeps the resolver configuration after reboot and Ansible converge.

## Problem Kubelet has emitted `DNSConfigForming` warnings across many unrelated pods for more than 10 days because the node resolver supplies more nameservers than Kubernetes permits in a pod resolver configuration. The warnings affect system and application namespaces, which makes event-based health review noisy and risks silently dropping a resolver that a workload expects. ## Scope * Identify the resolver file k3s passes to pods. * Converge a Kubernetes-safe resolver configuration with no more than the supported nameserver count. * Preserve the DNS paths required for ordinary internet, LAN, and tailnet name resolution. * Put the resolver choice in tracked host configuration rather than a hand edit. ## Acceptance * Newly created pods do not receive `DNSConfigForming` warnings. * CoreDNS and representative application pods resolve internet, LAN, and tailnet names. * The node keeps the resolver configuration after reboot and Ansible converge.

coilyco-ops added the

autonomy

headless

priority

labels

2026-07-29 03:46:25 +00:00

coilyco-ops referenced this issue from a commit

2026-07-29 12:48:40 +00:00

fix(k3s): converge pod resolver

coilyco-ops closed this issue

2026-07-29 12:48:40 +00:00

coilyco-ops referenced this issue

2026-07-29 12:51:00 +00:00

interactive: apply and verify k3s pod resolver #688

coilyco-ops commented

2026-07-29 12:53:35 +00:00

Author

Owner

WARD-WORKFLOW: done ✅

details

workflow: merge-remote-main; review summary: in-container review gate intentionally skipped because implementation and QA are role-separated. QA is a separate, opt-in exact-commit verification role bound to candidate e992407d0d25e018600a0f9162221b74e3b37ebb.

Landed on main. The implementation felt clean once the boundary was clear: one managed pod resolver delegates split DNS to systemd-resolved instead of truncating dynamic uplinks. Full pre-commit passed. Successor-main lint and secret scanning passed.

Confidence: high for repository validity and convergence shape. Live health is intentionally unclaimed by the sealed engineer.

Surprise: a newer main push concurrency-cancelled the candidate lint run; its successful successor contains the candidate.

Follow-up: interactive apply, reboot, event, and DNS-path verification is filed as #688.

Signed: Codex

WARD-WORKFLOW: done ✅ <details><summary>details</summary> workflow: merge-remote-main; review summary: in-container review gate intentionally skipped because implementation and QA are role-separated. QA is a separate, opt-in exact-commit verification role bound to candidate `e992407d0d25e018600a0f9162221b74e3b37ebb`. Landed on `main`. The implementation felt clean once the boundary was clear: one managed pod resolver delegates split DNS to systemd-resolved instead of truncating dynamic uplinks. Full pre-commit passed. Successor-main lint and secret scanning passed. Confidence: high for repository validity and convergence shape. Live health is intentionally unclaimed by the sealed engineer. Surprise: a newer main push concurrency-cancelled the candidate lint run; its successful successor contains the candidate. Follow-up: interactive apply, reboot, event, and DNS-path verification is filed as #688. Signed: Codex </details>

coilyco-ops commented

2026-07-29 12:53:49 +00:00

Author

Owner

WARD-WORKFLOW: reservation-released

release details

Run finished with WARD-WORKFLOW: done ✅.

ward container reap released container engineer-codex-infrastructure-591 (--harness codex): the terminal outcome supersedes the reservation, so a later redispatch no longer needs --override-reservation.

— Codex, via ward agent

WARD-WORKFLOW: reservation-released <details><summary>release details</summary> Run finished with `WARD-WORKFLOW: done ✅`. `ward container reap` released container `engineer-codex-infrastructure-591` (`--harness codex`): the terminal outcome supersedes the reservation, so a later redispatch no longer needs `--override-reservation`. </details>  — Codex, via `ward agent`

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

coilyco-flight-deck/infrastructure#591

No description provided.

Rows
Columns