vibecarbon 0.1.0

package/carbon/k8s/base/app/rbac.yaml

@@ -0,0 +1,36 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: vibecarbon-app
+# Pull secrets are attached to the `default` SA by deploy.js at runtime
+# (dockerhub-pull-secret for Supabase images, ghcr-pull-secret for the app
+# image). This app SA inherits the same set so the app Deployment — which
+# uses serviceAccountName: vibecarbon-app — can pull the private ghcr image.
+imagePullSecrets:
+  - name: dockerhub-pull-secret
+  - name: ghcr-pull-secret
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: vibecarbon-app-logs
+rules:
+  - apiGroups: [""]
+    resources: ["pods"]
+    verbs: ["list", "get"]
+  - apiGroups: [""]
+    resources: ["pods/log"]
+    verbs: ["get"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: vibecarbon-app-logs
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: vibecarbon-app-logs
+subjects:
+  - kind: ServiceAccount
+    name: vibecarbon-app
+    namespace: vibecarbon

package/carbon/k8s/base/app/service.yaml

@@ -0,0 +1,16 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: app
+  labels:
+    app: vibecarbon-app
+    component: application
+spec:
+  type: ClusterIP
+  ports:
+    - port: 3000
+      targetPort: http
+      protocol: TCP
+      name: http
+  selector:
+    app: vibecarbon-app

package/carbon/k8s/base/backup/cronjob.yaml

@@ -0,0 +1,120 @@
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: backup
+  labels:
+    app: vibecarbon-backup
+    component: backup
+spec:
+  schedule: 0 2 * * *
+  concurrencyPolicy: Forbid
+  successfulJobsHistoryLimit: 3
+  failedJobsHistoryLimit: 3
+  jobTemplate:
+    spec:
+      activeDeadlineSeconds: 3600
+      backoffLimit: 2
+      template:
+        metadata:
+          labels:
+            app: vibecarbon-backup
+            component: backup
+        spec:
+          restartPolicy: OnFailure
+          serviceAccountName: backup-sa
+          containers:
+          - name: backup
+            image: ghcr.io/{{GITHUB_OWNER}}/{{PROJECT_NAME}}-backup:latest
+            imagePullPolicy: Always
+            env:
+            - name: PGHOST
+              valueFrom:
+                configMapKeyRef:
+                  name: vibecarbon-config
+                  key: DB_HOST
+            - name: PGPORT
+              valueFrom:
+                configMapKeyRef:
+                  name: vibecarbon-config
+                  key: DB_PORT
+            - name: PGUSER
+              value: supabase_admin
+            - name: PGDATABASE
+              valueFrom:
+                configMapKeyRef:
+                  name: vibecarbon-config
+                  key: DB_NAME
+            - name: PGPASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: vibecarbon-secrets
+                  key: DB_PASSWORD
+            - name: S3_ACCESS_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: vibecarbon-secrets
+                  key: S3_ACCESS_KEY
+                  optional: true
+            - name: S3_SECRET_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: vibecarbon-secrets
+                  key: S3_SECRET_KEY
+                  optional: true
+            - name: S3_BUCKET
+              valueFrom:
+                secretKeyRef:
+                  name: vibecarbon-secrets
+                  key: S3_BUCKET
+                  optional: true
+            - name: S3_ENDPOINT
+              valueFrom:
+                secretKeyRef:
+                  name: vibecarbon-secrets
+                  key: S3_ENDPOINT
+                  optional: true
+            - name: S3_REGION
+              valueFrom:
+                secretKeyRef:
+                  name: vibecarbon-secrets
+                  key: S3_REGION
+                  optional: true
+            - name: S3_BACKUP_BUCKET
+              valueFrom:
+                secretKeyRef:
+                  name: vibecarbon-secrets
+                  key: S3_BACKUP_BUCKET
+                  optional: true
+            - name: BACKUP_RETENTION_DAYS
+              valueFrom:
+                configMapKeyRef:
+                  name: vibecarbon-config
+                  key: BACKUP_RETENTION_DAYS
+                  optional: true
+            - name: STORAGE_BACKEND
+              value: file
+            # Use pg_dump (network protocol) instead of WAL-G in this
+            # CronJob — WAL-G's backup-push needs direct filesystem access
+            # to PGDATA, which only the supabase-db pod has. The backup
+            # pod runs separately and connects via PGHOST, so it has to
+            # use the libpq-based pg_dump path. Switching WAL-G on for
+            # k8s would require a sidecar inside supabase-db.
+            - name: BACKUP_MODE
+              value: pg_dump
+            - name: PROJECT_NAME
+              valueFrom:
+                configMapKeyRef:
+                  name: vibecarbon-config
+                  key: PROJECT_NAME
+            resources:
+              requests:
+                cpu: 100m
+                memory: 256Mi
+              limits:
+                cpu: 500m
+                memory: 512Mi
+            securityContext:
+              allowPrivilegeEscalation: false
+          securityContext:
+            seccompProfile:
+              type: RuntimeDefault

package/carbon/k8s/base/backup/kustomization.yaml

@@ -0,0 +1,7 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - cronjob.yaml
+  - rbac.yaml
+  - network-policy.yaml

package/carbon/k8s/base/backup/network-policy.yaml

@@ -0,0 +1,31 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: backup-policy
+  namespace: vibecarbon
+spec:
+  podSelector:
+    matchLabels:
+      app: vibecarbon-backup
+  policyTypes:
+    - Egress
+  egress:
+    # Connect to PostgreSQL for pg_dump
+    - to:
+        - podSelector:
+            matchLabels:
+              app: vibecarbon-postgres
+      ports:
+        - protocol: TCP
+          port: 5432
+    # Upload to S3 (external HTTPS)
+    - to:
+        - ipBlock:
+            cidr: 0.0.0.0/0
+            except:
+              - 10.0.0.0/8
+              - 172.16.0.0/12
+              - 192.168.0.0/16
+      ports:
+        - protocol: TCP
+          port: 443

package/carbon/k8s/base/backup/rbac.yaml

@@ -0,0 +1,7 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: backup-sa
+  labels:
+    app: vibecarbon-backup
+    component: backup

package/carbon/k8s/base/cluster-autoscaler/deployment.yaml

@@ -0,0 +1,103 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: cluster-autoscaler
+  namespace: kube-system
+  labels:
+    app: cluster-autoscaler
+spec:
+  replicas: 1
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app: cluster-autoscaler
+  template:
+    metadata:
+      labels:
+        app: cluster-autoscaler
+    spec:
+      serviceAccountName: cluster-autoscaler
+      priorityClassName: system-cluster-critical
+      hostNetwork: true
+      dnsPolicy: ClusterFirstWithHostNet
+      tolerations:
+        - key: node-role.kubernetes.io/control-plane
+          operator: Exists
+          effect: NoSchedule
+      nodeSelector:
+        node-role.kubernetes.io/control-plane: "true"
+      securityContext:
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+        - name: cluster-autoscaler
+          image: registry.k8s.io/autoscaling/cluster-autoscaler:v1.32.7
+          imagePullPolicy: IfNotPresent
+          securityContext:
+            runAsNonRoot: true
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            capabilities:
+              drop:
+                - ALL
+          command:
+            - ./cluster-autoscaler
+          args:
+            - --cloud-provider=hetzner
+            - --nodes={{CA_NODES_SPEC}}
+            - --scale-down-delay-after-add=10m
+            - --scale-down-delay-after-delete=1m
+            - --scale-down-delay-after-failure=3m
+            - --scale-down-unneeded-time=10m
+            - --scale-down-utilization-threshold=0.5
+            - --skip-nodes-with-local-storage=false
+            - --skip-nodes-with-system-pods=false
+            - --balance-similar-node-groups=true
+            - --expander=least-waste
+            - --v=4
+          env:
+            - name: HCLOUD_TOKEN
+              valueFrom:
+                secretKeyRef:
+                  name: hcloud-cluster-config
+                  key: token
+            - name: HCLOUD_NETWORK
+              value: '{{CLUSTER_NAME}}-network'
+            - name: HCLOUD_FIREWALL
+              value: '{{CLUSTER_NAME}}-firewall'
+            - name: HCLOUD_SSH_KEY
+              value: '{{CLUSTER_NAME}}-{{REGION}}-key'
+            # cluster-autoscaler v1.32.x reads the config inline from
+            # HCLOUD_CLUSTER_CONFIG, not HCLOUD_CLUSTER_CONFIG_FILE — the
+            # _FILE variant landed on master post-1.33 and is not in 1.32.7.
+            # Sourcing from the Secret data.cluster-config.json gives us the
+            # decoded JSON payload as the env value (same Secret keeps both
+            # the token and the cluster-config under separate keys).
+            # Surfaced k8s e2e fanout5 2026-05-01: autoscaler crashed
+            # on every restart with "HCLOUD_CLUSTER_CONFIG or HCLOUD_CLOUD_INIT
+            # is not specified" despite _FILE pointing at a real path.
+            - name: HCLOUD_CLUSTER_CONFIG
+              valueFrom:
+                secretKeyRef:
+                  name: hcloud-cluster-config
+                  key: cluster-config.json
+          resources:
+            requests:
+              cpu: 100m
+              memory: 128Mi
+            limits:
+              cpu: 500m
+              memory: 384Mi
+          volumeMounts:
+            - name: ssl-certs
+              mountPath: /etc/ssl/certs/ca-certificates.crt
+              readOnly: true
+            - name: tmp-vol-0
+              mountPath: /tmp
+      volumes:
+        - name: ssl-certs
+          hostPath:
+            path: /etc/ssl/certs/ca-certificates.crt
+        - name: tmp-vol-0
+          emptyDir: {}

package/carbon/k8s/base/cluster-autoscaler/kustomization.yaml

@@ -0,0 +1,17 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+# Cluster-autoscaler must live in `kube-system`. The parent
+# `carbon/k8s/base/kustomization.yaml` sets `namespace: vibecarbon`,
+# whose namespace transformer overrides every namespaced resource
+# below it — including ours. Phase 5 (`applyK3sManifests`) therefore
+# applies this kustomization standalone via
+# `kubectl apply -k carbon/k8s/base/cluster-autoscaler/` so the
+# `namespace: kube-system` directive below takes effect, mirroring
+# the CCM/CSI pattern (those are listed in `base/kustomization.yaml`
+# only as comments and applied separately from cloud-init).
+namespace: kube-system
+
+resources:
+  - deployment.yaml
+  - rbac.yaml

package/carbon/k8s/base/cluster-autoscaler/rbac.yaml

@@ -0,0 +1,109 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: cluster-autoscaler
+  namespace: kube-system
+  labels:
+    app: cluster-autoscaler
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: cluster-autoscaler
+  labels:
+    app: cluster-autoscaler
+rules:
+  - apiGroups: [""]
+    resources: ["events", "endpoints"]
+    verbs: ["create", "patch"]
+  - apiGroups: [""]
+    resources: ["pods/eviction"]
+    verbs: ["create"]
+  - apiGroups: [""]
+    resources: ["pods/status"]
+    verbs: ["update"]
+  - apiGroups: [""]
+    resources: ["endpoints"]
+    resourceNames: ["cluster-autoscaler"]
+    verbs: ["get", "update"]
+  - apiGroups: [""]
+    resources: ["nodes"]
+    verbs: ["watch", "list", "get", "update"]
+  - apiGroups: [""]
+    resources: ["namespaces", "pods", "services", "replicationcontrollers", "persistentvolumeclaims", "persistentvolumes"]
+    verbs: ["watch", "list", "get"]
+  - apiGroups: ["batch"]
+    resources: ["jobs", "cronjobs"]
+    verbs: ["watch", "list", "get"]
+  - apiGroups: ["batch", "extensions"]
+    resources: ["jobs"]
+    verbs: ["get", "list", "patch", "watch"]
+  - apiGroups: ["extensions"]
+    resources: ["replicasets", "daemonsets"]
+    verbs: ["watch", "list", "get"]
+  - apiGroups: ["policy"]
+    resources: ["poddisruptionbudgets"]
+    verbs: ["watch", "list"]
+  - apiGroups: ["apps"]
+    resources: ["daemonsets", "replicasets", "statefulsets"]
+    verbs: ["watch", "list", "get"]
+  - apiGroups: ["storage.k8s.io"]
+    resources: ["storageclasses", "csinodes", "csidrivers", "csistoragecapacities"]
+    verbs: ["watch", "list", "get"]
+  - apiGroups: [""]
+    resources: ["configmaps"]
+    verbs: ["list", "watch"]
+  - apiGroups: ["coordination.k8s.io"]
+    resources: ["leases"]
+    verbs: ["create"]
+  - apiGroups: ["coordination.k8s.io"]
+    resourceNames: ["cluster-autoscaler"]
+    resources: ["leases"]
+    verbs: ["get", "update"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: cluster-autoscaler
+  labels:
+    app: cluster-autoscaler
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: cluster-autoscaler
+subjects:
+  - kind: ServiceAccount
+    name: cluster-autoscaler
+    namespace: kube-system
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: cluster-autoscaler
+  namespace: kube-system
+  labels:
+    app: cluster-autoscaler
+rules:
+  - apiGroups: [""]
+    resources: ["configmaps"]
+    verbs: ["create", "list", "watch"]
+  - apiGroups: [""]
+    resources: ["configmaps"]
+    resourceNames: ["cluster-autoscaler-status", "cluster-autoscaler-priority-expander"]
+    verbs: ["delete", "get", "update", "watch"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: cluster-autoscaler
+  namespace: kube-system
+  labels:
+    app: cluster-autoscaler
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: cluster-autoscaler
+subjects:
+  - kind: ServiceAccount
+    name: cluster-autoscaler
+    namespace: kube-system

package/carbon/k8s/base/config/configmap.yaml

@@ -0,0 +1,48 @@
+# Non-secret runtime configuration consumed by Supabase + app containers.
+# Committed to git; safe to reconcile via Flux.
+#
+# The vibecarbon-secrets Secret that used to live next to this file is
+# now created at deploy time — either by the vibecarbon CLI (imperative
+# deploy) or by the GitHub Actions deploy workflow
+# (.github/workflows/deploy.yml, GitOps deploy). That Secret is NOT
+# reconciled by Flux — it's owned by field-manager=github-actions-deploy
+# (workflow) or field-manager=kubectl-client-side-apply (CLI), and Flux
+# leaves it alone. This lets us rotate secrets via `gh secret set --env
+# prod KEY=value` without a git commit.
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: vibecarbon-config
+data:
+  # Site Configuration — SITE_URL is patched in by deploy code once the
+  # real domain is known (before-domain-known default is the placeholder
+  # below; deploy patches to https://<domain> via kubectlPatch).
+  SITE_URL: "https://app.example.com"
+  PROJECT_NAME: "vibecarbon"
+
+  # Database (in-cluster service names). The Supabase community Helm chart
+  # gives every component a `supabase-supabase-<name>` service via its
+  # release-name + chart-name pattern — `db` lives at supabase-supabase-db.
+  # Consumed by app/deployment.yaml + backup/cronjob.yaml; the chart's
+  # subcharts have their own internal wiring and do NOT read this map.
+  # Plain "postgres" silently falls back to no-such-host: backup pods print
+  # "could not translate host name 'postgres'" and pg_dump exits 1 (observed
+  # 2026-04-27 k8s-ha matrix #6).
+  DB_HOST: "supabase-supabase-db"
+  DB_PORT: "5432"
+  DB_NAME: "postgres"
+
+  # Internal Service URLs. Supabase community chart gives each subchart a
+  # fullnameOverride of `supabase-supabase-<name>`, so these are the ACTUAL
+  # in-cluster service names as of supabase-community chart v0.5.5.
+  KONG_URL: "http://supabase-supabase-kong:8000"
+  AUTH_URL: "http://supabase-supabase-auth:9999"
+  REST_URL: "http://supabase-supabase-rest:3000"
+  REALTIME_URL: "http://supabase-supabase-realtime:4000"
+  STORAGE_URL: "http://supabase-supabase-storage:5000"
+  META_URL: "http://supabase-supabase-meta:8080"
+  IMGPROXY_URL: "http://supabase-supabase-imgproxy:5001"
+
+  # Backup Configuration
+  BACKUP_RETENTION_DAYS: "7"

package/carbon/k8s/base/config/kustomization.yaml

@@ -0,0 +1,8 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - configmap.yaml
+
+generatorOptions:
+  disableNameSuffixHash: true

package/carbon/k8s/base/hetzner-ccm/kustomization.yaml

@@ -0,0 +1,9 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+# Hetzner Cloud Controller Manager
+# This enables automatic Load Balancer provisioning and node lifecycle management
+# Official repo: https://github.com/hetznercloud/hcloud-cloud-controller-manager
+
+resources:
+  - https://github.com/hetznercloud/hcloud-cloud-controller-manager/releases/download/v1.20.0/ccm-networks.yaml

package/carbon/k8s/base/hetzner-csi/kustomization.yaml

@@ -0,0 +1,9 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+# Hetzner CSI Driver
+# This enables automatic Hetzner Volume provisioning for PersistentVolumeClaims
+# Official repo: https://github.com/hetznercloud/csi-driver
+
+resources:
+  - https://raw.githubusercontent.com/hetznercloud/csi-driver/v2.9.0/deploy/kubernetes/hcloud-csi.yml

package/carbon/k8s/base/kustomization.yaml

@@ -0,0 +1,43 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+namespace: vibecarbon
+
+resources:
+  - namespace.yaml
+  - network-policies.yaml
+  # `config/` holds the vibecarbon-config ConfigMap (non-secret runtime
+  # settings — service URLs, retention days, etc.). The previous
+  # `secrets/` dir which bundled a Secret alongside the ConfigMap is
+  # gone — the Secret is now applied at deploy time by either the
+  # vibecarbon CLI or the .github/workflows/deploy.yml GitHub Action,
+  # with field-manager=github-actions-deploy so Flux doesn't touch it.
+  # See /home/brandon/.claude/plans/after-12-hours-of-goofy-snail.md.
+  - config/
+  # Note: hetzner-ccm and hetzner-csi are installed via cloud-init (master-init.sh)
+  # Note: cert-manager is installed separately via infra/ kustomization
+  # Note: Supabase (postgres, kong, auth, rest, realtime, storage, imgproxy,
+  # meta, studio, supavisor, edge-functions) is installed via the community
+  # Helm chart — see the helm step in src/lib/deploy/k8s/k3s.js. Values come
+  # from k8s/values/supabase.values.yaml, rendered at deploy time with our
+  # secrets.
+  - app/
+  - backup/
+  # `registry/` runs an S3-backed image registry on the master node (hostPort
+  # 5000 on the private network). Sideload remains primary for static workers,
+  # but cluster-autoscaler-spawned workers don't exist at sideload time —
+  # they pull from this registry on first schedule via the registries.yaml
+  # mirror config laid down in cloud-init.
+  - registry/
+  # Note: cluster-autoscaler is installed separately by applyK3sManifests
+  # (Phase 5) because it lives in `kube-system`, not `vibecarbon` — listing
+  # it here would let this kustomization's `namespace: vibecarbon`
+  # transformer rewrite its ServiceAccount/Role/RoleBinding/Deployment
+  # into the wrong namespace. Apply with:
+  #   kubectl apply -k carbon/k8s/base/cluster-autoscaler/
+  # Mirrors the CCM/CSI pattern above.
+  - traefik/
+
+labels:
+  - pairs:
+      app.kubernetes.io/part-of: vibecarbon

package/carbon/k8s/base/namespace.yaml

@@ -0,0 +1,7 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: vibecarbon
+  labels:
+    app.kubernetes.io/name: vibecarbon
+    app.kubernetes.io/managed-by: kustomize

package/carbon/k8s/base/network-policies.yaml

@@ -0,0 +1,95 @@
+# =============================================================================
+# VIBECARBON NETWORK POLICIES (CLUSTER BASELINE)
+# =============================================================================
+# These policies implement a "deny by default" approach with explicit allowlists
+# for required communication paths.
+#
+# Security Principle: Pods can only communicate with explicitly allowed targets.
+# =============================================================================
+
+---
+# Default deny all INGRESS for the namespace. We don't deny egress by
+# default — that broke the Supabase community chart whose subcharts
+# (auth, rest, realtime, storage, analytics) init-container against the
+# `supabase-supabase-db` service and don't have vibecarbon-app labels
+# our specific allow-policies matched.
+#
+# The chart-internal east/west traffic is fine inside the namespace;
+# external egress restrictions are enforced by the Hetzner firewall
+# (no outbound from cluster-public nets to arbitrary ports anyway).
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: default-deny-all
+  namespace: vibecarbon
+spec:
+  podSelector: {}
+  policyTypes:
+    - Ingress
+
+---
+# Allow ALL ingress from other pods in the same namespace. Chart
+# subcharts need to reach the db / kong / each other without us
+# having to enumerate every label combination the chart might use.
+# External ingress still gates through traefik-policy + app-policy etc.
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: allow-intra-namespace
+  namespace: vibecarbon
+spec:
+  podSelector: {}
+  policyTypes:
+    - Ingress
+  ingress:
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: vibecarbon
+
+---
+# Allow egress to pods in the same namespace. Symmetric with the
+# allow-intra-namespace ingress policy above. Required because
+# `allow-dns` below selects all pods with Egress policyType, which
+# implicitly switches the namespace to default-deny-egress for those
+# pods. Without this, the Supabase subchart init containers can resolve
+# `supabase-supabase-db` via DNS but the TCP connect to :5432 is
+# dropped, causing a 25-minute wait-for-db loop on every cold install.
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: allow-intra-namespace-egress
+  namespace: vibecarbon
+spec:
+  podSelector: {}
+  policyTypes:
+    - Egress
+  egress:
+    - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: vibecarbon
+---
+# Allow DNS resolution for all pods
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: allow-dns
+  namespace: vibecarbon
+spec:
+  podSelector: {}
+  policyTypes:
+    - Egress
+  egress:
+    - to:
+        # Use namespaceSelector only (no podSelector) so kustomize commonLabels doesn't
+        # add environment/region/role labels to the selector, which would exclude CoreDNS
+        # pods (managed by k3s, they only have k8s-app: kube-dns, not overlay labels).
+        - namespaceSelector:
+            matchLabels:
+                kubernetes.io/metadata.name: kube-system
+      ports:
+        - protocol: UDP
+          port: 53
+        - protocol: TCP
+          port: 53