fix(database): force PgBouncer DNS over TCP

[Tanguille]

Summary

• force DNS over TCP in the RW, RO, and session PgBouncer pods
• bypass the c-ares UDP resolver failure that leaves CNPG backend pools unable to resolve postgres16-rw
• prevent downstream services such as Memini from surfacing misleading authentication errors when their database is unavailable

Validation

• git diff --check
• mise exec -- flate test all — 278 passed
• focused independent review — GO, no findings

Summary by CodeRabbit

• Bug Fixes
  • Improved DNS resolution reliability for database connection pooling services by enabling TCP-based DNS queries.
  • Updated read-only, session-mode, and standard pooling configurations consistently to reduce potential DNS-related connectivity issues.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 53cfe51b-faf7-4d65-9a91-b9cf040aef0f

📥 Commits

Reviewing files that changed from the base of the PR and between 77e93df and 3dd7329.

📒 Files selected for processing (3)

• kubernetes/apps/database/cloudnative-pg/cluster/pooler-ro.yaml
• kubernetes/apps/database/cloudnative-pg/cluster/pooler-session.yaml
• kubernetes/apps/database/cloudnative-pg/cluster/pooler.yaml

---

📝 Walkthrough

Walkthrough

The three CloudNativePG PgBouncer pooler manifests now configure pod DNS with the use-vc option, enabling TCP-based DNS resolution.

Changes

Pooler DNS Configuration

Layer / File(s)	Summary
Configure DNS over TCP kubernetes/apps/database/cloudnative-pg/cluster/pooler*.yaml	The default, read-only, and session-mode pooler pod templates add dnsConfig.options with name: use-vc.

Estimated code review effort: 1 (Trivial) | ~2 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: forcing PgBouncer DNS resolution over TCP.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/pgbouncer-dns-tcp

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 Checkov (3.3.8)

kubernetes/apps/database/cloudnative-pg/cluster/pooler-ro.yaml

Traceback (most recent call last):
File "/usr/local/bin/checkov", line 2, in
from checkov.main import Checkov
ModuleNotFoundError: No module named 'checkov'

kubernetes/apps/database/cloudnative-pg/cluster/pooler-session.yaml

Traceback (most recent call last):
File "/usr/local/bin/checkov", line 2, in
from checkov.main import Checkov
ModuleNotFoundError: No module named 'checkov'

kubernetes/apps/database/cloudnative-pg/cluster/pooler.yaml

Traceback (most recent call last):
File "/usr/local/bin/checkov", line 2, in
from checkov.main import Checkov
ModuleNotFoundError: No module named 'checkov'

---

_{Comment @coderabbitai help to get the list of available commands.}

[tanguille-cluster]

@@ spec.template.spec @@
# postgresql.cnpg.io/v1/Pooler/database/pgbouncer-rw
! + one map entry added:
+ dnsConfig:
+   options:
+   - name: use-vc

@@ spec.template.spec @@
# postgresql.cnpg.io/v1/Pooler/database/pgbouncer-ro
! + one map entry added:
+ dnsConfig:
+   options:
+   - name: use-vc

@@ spec.template.spec @@
# postgresql.cnpg.io/v1/Pooler/database/pgbouncer-session
! + one map entry added:
+ dnsConfig:
+   options:
+   - name: use-vc

[github-actions]

AI Automated Review

Analysis engine: qwen-3.6-fast@http://litellm.ai.svc.cluster.local/v1 (openai)

Recommendation

Approve. This is a small, targeted fix that adds dnsConfig with the use-vc option to all three PgBouncer Pooler manifests. The change is consistent across files, follows existing repository patterns for dnsConfig usage, and addresses a documented operational issue (c-ares UDP resolver failures). Validation passed (flate test all — 278 passed).

Change-by-change findings

1. kubernetes/apps/database/cloudnative-pg/cluster/pooler.yaml — Adds dnsConfig.options[0].name: use-vc under spec.template.spec. Consistent with the PR title and intent.
2. kubernetes/apps/database/cloudnative-pg/cluster/pooler-ro.yaml — Same addition applied to the read-only pooler.
3. kubernetes/apps/database/cloudnative-pg/cluster/pooler-session.yaml — Same addition applied to the session-mode pooler.

All three files already contain resource requests/limits and topology spread constraints; this addition does not alter those settings. The indentation matches the surrounding YAML (6 spaces for dnsConfig, 8 for options, 10 for - name).

Standards Compliance

• Conventional Commit: Title fix(database): force PgBouncer DNS over TCP follows the required format.
• Validation: Author reports git diff --check and mise exec -- flate test all both pass.
• Existing patterns: Other manifests in this repo (e.g., seerr, prowlarr-exporter) also use dnsConfig under spec.template.spec, confirming this is an accepted pattern.
• No secrets, no SOPS edits, no schema changes.

Unknowns or Needs Verification

• use-vc semantics: The Kubernetes dnsConfig option use-vc instructs the c-ares resolver to prefer TCP for queries exceeding the UDP size limit (or always, depending on implementation). This is a well-known option but is not explicitly documented in the repo's AGENTS.md. It appears safe and consistent with the PR's stated intent. If the cluster's CoreDNS or node-level DNS configuration behaves unexpectedly with forced-TCP fallback, monitoring after merge would be prudent — but this is informational, not a blocker.