fix(iptables): emit one DNS rule per address

[mxhob1]

Problem

Wireguard.status.dns can hold more than one resolver (an anycast pair, e.g. "172.31.255.253, 172.31.255.254"). GenerateIptableRulesFromNetworkPolicies interpolated that string straight into a single rule:

fmt.Sprintf("-A %s -d %s -p UDP --dport 53 -j ACCEPT", peerChain, kubeDnsIp)
→ -A <chain> -d 172.31.255.253, 172.31.255.254 -p UDP --dport 53 -j ACCEPT

iptables-restore takes one address per -d and tokenises on whitespace, so it aborts:

Bad argument `172.31.255.254'
Error occurred at line: 19

Impact: iptables-restore is all-or-nothing. Every agent state sync fails, leaving the ruleset half-applied and forwarding through wg0 broken for ~10s — while the pod itself stays pingable. In production this fired on every operator state push (each triggered by routine peer liveness transitions from road-warrior peers), causing synchronised ~100-device monitoring outages several times a day, chronically. Observed on 2 of 7 tenants in a 30-minute window.

Fix

Split kubeDnsIp on commas, trim, skip empties, and emit one UDP + one TCP rule per address. Safe for IPv6 (addresses use : not ,) and a no-op for the single-address case.

Verification

• RED first: new table case Multiple DNS servers emit one rule per address reproduced the exact prod output (-d 172.31.255.253, 172.31.255.254 ...) before the fix.
• GREEN: all 6 TestIptableRules subtests pass; internal/ipam + internal/iptables pass; go build ./..., go vet, gofmt clean. (internal/controller needs envtest assets, not run.)
• End-to-end against the real binary in the production agent pod using iptables-restore --test (dry-run):
  • broken form → Bad argument `172.31.255.254'
  • fixed form → accepted cleanly

🤖 Generated with Claude Code

[mxhob1]

Superseded by the PR against noden/main — main has diverged and doesn't carry the liveness feature, so a fix merged here would never reach production.