taylanbakircioglu 99f44f854c feat: DNS search domain normalization to deduplicate graph nodes ...

Kubernetes DNS search domain expansion creates multiple NXDOMAIN queries
for the same external domain (e.g. auth.docker.io.cluster.local,
auth.docker.io.svc.cluster.local). Without normalization, each variant
becomes a separate Neo4j node, inflating Public connections on the Map.

Backend (graph-writer):
- Rewrite _normalize_dns_name with TLD-safe 4-step algorithm
- Strip .svc.cluster.local, .<ns>.svc.cluster.local, .cluster.local
- Support custom search domains via DNS_SEARCH_DOMAINS env var
- Apply normalization in process_dns_query and process_sni_event
- Fix NXDOMAIN vertex overriding NOERROR resolved IP data
- Add KNOWN_TLDS/MULTI_LEVEL_TLDS for .com.tr/.co.uk safety checks

Frontend (NetworkExplorer):
- Add "Hide Search Domain Artifacts" toggle on DNS Queries tab
- Detect NXDOMAIN entries ending with .cluster.local
- Show artifact count, toggle hidden by default

Raw ClickHouse data and API responses are NOT modified — only the
dependency graph (Neo4j) is deduplicated. Full debugging data preserved.

Tests: 31 cases covering normalization, edge cases, and integration.
Made-with: Cursor

2026-04-02 14:34:00 +03:00

..

test_dns_normalization.py

feat: DNS search domain normalization to deduplicate graph nodes

2026-04-02 14:34:00 +03:00