Debian's dnsmasq looks for /run/dnsmasq/resolv.conf, which only resolvconf writes; without it every name outside the cluster domain was refused, so nodes could not resolve mirrors or site services. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>