It is only resolving for devices in the Tailnet. Kuma is checking they are all up, and this Ansible playbook is checking they have all their updates. I wouldn't have thought that was an unusual arrangement - and it's worked perfectly for about a year till about three weeks ago.