42cc2a67a7
This updates coredns chart to include the podsecurity context on the pod template This also adds the container security context to set readOnlyRootFilesystem to true Change-Id: Ib44e7b9e5d0ccc642ee095062f3aefcfef2a98f8
91 lines
1.8 KiB
YAML
91 lines
1.8 KiB
YAML
conf:
|
|
coredns:
|
|
corefile: |
|
|
.:53 {
|
|
errors
|
|
health
|
|
autopath @kubernetes
|
|
kubernetes cluster.local 10.96.0.0/16 10.97.0.0/16 {
|
|
pods disabled
|
|
fallthrough in-addr.arpa ip6.arpa
|
|
upstream 8.8.8.8
|
|
upstream 8.8.4.4
|
|
}
|
|
prometheus :9253
|
|
forward . 8.8.8.8 8.8.4.4
|
|
cache 30
|
|
}
|
|
|
|
test:
|
|
names_to_resolve:
|
|
- kubernetes.default.svc.cluster.local
|
|
|
|
images:
|
|
tags:
|
|
coredns: coredns/coredns:1.1.3
|
|
test: coredns/coredns:1.1.3
|
|
pull_policy: "IfNotPresent"
|
|
|
|
labels:
|
|
coredns:
|
|
node_selector_key: coredns
|
|
node_selector_value: enabled
|
|
|
|
service:
|
|
name: coredns
|
|
ip: 10.96.0.10
|
|
|
|
pod:
|
|
security_context:
|
|
coredns:
|
|
pod:
|
|
runAsUser: 65534
|
|
container:
|
|
coredns:
|
|
runAsUser: 0
|
|
readOnlyRootFilesystem: true
|
|
lifecycle:
|
|
upgrades:
|
|
# This is only meaningful when deploying as a DaemonSet
|
|
daemonsets:
|
|
pod_replacement_strategy: RollingUpdate
|
|
coredns:
|
|
enabled: true
|
|
min_ready_seconds: 0
|
|
max_unavailable: 30%
|
|
termination_grace_period:
|
|
coredns:
|
|
timeout: 30
|
|
resources:
|
|
enabled: false
|
|
coredns:
|
|
requests:
|
|
memory: "128Mi"
|
|
cpu: "100m"
|
|
limits:
|
|
memory: "1024Mi"
|
|
cpu: "2000m"
|
|
pod_test:
|
|
requests:
|
|
memory: "128Mi"
|
|
cpu: "100m"
|
|
limits:
|
|
memory: "1024Mi"
|
|
cpu: "2000m"
|
|
# This is only meaningful when deploying as a Deployment
|
|
replicas:
|
|
coredns: 3
|
|
|
|
monitoring:
|
|
prometheus:
|
|
enabled: false
|
|
coredns:
|
|
scrape: true
|
|
port: 9253
|
|
|
|
manifests:
|
|
# This chart can deploy CoreDNS as a Deployment, as a DaemonSet, or both
|
|
daemonset: false
|
|
deployment: true
|
|
pod_test: true
|