mirror of
https://github.com/cozystack/cozystack.git
synced 2026-11-08 21:14:56 +09:00
chore(coredns): refresh coredns chart to 1.46.0 (#3004)
## What this PR does Re-vendors the CoreDNS Helm chart from `1.43.2` to `1.46.0` (chart `appVersion` `1.12.3` → `1.13.1`) and pins the `make update` target to `--version 1.46.0` so re-vendoring is reproducible (it was previously tracking upstream `latest` silently). The running CoreDNS **image is deliberately kept** at `registry.k8s.io/coredns/coredns:v1.12.4`. It is pinned to the 1.12 line that matches the Kubernetes-bundled kube-dns replacement, and v1.12.4 is the latest patch of that line (itself a security release). The cozystack-side `values.yaml` pins `coredns.image.tag: v1.12.4`, so the chart's `appVersion` bump never reaches the deployed container — the rendered Deployment still uses `v1.12.4`. The kube-dns overrides (`k8sAppLabelOverride`, `service.name`, `serviceAccount.name`) stay valid. The new chart template logic (`dnsConfig`/`dnsPolicy`, ServiceMonitor `scrapeTimeout`/`scheme`/`honorLabels`/`tlsConfig`/relabelings, multicluster RBAC, `customAnnotations`, `automountServiceAccountToken`) is inert under the cozystack values — none of those keys are set, so every new conditional is skipped and the bump is behavior-neutral for the pinned configuration. This references #2899 but does **not** close it: that ticket asks to advance the CoreDNS *image* for CVE remediation, which conflicts with the kube-dns version alignment. Whether to move the bundled CoreDNS line forward (and thus the image) is a platform-level call, left open on the issue. ### Release note ```release-note chore(coredns): refresh vendored CoreDNS chart to 1.46.0 (image held at v1.12.4 for kube-dns alignment) ``` <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added DNS policy and custom DNS configuration options for deployments * Introduced pod labels support for custom pod labeling * Expanded Prometheus monitoring with scrape timeout, TLS configuration, and relabeling options * Added multicluster RBAC support capability * **Chores** * Updated CoreDNS to version 1.13.1 * Bumped Helm chart version to 1.46.0 <!-- end of auto-generated comment: release notes by coderabbit.ai -->
This commit is contained in:
8 files changed
+97
-9
No files matched your search
@@ -10,7 +10,7 @@ update:
|
||||
rm -rf charts
|
||||
helm repo add cozy-coredns https://coredns.github.io/helm
|
||||
helm repo update cozy-coredns
|
||||
helm pull cozy-coredns/coredns --untar --untardir charts
|
||||
helm pull cozy-coredns/coredns --untar --untardir charts --version 1.46.0
|
||||
# Drop vendored upstream helm-unittest fixtures: they hard-code
|
||||
# upstream defaults (test-release-coredns names, no
|
||||
# k8sAppLabelOverride, no service.name override) and fail under
|
||||
|
||||
@@ -1,9 +1,9 @@
|
||||
annotations:
|
||||
artifacthub.io/changes: |
|
||||
- kind: changed
|
||||
description: Bump to CoreDNS 1.12.3
|
||||
- kind: added
|
||||
description: Add scrapeTimeout, scheme, honorLabels, tlsConfig, relabelings, and metricRelabelings options to ServiceMonitor endpoint
|
||||
apiVersion: v2
|
||||
appVersion: 1.12.3
|
||||
appVersion: 1.13.1
|
||||
description: CoreDNS is a DNS server that chains plugins and provides Kubernetes DNS
|
||||
Services
|
||||
home: https://coredns.io
|
||||
@@ -21,4 +21,4 @@ name: coredns
|
||||
sources:
|
||||
- https://github.com/coredns/coredns
|
||||
type: application
|
||||
version: 1.43.2
|
||||
version: 1.46.0
|
||||
@@ -108,7 +108,7 @@ The command removes all the Kubernetes components associated with the chart and
|
||||
## Configuration
|
||||
|
||||
| Parameter | Description | Default |
|
||||
| :--------------------------------------------- | :---------------------------------------------------------------------------------------------------------------------------------------- | :----------------------------------------------------------- |
|
||||
| :--------------------------------------------- |:------------------------------------------------------------------------------------------------------------------------------------------| :----------------------------------------------------------- |
|
||||
| `image.repository` | The image repository to pull from | coredns/coredns |
|
||||
| `image.tag` | The image tag to pull from (derived from Chart.yaml) | `` |
|
||||
| `image.pullPolicy` | Image pull policy | IfNotPresent |
|
||||
@@ -126,6 +126,12 @@ The command removes all the Kubernetes components associated with the chart and
|
||||
| `prometheus.monitor.additionalLabels` | Additional labels that can be used so ServiceMonitor will be discovered by Prometheus | {} |
|
||||
| `prometheus.monitor.namespace` | Selector to select which namespaces the Endpoints objects are discovered from. | `""` |
|
||||
| `prometheus.monitor.interval` | Scrape interval for polling the metrics endpoint. (E.g. "30s") | `""` |
|
||||
| `prometheus.monitor.scrapeTimeout` | Timeout for each scrape request. (E.g. "10s") | `""` |
|
||||
| `prometheus.monitor.scheme` | HTTP scheme used for scraping. (`http` or `https`) | `""` |
|
||||
| `prometheus.monitor.honorLabels` | Honor labels from the target when scraping | `false` |
|
||||
| `prometheus.monitor.tlsConfig` | TLS configuration for the metrics endpoint (e.g. `insecureSkipVerify`, certificates) | `{}` |
|
||||
| `prometheus.monitor.relabelings` | List of target relabeling rules applied before scraping | `[]` |
|
||||
| `prometheus.monitor.metricRelabelings` | List of metric relabeling rules applied after scraping | `[]` |
|
||||
| `prometheus.monitor.selector` | Service selector | `{}` |
|
||||
| `service.clusterIP` | IP address to assign to service | `""` |
|
||||
| `service.clusterIPs` | IP addresses to assign to service | `[]` |
|
||||
@@ -140,6 +146,7 @@ The command removes all the Kubernetes components associated with the chart and
|
||||
| `serviceAccount.name` | If not set & create is true, use template fullname | |
|
||||
| `rbac.create` | If true, create & use RBAC resources | true |
|
||||
| `rbac.pspEnable` | Specifies whether a PodSecurityPolicy should be created. | `false` |
|
||||
| `rbac.multiclusterEnable` | Specifies whether the kubernetes plugin multicluster RBAC should be created. | `false` |
|
||||
| `isClusterService` | Specifies whether chart should be deployed as cluster-service or normal k8s app. | true |
|
||||
| `priorityClassName` | Name of Priority Class to assign pods | `""` |
|
||||
| `securityContext` | securityContext definition for pods | capabilities.add.NET_BIND_SERVICE |
|
||||
@@ -164,13 +171,15 @@ The command removes all the Kubernetes components associated with the chart and
|
||||
| `extraVolumes` | Optional array of volumes to create | [] |
|
||||
| `extraVolumeMounts` | Optional array of volumes to mount inside the CoreDNS container | [] |
|
||||
| `extraSecrets` | Optional array of secrets to mount inside the CoreDNS container | [] |
|
||||
| `env` | Optional array of environment variables for CoreDNS container | [] |
|
||||
| `env` | Optional array of environment variables for CoreDNS container | [] |
|
||||
| `customLabels` | Optional labels for Deployment(s), Pod, Service, ServiceMonitor objects | {} |
|
||||
| `customAnnotations` | Optional annotations for Deployment(s), Pod, Service, ServiceMonitor objects |
|
||||
| `rollingUpdate.maxUnavailable` | Maximum number of unavailable replicas during rolling update | `1` |
|
||||
| `rollingUpdate.maxSurge` | Maximum number of pods created above desired number of pods | `25%` |
|
||||
| `podDisruptionBudget` | Optional PodDisruptionBudget | {} |
|
||||
| `podAnnotations` | Optional Pod only Annotations | {} |
|
||||
| `podLabels` | Optional Pod only Labels | {} |
|
||||
| `dnsConfig` | Optional Pod DNS configuration. When set, `dnsPolicy` is automatically set to `None` | {} |
|
||||
| `terminationGracePeriodSeconds` | Optional duration in seconds the pod needs to terminate gracefully. | 30 |
|
||||
| `hpa.enabled` | Enable Hpa autoscaler instead of proportional one | `false` |
|
||||
| `hpa.minReplicas` | Hpa minimum number of CoreDNS replicas | `1` |
|
||||
@@ -208,6 +217,8 @@ The command removes all the Kubernetes components associated with the chart and
|
||||
| `deployment.name` | Name of the deployment if `deployment.enabled` is true. Otherwise the name of an existing deployment for the autoscaler or HPA to target. | `""` |
|
||||
| `deployment.annotations` | Annotations to add to the main deployment | `{}` |
|
||||
| `deployment.selector` | Pod selector | `{}` |
|
||||
| `deployment.dnsPolicy` | DNS policy for the pod (Default, ClusterFirst, ClusterFirstWithHostNet, None) | `"Default"` |
|
||||
| `deployment.dnsConfig` | Custom DNS configuration (nameservers, searches, options). Required when dnsPolicy is "None" | `{}` |
|
||||
| `clusterRole.nameOverride` | ClusterRole name override | |
|
||||
|
||||
See `values.yaml` for configuration notes. Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. For example,
|
||||
|
||||
@@ -4,6 +4,10 @@ kind: ClusterRole
|
||||
metadata:
|
||||
name: {{ template "coredns.clusterRoleName" . }}
|
||||
labels: {{- include "coredns.labels" . | nindent 4 }}
|
||||
{{- with .Values.customAnnotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
@@ -33,4 +37,14 @@ rules:
|
||||
resourceNames:
|
||||
- {{ template "coredns.fullname" . }}
|
||||
{{- end }}
|
||||
{{- if .Values.rbac.multiclusterEnable }}
|
||||
- apiGroups:
|
||||
- multicluster.x-k8s.io
|
||||
resources:
|
||||
- serviceexports
|
||||
- serviceimports
|
||||
verbs:
|
||||
- list
|
||||
- watch
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -4,6 +4,10 @@ kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: {{ template "coredns.clusterRoleName" . }}
|
||||
labels: {{- include "coredns.labels" . | nindent 4 }}
|
||||
{{- with .Values.customAnnotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
|
||||
@@ -49,6 +49,9 @@ spec:
|
||||
app.kubernetes.io/instance: {{ .Release.Name | quote }}
|
||||
{{- if .Values.customLabels }}
|
||||
{{ toYaml .Values.customLabels | indent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.podLabels }}
|
||||
{{ toYaml .Values.podLabels | indent 8 }}
|
||||
{{- end }}
|
||||
annotations:
|
||||
checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }}
|
||||
@@ -66,15 +69,25 @@ spec:
|
||||
terminationGracePeriodSeconds: {{ .Values.terminationGracePeriodSeconds }}
|
||||
{{- end }}
|
||||
serviceAccountName: {{ template "coredns.serviceAccountName" . }}
|
||||
{{- if eq .Values.automountServiceAccountToken false }}
|
||||
automountServiceAccountToken: false
|
||||
{{- end }}
|
||||
{{- if .Values.priorityClassName }}
|
||||
priorityClassName: {{ .Values.priorityClassName | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.isClusterService }}
|
||||
dnsPolicy: Default
|
||||
dnsPolicy: {{ .Values.deployment.dnsPolicy }}
|
||||
{{- end }}
|
||||
{{- if and (eq .Values.deployment.dnsPolicy "None") (not .Values.deployment.dnsConfig) }}
|
||||
{{- fail "dnsConfig is required when dnsPolicy is set to None" }}
|
||||
{{- end }}
|
||||
{{- with .Values.deployment.dnsConfig }}
|
||||
dnsConfig:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.affinity }}
|
||||
affinity:
|
||||
{{ toYaml .Values.affinity | indent 8 }}
|
||||
{{ tpl (toYaml .Values.affinity) $ | indent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.topologySpreadConstraints }}
|
||||
topologySpreadConstraints:
|
||||
|
||||
@@ -37,4 +37,25 @@ spec:
|
||||
{{- if .Values.prometheus.monitor.interval }}
|
||||
interval: {{ .Values.prometheus.monitor.interval }}
|
||||
{{- end }}
|
||||
{{- if .Values.prometheus.monitor.scrapeTimeout }}
|
||||
scrapeTimeout: {{ .Values.prometheus.monitor.scrapeTimeout }}
|
||||
{{- end }}
|
||||
{{- if .Values.prometheus.monitor.scheme }}
|
||||
scheme: {{ .Values.prometheus.monitor.scheme }}
|
||||
{{- end }}
|
||||
{{- if .Values.prometheus.monitor.honorLabels }}
|
||||
honorLabels: {{ .Values.prometheus.monitor.honorLabels }}
|
||||
{{- end }}
|
||||
{{- with .Values.prometheus.monitor.tlsConfig }}
|
||||
tlsConfig:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.prometheus.monitor.relabelings }}
|
||||
relabelings:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.prometheus.monitor.metricRelabelings }}
|
||||
metricRelabelings:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -34,6 +34,8 @@ terminationGracePeriodSeconds: 30
|
||||
podAnnotations: {}
|
||||
# cluster-autoscaler.kubernetes.io/safe-to-evict: "false"
|
||||
|
||||
podLabels: {}
|
||||
|
||||
serviceType: "ClusterIP"
|
||||
|
||||
prometheus:
|
||||
@@ -48,6 +50,12 @@ prometheus:
|
||||
additionalLabels: {}
|
||||
namespace: ""
|
||||
interval: ""
|
||||
scrapeTimeout: ""
|
||||
scheme: ""
|
||||
honorLabels: false
|
||||
tlsConfig: {}
|
||||
relabelings: []
|
||||
metricRelabelings: []
|
||||
selector: {}
|
||||
|
||||
service:
|
||||
@@ -403,6 +411,23 @@ deployment:
|
||||
annotations: {}
|
||||
## Pod selector
|
||||
selector: {}
|
||||
# dnsPolicy determines how DNS resolution is handled for the pod.
|
||||
# When isClusterService is true, this defaults to "Default" to avoid circular DNS resolution.
|
||||
# Options: Default, ClusterFirst, ClusterFirstWithHostNet, None
|
||||
# If set to "None", you must provide dnsConfig.
|
||||
dnsPolicy: "Default"
|
||||
# dnsConfig allows fine-grained DNS configuration for the pod.
|
||||
# Only used when dnsPolicy is set to "None" or when custom DNS settings are needed.
|
||||
# Example:
|
||||
# dnsConfig:
|
||||
# nameservers:
|
||||
# - 8.8.8.8
|
||||
# searches:
|
||||
# - my.dns.search.suffix
|
||||
# options:
|
||||
# - name: ndots
|
||||
# value: "2"
|
||||
dnsConfig: {}
|
||||
|
||||
# Configures initcontainers for the coredns deployment.
|
||||
initContainers: []
|
||||
Reference in new issue
Block a user