diff --git a/packages/system/coredns/Makefile b/packages/system/coredns/Makefile index 027800401..7ae42f72a 100644 --- a/packages/system/coredns/Makefile +++ b/packages/system/coredns/Makefile @@ -10,7 +10,7 @@ update: rm -rf charts helm repo add cozy-coredns https://coredns.github.io/helm helm repo update cozy-coredns - helm pull cozy-coredns/coredns --untar --untardir charts + helm pull cozy-coredns/coredns --untar --untardir charts --version 1.46.0 # Drop vendored upstream helm-unittest fixtures: they hard-code # upstream defaults (test-release-coredns names, no # k8sAppLabelOverride, no service.name override) and fail under diff --git a/packages/system/coredns/charts/coredns/Chart.yaml b/packages/system/coredns/charts/coredns/Chart.yaml index f3e9282fc..44c1cb2bc 100644 --- a/packages/system/coredns/charts/coredns/Chart.yaml +++ b/packages/system/coredns/charts/coredns/Chart.yaml @@ -1,9 +1,9 @@ annotations: artifacthub.io/changes: | - - kind: changed - description: Bump to CoreDNS 1.12.3 + - kind: added + description: Add scrapeTimeout, scheme, honorLabels, tlsConfig, relabelings, and metricRelabelings options to ServiceMonitor endpoint apiVersion: v2 -appVersion: 1.12.3 +appVersion: 1.13.1 description: CoreDNS is a DNS server that chains plugins and provides Kubernetes DNS Services home: https://coredns.io @@ -21,4 +21,4 @@ name: coredns sources: - https://github.com/coredns/coredns type: application -version: 1.43.2 +version: 1.46.0 diff --git a/packages/system/coredns/charts/coredns/README.md b/packages/system/coredns/charts/coredns/README.md index 1ba154d48..7e5895821 100644 --- a/packages/system/coredns/charts/coredns/README.md +++ b/packages/system/coredns/charts/coredns/README.md @@ -108,7 +108,7 @@ The command removes all the Kubernetes components associated with the chart and ## Configuration | Parameter | Description | Default | -| :--------------------------------------------- | :---------------------------------------------------------------------------------------------------------------------------------------- | :----------------------------------------------------------- | +| :--------------------------------------------- |:------------------------------------------------------------------------------------------------------------------------------------------| :----------------------------------------------------------- | | `image.repository` | The image repository to pull from | coredns/coredns | | `image.tag` | The image tag to pull from (derived from Chart.yaml) | `` | | `image.pullPolicy` | Image pull policy | IfNotPresent | @@ -126,6 +126,12 @@ The command removes all the Kubernetes components associated with the chart and | `prometheus.monitor.additionalLabels` | Additional labels that can be used so ServiceMonitor will be discovered by Prometheus | {} | | `prometheus.monitor.namespace` | Selector to select which namespaces the Endpoints objects are discovered from. | `""` | | `prometheus.monitor.interval` | Scrape interval for polling the metrics endpoint. (E.g. "30s") | `""` | +| `prometheus.monitor.scrapeTimeout` | Timeout for each scrape request. (E.g. "10s") | `""` | +| `prometheus.monitor.scheme` | HTTP scheme used for scraping. (`http` or `https`) | `""` | +| `prometheus.monitor.honorLabels` | Honor labels from the target when scraping | `false` | +| `prometheus.monitor.tlsConfig` | TLS configuration for the metrics endpoint (e.g. `insecureSkipVerify`, certificates) | `{}` | +| `prometheus.monitor.relabelings` | List of target relabeling rules applied before scraping | `[]` | +| `prometheus.monitor.metricRelabelings` | List of metric relabeling rules applied after scraping | `[]` | | `prometheus.monitor.selector` | Service selector | `{}` | | `service.clusterIP` | IP address to assign to service | `""` | | `service.clusterIPs` | IP addresses to assign to service | `[]` | @@ -140,6 +146,7 @@ The command removes all the Kubernetes components associated with the chart and | `serviceAccount.name` | If not set & create is true, use template fullname | | | `rbac.create` | If true, create & use RBAC resources | true | | `rbac.pspEnable` | Specifies whether a PodSecurityPolicy should be created. | `false` | +| `rbac.multiclusterEnable` | Specifies whether the kubernetes plugin multicluster RBAC should be created. | `false` | | `isClusterService` | Specifies whether chart should be deployed as cluster-service or normal k8s app. | true | | `priorityClassName` | Name of Priority Class to assign pods | `""` | | `securityContext` | securityContext definition for pods | capabilities.add.NET_BIND_SERVICE | @@ -164,13 +171,15 @@ The command removes all the Kubernetes components associated with the chart and | `extraVolumes` | Optional array of volumes to create | [] | | `extraVolumeMounts` | Optional array of volumes to mount inside the CoreDNS container | [] | | `extraSecrets` | Optional array of secrets to mount inside the CoreDNS container | [] | -| `env` | Optional array of environment variables for CoreDNS container | [] | +| `env` | Optional array of environment variables for CoreDNS container | [] | | `customLabels` | Optional labels for Deployment(s), Pod, Service, ServiceMonitor objects | {} | | `customAnnotations` | Optional annotations for Deployment(s), Pod, Service, ServiceMonitor objects | | `rollingUpdate.maxUnavailable` | Maximum number of unavailable replicas during rolling update | `1` | | `rollingUpdate.maxSurge` | Maximum number of pods created above desired number of pods | `25%` | | `podDisruptionBudget` | Optional PodDisruptionBudget | {} | | `podAnnotations` | Optional Pod only Annotations | {} | +| `podLabels` | Optional Pod only Labels | {} | +| `dnsConfig` | Optional Pod DNS configuration. When set, `dnsPolicy` is automatically set to `None` | {} | | `terminationGracePeriodSeconds` | Optional duration in seconds the pod needs to terminate gracefully. | 30 | | `hpa.enabled` | Enable Hpa autoscaler instead of proportional one | `false` | | `hpa.minReplicas` | Hpa minimum number of CoreDNS replicas | `1` | @@ -208,6 +217,8 @@ The command removes all the Kubernetes components associated with the chart and | `deployment.name` | Name of the deployment if `deployment.enabled` is true. Otherwise the name of an existing deployment for the autoscaler or HPA to target. | `""` | | `deployment.annotations` | Annotations to add to the main deployment | `{}` | | `deployment.selector` | Pod selector | `{}` | +| `deployment.dnsPolicy` | DNS policy for the pod (Default, ClusterFirst, ClusterFirstWithHostNet, None) | `"Default"` | +| `deployment.dnsConfig` | Custom DNS configuration (nameservers, searches, options). Required when dnsPolicy is "None" | `{}` | | `clusterRole.nameOverride` | ClusterRole name override | | See `values.yaml` for configuration notes. Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. For example, diff --git a/packages/system/coredns/charts/coredns/templates/clusterrole.yaml b/packages/system/coredns/charts/coredns/templates/clusterrole.yaml index ecdeafae4..63ba17fd0 100644 --- a/packages/system/coredns/charts/coredns/templates/clusterrole.yaml +++ b/packages/system/coredns/charts/coredns/templates/clusterrole.yaml @@ -4,6 +4,10 @@ kind: ClusterRole metadata: name: {{ template "coredns.clusterRoleName" . }} labels: {{- include "coredns.labels" . | nindent 4 }} +{{- with .Values.customAnnotations }} + annotations: +{{- toYaml . | nindent 4 }} +{{- end }} rules: - apiGroups: - "" @@ -33,4 +37,14 @@ rules: resourceNames: - {{ template "coredns.fullname" . }} {{- end }} +{{- if .Values.rbac.multiclusterEnable }} +- apiGroups: + - multicluster.x-k8s.io + resources: + - serviceexports + - serviceimports + verbs: + - list + - watch +{{- end }} {{- end }} diff --git a/packages/system/coredns/charts/coredns/templates/clusterrolebinding.yaml b/packages/system/coredns/charts/coredns/templates/clusterrolebinding.yaml index ebeaf1431..4537c9373 100644 --- a/packages/system/coredns/charts/coredns/templates/clusterrolebinding.yaml +++ b/packages/system/coredns/charts/coredns/templates/clusterrolebinding.yaml @@ -4,6 +4,10 @@ kind: ClusterRoleBinding metadata: name: {{ template "coredns.clusterRoleName" . }} labels: {{- include "coredns.labels" . | nindent 4 }} +{{- with .Values.customAnnotations }} + annotations: +{{- toYaml . | nindent 4 }} +{{- end }} roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole diff --git a/packages/system/coredns/charts/coredns/templates/deployment.yaml b/packages/system/coredns/charts/coredns/templates/deployment.yaml index a0119aa31..62d9c7681 100644 --- a/packages/system/coredns/charts/coredns/templates/deployment.yaml +++ b/packages/system/coredns/charts/coredns/templates/deployment.yaml @@ -49,6 +49,9 @@ spec: app.kubernetes.io/instance: {{ .Release.Name | quote }} {{- if .Values.customLabels }} {{ toYaml .Values.customLabels | indent 8 }} +{{- end }} +{{- if .Values.podLabels }} +{{ toYaml .Values.podLabels | indent 8 }} {{- end }} annotations: checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }} @@ -66,15 +69,25 @@ spec: terminationGracePeriodSeconds: {{ .Values.terminationGracePeriodSeconds }} {{- end }} serviceAccountName: {{ template "coredns.serviceAccountName" . }} + {{- if eq .Values.automountServiceAccountToken false }} + automountServiceAccountToken: false + {{- end }} {{- if .Values.priorityClassName }} priorityClassName: {{ .Values.priorityClassName | quote }} {{- end }} {{- if .Values.isClusterService }} - dnsPolicy: Default + dnsPolicy: {{ .Values.deployment.dnsPolicy }} + {{- end }} + {{- if and (eq .Values.deployment.dnsPolicy "None") (not .Values.deployment.dnsConfig) }} + {{- fail "dnsConfig is required when dnsPolicy is set to None" }} + {{- end }} + {{- with .Values.deployment.dnsConfig }} + dnsConfig: + {{- toYaml . | nindent 8 }} {{- end }} {{- if .Values.affinity }} affinity: -{{ toYaml .Values.affinity | indent 8 }} +{{ tpl (toYaml .Values.affinity) $ | indent 8 }} {{- end }} {{- if .Values.topologySpreadConstraints }} topologySpreadConstraints: diff --git a/packages/system/coredns/charts/coredns/templates/servicemonitor.yaml b/packages/system/coredns/charts/coredns/templates/servicemonitor.yaml index 53f8bdb5d..cf2eb3cfd 100644 --- a/packages/system/coredns/charts/coredns/templates/servicemonitor.yaml +++ b/packages/system/coredns/charts/coredns/templates/servicemonitor.yaml @@ -37,4 +37,25 @@ spec: {{- if .Values.prometheus.monitor.interval }} interval: {{ .Values.prometheus.monitor.interval }} {{- end }} + {{- if .Values.prometheus.monitor.scrapeTimeout }} + scrapeTimeout: {{ .Values.prometheus.monitor.scrapeTimeout }} + {{- end }} + {{- if .Values.prometheus.monitor.scheme }} + scheme: {{ .Values.prometheus.monitor.scheme }} + {{- end }} + {{- if .Values.prometheus.monitor.honorLabels }} + honorLabels: {{ .Values.prometheus.monitor.honorLabels }} + {{- end }} + {{- with .Values.prometheus.monitor.tlsConfig }} + tlsConfig: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.prometheus.monitor.relabelings }} + relabelings: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.prometheus.monitor.metricRelabelings }} + metricRelabelings: + {{- toYaml . | nindent 8 }} + {{- end }} {{- end }} diff --git a/packages/system/coredns/charts/coredns/values.yaml b/packages/system/coredns/charts/coredns/values.yaml index 9f05dbad6..2616b389f 100644 --- a/packages/system/coredns/charts/coredns/values.yaml +++ b/packages/system/coredns/charts/coredns/values.yaml @@ -34,6 +34,8 @@ terminationGracePeriodSeconds: 30 podAnnotations: {} # cluster-autoscaler.kubernetes.io/safe-to-evict: "false" +podLabels: {} + serviceType: "ClusterIP" prometheus: @@ -48,6 +50,12 @@ prometheus: additionalLabels: {} namespace: "" interval: "" + scrapeTimeout: "" + scheme: "" + honorLabels: false + tlsConfig: {} + relabelings: [] + metricRelabelings: [] selector: {} service: @@ -403,6 +411,23 @@ deployment: annotations: {} ## Pod selector selector: {} + # dnsPolicy determines how DNS resolution is handled for the pod. + # When isClusterService is true, this defaults to "Default" to avoid circular DNS resolution. + # Options: Default, ClusterFirst, ClusterFirstWithHostNet, None + # If set to "None", you must provide dnsConfig. + dnsPolicy: "Default" + # dnsConfig allows fine-grained DNS configuration for the pod. + # Only used when dnsPolicy is set to "None" or when custom DNS settings are needed. + # Example: + # dnsConfig: + # nameservers: + # - 8.8.8.8 + # searches: + # - my.dns.search.suffix + # options: + # - name: ndots + # value: "2" + dnsConfig: {} # Configures initcontainers for the coredns deployment. initContainers: []