mirror of
https://github.com/cozystack/cozystack.git
synced 2026-11-09 22:13:18 +09:00
Aleksei Sviridkin
9f8e7f9d4a
Extends the cozystack-coredns wrapper with the standard CoreDNS `import /etc/coredns/custom/*.override` directive in the .:53 server block and renders an empty kube-system/coredns-custom ConfigMap as a chart-managed prerequisite, mounted into the CoreDNS Deployment at /etc/coredns/custom/ via extraVolumes / extraVolumeMounts. The ConfigMap carries helm.sh/resource-policy: keep so the chart-managed empty value cannot strip what later writers add into it. This exposes a stable extension point on the cozystack CoreDNS for operators (or other cozystack components) that need to add plugin-only rewrite snippets without touching the chart-rendered Corefile — otherwise the chart would re-template data.Corefile on every Flux reconcile and overwrite the additions. The same package serves both host and tenant CoreDNS deployments, so this plumbing covers both layers without per-layer duplication. The volume mount is `optional: true` for defence-in-depth: a future chart upgrade that drops the templates/coredns-custom.yaml render still leaves CoreDNS healthy with no override snippets in play. helm-unittest fixtures pin the ConfigMap shape (name, namespace, keep annotation, no data), the `import` directive in the rendered Corefile, the presence of the `reload` plugin (required for live ConfigMap updates), and the volume + volumeMount on the CoreDNS Deployment. Assisted-By: Claude <noreply@anthropic.com> Signed-off-by: Aleksei Sviridkin <f@lex.la>
69 lines
2.5 KiB
YAML
69 lines
2.5 KiB
YAML
coredns:
|
|
image:
|
|
repository: registry.k8s.io/coredns/coredns
|
|
tag: v1.12.4
|
|
replicaCount: 2
|
|
k8sAppLabelOverride: kube-dns
|
|
service:
|
|
name: kube-dns
|
|
serviceAccount:
|
|
create: true
|
|
name: kube-dns
|
|
# Mirrors the upstream chart's default .:53 server-block plus an `import`
|
|
# directive that picks up plugin-only snippets written to the
|
|
# coredns-custom ConfigMap. ouroboros's coredns-import mode targets that
|
|
# ConfigMap, so its rewrite directives flow into CoreDNS without ever
|
|
# touching this Corefile (no Flux-vs-controller flap).
|
|
servers:
|
|
- zones:
|
|
- zone: .
|
|
use_tcp: true
|
|
port: 53
|
|
plugins:
|
|
- name: errors
|
|
- name: health
|
|
configBlock: |-
|
|
lameduck 10s
|
|
- name: ready
|
|
- name: kubernetes
|
|
parameters: cluster.local in-addr.arpa ip6.arpa
|
|
configBlock: |-
|
|
pods insecure
|
|
fallthrough in-addr.arpa ip6.arpa
|
|
ttl 30
|
|
- name: prometheus
|
|
parameters: 0.0.0.0:9153
|
|
- name: forward
|
|
parameters: . /etc/resolv.conf
|
|
- name: cache
|
|
parameters: 30
|
|
- name: loop
|
|
- name: reload
|
|
- name: import
|
|
parameters: /etc/coredns/custom/*.override
|
|
- name: loadbalance
|
|
# ConfigMap mount so CoreDNS finds the snippet files imported above.
|
|
# The cozystack coredns chart owns creation of an empty coredns-custom
|
|
# ConfigMap (see templates/coredns-custom.yaml). The rendered manifest
|
|
# has no `data:` field at all — that is what makes ouroboros's runtime
|
|
# writes to the `ouroboros.override` data key survive each reconcile:
|
|
# Helm's three-way merge sees no template-side keys to strip, so the
|
|
# apiserver-side data is untouched. The `helm.sh/resource-policy: keep`
|
|
# annotation on the ConfigMap is not what protects the runtime writes
|
|
# against upgrade — it only delays deletion on `helm uninstall`. The
|
|
# invariant is pinned by `notExists: data` in
|
|
# tests/coredns_custom_test.yaml; if a future chart change adds even
|
|
# `data: {}` "to be explicit", the test fires before the regression
|
|
# ships. `optional: true` is defensive — if a future chart upgrade
|
|
# ever drops the templates/coredns-custom.yaml render, the CoreDNS
|
|
# Deployment still stays healthy with no override snippets in play.
|
|
extraVolumes:
|
|
- name: coredns-custom
|
|
configMap:
|
|
name: coredns-custom
|
|
optional: true
|
|
extraVolumeMounts:
|
|
- name: coredns-custom
|
|
mountPath: /etc/coredns/custom
|
|
readOnly: true
|