From cdce8c81da80c228753f737a2c2dd2af0535db82 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Andreas=20Kr=C3=BCger?= <andreas@kruger.nu>
Date: Thu, 11 Oct 2018 09:12:58 +0200
Subject: [PATCH] Update CoreDNS templates to newest version and fix
kubedns-autoscaler (#3483)
* Update CoreDNS templates to newest version
* Add watch to ClusterRole. Fixes #3460
---
.../ansible/templates/coredns-clusterrole.yml.j2 | 1 -
.../templates/coredns-clusterrolebinding.yml.j2 | 1 -
.../ansible/templates/coredns-config.yml.j2 | 5 +++--
.../ansible/templates/coredns-deployment.yml.j2 | 12 +++++++++---
.../ansible/templates/coredns-sa.yml.j2 | 3 ---
.../ansible/templates/coredns-svc.yml.j2 | 3 +--
.../templates/kubedns-autoscaler-clusterrole.yml.j2 | 2 +-
7 files changed, 14 insertions(+), 13 deletions(-)
diff --git a/roles/kubernetes-apps/ansible/templates/coredns-clusterrole.yml.j2 b/roles/kubernetes-apps/ansible/templates/coredns-clusterrole.yml.j2
index 4136d603e..812d95211 100644
--- a/roles/kubernetes-apps/ansible/templates/coredns-clusterrole.yml.j2
+++ b/roles/kubernetes-apps/ansible/templates/coredns-clusterrole.yml.j2
@@ -4,7 +4,6 @@ kind: ClusterRole
metadata:
labels:
kubernetes.io/bootstrapping: rbac-defaults
- addonmanager.kubernetes.io/mode: Reconcile
name: system:coredns
rules:
- apiGroups:
diff --git a/roles/kubernetes-apps/ansible/templates/coredns-clusterrolebinding.yml.j2 b/roles/kubernetes-apps/ansible/templates/coredns-clusterrolebinding.yml.j2
index 89becd5b4..bbda5ebc4 100644
--- a/roles/kubernetes-apps/ansible/templates/coredns-clusterrolebinding.yml.j2
+++ b/roles/kubernetes-apps/ansible/templates/coredns-clusterrolebinding.yml.j2
@@ -6,7 +6,6 @@ metadata:
rbac.authorization.kubernetes.io/autoupdate: "true"
labels:
kubernetes.io/bootstrapping: rbac-defaults
- addonmanager.kubernetes.io/mode: EnsureExists
name: system:coredns
roleRef:
apiGroup: rbac.authorization.k8s.io
diff --git a/roles/kubernetes-apps/ansible/templates/coredns-config.yml.j2 b/roles/kubernetes-apps/ansible/templates/coredns-config.yml.j2
index a89d3fc9e..928f82cdf 100644
--- a/roles/kubernetes-apps/ansible/templates/coredns-config.yml.j2
+++ b/roles/kubernetes-apps/ansible/templates/coredns-config.yml.j2
@@ -4,8 +4,6 @@ kind: ConfigMap
metadata:
name: coredns
namespace: kube-system
- labels:
- addonmanager.kubernetes.io/mode: EnsureExists
data:
Corefile: |
.:53 {
@@ -27,4 +25,7 @@ data:
proxy . /etc/resolv.conf
{% endif %}
cache 30
+ loop
+ reload
+ loadbalance
}
diff --git a/roles/kubernetes-apps/ansible/templates/coredns-deployment.yml.j2 b/roles/kubernetes-apps/ansible/templates/coredns-deployment.yml.j2
index 02442bcba..aef110238 100644
--- a/roles/kubernetes-apps/ansible/templates/coredns-deployment.yml.j2
+++ b/roles/kubernetes-apps/ansible/templates/coredns-deployment.yml.j2
@@ -6,9 +6,7 @@ metadata:
namespace: kube-system
labels:
k8s-app: coredns{{ coredns_ordinal_suffix | default('') }}
- kubernetes.io/cluster-service: "true"
- addonmanager.kubernetes.io/mode: Reconcile
- kubernetes.io/name: "CoreDNS"
+ kubernetes.io/name: "coredns{{ coredns_ordinal_suffix | default('') }}"
spec:
replicas: {{ coredns_replicas }}
strategy:
@@ -79,6 +77,14 @@ spec:
- containerPort: 9153
name: metrics
protocol: TCP
+ securityContext:
+ allowPrivilegeEscalation: false
+ capabilities:
+ add:
+ - NET_BIND_SERVICE
+ drop:
+ - all
+ readOnlyRootFilesystem: true
livenessProbe:
httpGet:
path: /health
diff --git a/roles/kubernetes-apps/ansible/templates/coredns-sa.yml.j2 b/roles/kubernetes-apps/ansible/templates/coredns-sa.yml.j2
index 64d9c4dae..8d2b47c46 100644
--- a/roles/kubernetes-apps/ansible/templates/coredns-sa.yml.j2
+++ b/roles/kubernetes-apps/ansible/templates/coredns-sa.yml.j2
@@ -4,6 +4,3 @@ kind: ServiceAccount
metadata:
name: coredns
namespace: kube-system
- labels:
- kubernetes.io/cluster-service: "true"
- addonmanager.kubernetes.io/mode: Reconcile
diff --git a/roles/kubernetes-apps/ansible/templates/coredns-svc.yml.j2 b/roles/kubernetes-apps/ansible/templates/coredns-svc.yml.j2
index 7f08d17ca..1eb3947ad 100644
--- a/roles/kubernetes-apps/ansible/templates/coredns-svc.yml.j2
+++ b/roles/kubernetes-apps/ansible/templates/coredns-svc.yml.j2
@@ -7,8 +7,7 @@ metadata:
labels:
k8s-app: coredns{{ coredns_ordinal_suffix | default('') }}
kubernetes.io/cluster-service: "true"
- addonmanager.kubernetes.io/mode: Reconcile
- kubernetes.io/name: "CoreDNS"
+ kubernetes.io/name: "coredns{{ coredns_ordinal_suffix | default('') }}"
annotations:
prometheus.io/path: /metrics
prometheus.io/port: "9153"
diff --git a/roles/kubernetes-apps/ansible/templates/kubedns-autoscaler-clusterrole.yml.j2 b/roles/kubernetes-apps/ansible/templates/kubedns-autoscaler-clusterrole.yml.j2
index e29ed4dac..dba3ff73d 100644
--- a/roles/kubernetes-apps/ansible/templates/kubedns-autoscaler-clusterrole.yml.j2
+++ b/roles/kubernetes-apps/ansible/templates/kubedns-autoscaler-clusterrole.yml.j2
@@ -21,7 +21,7 @@ metadata:
rules:
- apiGroups: [""]
resources: ["nodes"]
- verbs: ["list"]
+ verbs: ["list", "watch"]
- apiGroups: [""]
resources: ["replicationcontrollers/scale"]
verbs: ["get", "update"]
--
GitLab