From ed6f8df7841dfb3bb606a8e24558ade7f9a6bef6 Mon Sep 17 00:00:00 2001
From: Mohamed Omar Zaian <mohamedzaian@gmail.com>
Date: Thu, 13 Apr 2023 06:38:35 +0200
Subject: [PATCH] [feature] Update CoreDNS manifests (#9977)
---
.../templates/coredns-clusterrole.yml.j2 | 46 +++++++++----------
.../templates/coredns-deployment.yml.j2 | 4 +-
.../ansible/templates/coredns-sa.yml.j2 | 1 +
3 files changed, 27 insertions(+), 24 deletions(-)
diff --git a/roles/kubernetes-apps/ansible/templates/coredns-clusterrole.yml.j2 b/roles/kubernetes-apps/ansible/templates/coredns-clusterrole.yml.j2
index 79c4e775d..d5f91eddf 100644
--- a/roles/kubernetes-apps/ansible/templates/coredns-clusterrole.yml.j2
+++ b/roles/kubernetes-apps/ansible/templates/coredns-clusterrole.yml.j2
@@ -7,26 +7,26 @@ metadata:
addonmanager.kubernetes.io/mode: Reconcile
name: system:coredns
rules:
- - apiGroups:
- - ""
- resources:
- - endpoints
- - services
- - pods
- - namespaces
- verbs:
- - list
- - watch
- - apiGroups:
- - ""
- resources:
- - nodes
- verbs:
- - get
- - apiGroups:
- - discovery.k8s.io
- resources:
- - endpointslices
- verbs:
- - list
- - watch
+- apiGroups:
+ - ""
+ resources:
+ - endpoints
+ - services
+ - pods
+ - namespaces
+ verbs:
+ - list
+ - watch
+- apiGroups:
+ - ""
+ resources:
+ - nodes
+ verbs:
+ - get
+- apiGroups:
+ - discovery.k8s.io
+ resources:
+ - endpointslices
+ verbs:
+ - list
+ - watch
diff --git a/roles/kubernetes-apps/ansible/templates/coredns-deployment.yml.j2 b/roles/kubernetes-apps/ansible/templates/coredns-deployment.yml.j2
index fa8106935..316425bfd 100644
--- a/roles/kubernetes-apps/ansible/templates/coredns-deployment.yml.j2
+++ b/roles/kubernetes-apps/ansible/templates/coredns-deployment.yml.j2
@@ -22,9 +22,11 @@ spec:
labels:
k8s-app: kube-dns{{ coredns_ordinal_suffix }}
annotations:
- seccomp.security.alpha.kubernetes.io/pod: 'runtime/default'
createdby: 'kubespray'
spec:
+ securityContext:
+ seccompProfile:
+ type: RuntimeDefault
nodeSelector:
{{ coredns_deployment_nodeselector }}
priorityClassName: system-cluster-critical
diff --git a/roles/kubernetes-apps/ansible/templates/coredns-sa.yml.j2 b/roles/kubernetes-apps/ansible/templates/coredns-sa.yml.j2
index daebd6a8e..64d9c4dae 100644
--- a/roles/kubernetes-apps/ansible/templates/coredns-sa.yml.j2
+++ b/roles/kubernetes-apps/ansible/templates/coredns-sa.yml.j2
@@ -5,4 +5,5 @@ metadata:
name: coredns
namespace: kube-system
labels:
+ kubernetes.io/cluster-service: "true"
addonmanager.kubernetes.io/mode: Reconcile
--
GitLab