coredns

# Default values for coredns.

# This is a YAML-formatted file.

# Declare variables to be passed into your templates.

# EKS add-on compatibility settings, in the shape of AWS's own CoreDNS add-on.

# templates/_eks-addon-compat.tpl maps them onto this chart's settings, and they

# win when both are set. Unset, they render nothing.

# The whole Corefile; replaces the one built from servers and extraConfig.

corefile: ""

# enabled, minReplicas, maxReplicas, nodesPerReplica, and cpuCoresPerReplica

# set autoscaler.enabled, min, max, nodesPerReplica, and coresPerReplica.

autoScaling: {}

# Sets service.trafficDistribution.

trafficDistribution: ""

# Disabled or Auto; sets the service.kubernetes.io/topology-mode annotation.

annotationTopologyMode: ""

# podDisruptionBudget also takes AWS's enabled key: false removes the PDB, and

# true alone creates one with maxUnavailable: 1 (see podDisruptionBudget below).

image:

repository: cgr.dev/chainguard-private/coredns-fips

# Overrides the image tag whose default is the chart appVersion.

tag: 1.15.0-r1@sha256:57bbf8bf574dbff315cccf6a0e2cc91c57c014cbfda174e07d6fb8e32c9b2b71

pullPolicy: IfNotPresent

## Optionally specify an array of imagePullSecrets.

## Secrets must be manually created in the namespace.

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/

##

pullSecrets: []

# pullSecrets:

# - name: myRegistryKeySecretName

replicaCount: 1

resources:

limits:

cpu: 100m

memory: 128Mi

requests:

cpu: 100m

memory: 128Mi

rollingUpdate:

maxUnavailable: 1

maxSurge: 25%

terminationGracePeriodSeconds: 30

podAnnotations: {}

# cluster-autoscaler.kubernetes.io/safe-to-evict: "false"

podLabels: {}

serviceType: "ClusterIP"

prometheus:

service:

enabled: false

annotations:

prometheus.io/scrape: "true"

prometheus.io/port: "9153"

selector: {}

monitor:

enabled: false

additionalLabels: {}

namespace: ""

interval: ""

scrapeTimeout: ""

scheme: ""

honorLabels: false

tlsConfig: {}

relabelings: []

metricRelabelings: []

selector: {}

service:

# clusterIP: ""

# clusterIPs: []

# loadBalancerIP: ""

# loadBalancerClass: ""

# externalIPs: []

# externalTrafficPolicy: ""

# ipFamilies: []

# ipFamilyPolicy: ""

# trafficDistribution: PreferClose

# The name of the Service

# If not set, a name is generated using the fullname template

name: "kube-dns"

annotations: {}

# Pod selector

selector: {}

serviceAccount:

# Create a ServiceAccount for CoreDNS. The ClusterRole (list/watch on pods,

# services, endpoints, endpointslices and namespaces) is bound to this

# account; with create: false and no name it is bound to the namespace's

# "default" ServiceAccount, and so granted to every pod that runs as it.

create: true

# The name of the ServiceAccount to use

# If not set and create is true, a name is generated using the fullname template

name: ""

annotations: {}

rbac:

# If true, create & use RBAC resources

create: true

clusterRole:

# By default a name is generated using the fullname template.

# Override here if desired:

nameOverride: ""

# isClusterService specifies whether chart should be deployed as cluster-service or normal k8s app.

isClusterService: true

# Optional priority class to be used for the coredns pods. Used for autoscaler if autoscaler.priorityClassName not set.

priorityClassName: ""

# Configure the pod level securityContext.

podSecurityContext: {}

# Configure SecurityContext for the CoreDNS container.

# The defaults satisfy the `restricted` Pod Security Standard, so the chart

# installs into a namespace that enforces it.

# Ensure that required linux capability to bind port number below 1024 is assigned (`CAP_NET_BIND_SERVICE`).

# The CoreDNS image runs as the distroless `nonroot` user (uid/gid 65532) since

# 1.11.0. The numeric ids are set here because images before 1.14.7 declare the

# user by name, which the kubelet cannot verify when `runAsNonRoot` is true.

securityContext:

allowPrivilegeEscalation: false

capabilities:

add:

- NET_BIND_SERVICE

drop:

- ALL

readOnlyRootFilesystem: true

runAsNonRoot: true

runAsUser: 65532

runAsGroup: 65532

seccompProfile:

type: RuntimeDefault

# Default zone is what Kubernetes recommends:

# https://kubernetes.io/docs/tasks/administer-cluster/dns-custom-nameservers/#coredns-configmap-options

servers:

- zones:

- zone: .

use_tcp: true

port: 53

# -- expose the service on a different port

# servicePort: 5353

# If serviceType is nodePort you can specify nodePort here

# nodePort: 30053

# hostPort: 53

plugins:

- name: errors

# Serves a /health endpoint on :8080, required for livenessProbe

- name: health

configBlock: |-

lameduck 10s

# Serves a /ready endpoint on :8181, required for readinessProbe

- name: ready

# Required to query kubernetes API for data

- name: kubernetes

parameters: cluster.local in-addr.arpa ip6.arpa

configBlock: |-

pods insecure

fallthrough in-addr.arpa ip6.arpa

ttl 30

# Serves a /metrics endpoint on :9153, required for serviceMonitor

- name: prometheus

parameters: 0.0.0.0:9153

- name: forward

parameters: . /etc/resolv.conf

- name: cache

parameters: 30

- name: loop

- name: reload

- name: loadbalance

# Complete example with all the options:

# - zones: # the `zones` block can be left out entirely, defaults to "."

# - zone: hello.world. # optional, defaults to "."

# scheme: tls:// # optional, defaults to "" (which equals "dns://" in CoreDNS)

# - zone: foo.bar.

# scheme: dns://

# use_tcp: true # set this parameter to optionally expose the port on tcp as well as udp for the DNS protocol

# # Note that this will not work if you are also exposing tls or grpc on the same server

# port: 12345 # optional, defaults to "" (which equals 53 in CoreDNS)

# plugins: # the plugins to use for this server block

# - name: kubernetes # name of plugin, if used multiple times ensure that the plugin supports it!

# parameters: foo bar # list of parameters after the plugin

# configBlock: |- # if the plugin supports extra block style config, supply it here

# hello world

# foo bar

# Extra configuration that is applied outside of the default zone block.

# Example to include additional config files, which may come from extraVolumes:

# extraConfig:

# import:

# parameters: /opt/coredns/*.conf

extraConfig: {}

# To use the livenessProbe, the health plugin needs to be enabled in CoreDNS' server config

livenessProbe:

enabled: true

initialDelaySeconds: 60

periodSeconds: 10

timeoutSeconds: 5

failureThreshold: 5

successThreshold: 1

# To use the readinessProbe, the ready plugin needs to be enabled in CoreDNS' server config

readinessProbe:

enabled: true

initialDelaySeconds: 30

periodSeconds: 5

timeoutSeconds: 5

failureThreshold: 1

successThreshold: 1

# expects input structure as per specification https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.11/#affinity-v1-core

# for example:

# affinity:

# nodeAffinity:

# requiredDuringSchedulingIgnoredDuringExecution:

# nodeSelectorTerms:

# - matchExpressions:

# - key: foo.bar.com/role

# operator: In

# values:

# - master

affinity: {}

# expects input structure as per specification https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.21/#topologyspreadconstraint-v1-core

# and supports Helm templating.

# For example:

# topologySpreadConstraints:

# - labelSelector:

# matchLabels:

# app.kubernetes.io/name: '{{ template "coredns.name" . }}'

# app.kubernetes.io/instance: '{{ .Release.Name }}'

# topologyKey: topology.kubernetes.io/zone

# maxSkew: 1

# whenUnsatisfiable: ScheduleAnyway

# - labelSelector:

# matchLabels:

# app.kubernetes.io/name: '{{ template "coredns.name" . }}'

# app.kubernetes.io/instance: '{{ .Release.Name }}'

# topologyKey: kubernetes.io/hostname

# maxSkew: 1

# whenUnsatisfiable: ScheduleAnyway

topologySpreadConstraints: []

# Node labels for pod assignment

# Ref: https://kubernetes.io/docs/user-guide/node-selection/

nodeSelector: {}

# expects input structure as per specification https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.11/#toleration-v1-core

# for example:

# tolerations:

# - key: foo.bar.com/role

# operator: Equal

# value: master

# effect: NoSchedule

tolerations: []

# https://kubernetes.io/docs/tasks/run-application/configure-pdb/#specifying-a-poddisruptionbudget

podDisruptionBudget: {}

# configure custom zone files as per https://coredns.io/2017/05/08/custom-dns-entries-for-kubernetes/

zoneFiles: []

# - filename: example.db

# domain: example.com

# contents: |

# example.com. IN SOA sns.dns.icann.com. noc.dns.icann.com. 2015082541 7200 3600 1209600 3600

# example.com. IN NS b.iana-servers.net.

# example.com. IN NS a.iana-servers.net.

# example.com. IN A 192.168.99.102

# *.example.com. IN A 192.168.99.102

# optional array of sidecar containers

extraContainers: []

# - name: some-container-name

# image: some-image:latest

# imagePullPolicy: Always

# optional array of extra volumes to create

extraVolumes: []

# - name: some-volume-name

# emptyDir: {}

# optional array of mount points for extraVolumes

extraVolumeMounts: []

# - name: some-volume-name

# mountPath: /etc/wherever

# optional array of secrets to mount inside coredns container

# possible usecase: need for secure connection with etcd backend

extraSecrets: []

# - name: etcd-client-certs

# mountPath: /etc/coredns/tls/etcd

# defaultMode: 420

# - name: some-fancy-secret

# mountPath: /etc/wherever

# defaultMode: 440

# optional array of environment variables for coredns container

# possible usecase: provides username and password for etcd user authentications

env: []

# - name: WHATEVER_ENV

# value: whatever

# - name: SOME_SECRET_ENV

# valueFrom:

# secretKeyRef:

# name: some-secret-name

# key: secret-key

# To support legacy deployments using CoreDNS with the "k8s-app: kube-dns" label selectors.

# See https://github.com/coredns/helm/blob/master/charts/coredns/README.md#adopting-existing-coredns-resources

# k8sAppLabelOverride: "kube-dns"

# Custom labels to apply to Deployment, Pod, Configmap, Service, ServiceMonitor.

# Also applied to the autoscaler when autoscaler.inheritCustomLabels is true.

customLabels: {}

# Custom annotations to apply to Deployment, Pod, Configmap, Service, ServiceMonitor. Including autoscaler if enabled.

customAnnotations: {}

## Alternative configuration for HPA deployment if wanted

## Create HorizontalPodAutoscaler object.

##

# hpa:

# enabled: false

# minReplicas: 1

# maxReplicas: 10

# metrics:

# metrics:

# - type: Resource

# resource:

# name: memory

# target:

# type: Utilization

# averageUtilization: 60

# - type: Resource

# resource:

# name: cpu

# target:

# type: Utilization

# averageUtilization: 60

hpa:

enabled: false

minReplicas: 1

maxReplicas: 2

metrics: []

## Configue a cluster-proportional-autoscaler for coredns

# See https://github.com/kubernetes-incubator/cluster-proportional-autoscaler

autoscaler:

# Enabled the cluster-proportional-autoscaler

enabled: false

# Number of autoscaler pods. null omits replicas (Kubernetes defaults to one).

# Multiple replicas run independent scaling loops without leader election.

replicaCount: null

# Optional PodDisruptionBudget for autoscaler pods, e.g. {maxUnavailable: 1}.

# Use multiple replicas to retain availability during voluntary disruptions.

podDisruptionBudget: {}

# Number of cores in the cluster per coredns replica

coresPerReplica: 256

# Number of nodes in the cluster per coredns replica

nodesPerReplica: 16

# Min size of replicaCount

min: 0

# Max size of replicaCount (default of 0 is no max)

max: 0

# Whether to include unschedulable nodes in the nodes/cores calculations - this requires version 1.8.0+ of the autoscaler

includeUnschedulableNodes: false

# If true does not allow single points of failure to form

preventSinglePointFailure: true

# Annotations for the coredns proportional autoscaler pods

podAnnotations: {}

# When true, top-level customLabels are also applied to the autoscaler Deployment/pods.

inheritCustomLabels: true

# Extra labels for the autoscaler Deployment and pods. Independent of customLabels

# when inheritCustomLabels is false.

customLabels: {}

# Extra labels applied only to autoscaler pods.

podLabels: {}

# Optional pod selector override for the autoscaler Deployment.

# If set, pod template labels must match this selector.

selector: {}

podSecurityContext: {}

securityContext:

allowPrivilegeEscalation: false

readOnlyRootFilesystem: true

privileged: false

## Optionally specify some extra flags to pass to cluster-proprtional-autoscaler.

## Useful for e.g. the nodelabels flag.

# customFlags:

# - --nodelabels=topology.kubernetes.io/zone=us-east-1a

image:

repository: cgr.dev/chainguard-private/cluster-proportional-autoscaler-fips

tag: 1.11.0-r7@sha256:d7b7e39d655bf9a583885eb668c9034b54e043340d805c40185f18c96a02bbfa

pullPolicy: IfNotPresent

## Optionally specify an array of imagePullSecrets.

## Secrets must be manually created in the namespace.

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/

##

pullSecrets: []

# pullSecrets:

# - name: myRegistryKeySecretName

# Optional priority class to be used for the autoscaler pods. priorityClassName used if not set.

priorityClassName: ""

# expects input structure as per specification https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.11/#affinity-v1-core

affinity: {}

# Node labels for pod assignment

# Ref: https://kubernetes.io/docs/user-guide/node-selection/

nodeSelector: {}

# expects input structure as per specification https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.11/#toleration-v1-core

tolerations: []

# resources for autoscaler pod

resources:

requests:

cpu: "20m"

memory: "10Mi"

limits:

cpu: "20m"

memory: "10Mi"

# Options for autoscaler configmap

configmap:

## Annotations for the coredns-autoscaler configmap

# i.e. strategy.spinnaker.io/versioned: "false" to ensure configmap isn't renamed

annotations: {}

# Enables the livenessProbe for cluster-proportional-autoscaler - this requires version 1.8.0+ of the autoscaler

livenessProbe:

enabled: true

initialDelaySeconds: 10

periodSeconds: 5

timeoutSeconds: 5

failureThreshold: 3

successThreshold: 1

# optional array of sidecar containers

extraContainers: []

# - name: some-container-name

# image: some-image:latest

# imagePullPolicy: Always

deployment:

skipConfig: false

enabled: true

name: ""

## Annotations for the coredns deployment

annotations: {}

## Pod selector

selector: {}

# dnsPolicy determines how DNS resolution is handled for the pod.

# When isClusterService is true, this defaults to "Default" to avoid circular DNS resolution.

# Options: Default, ClusterFirst, ClusterFirstWithHostNet, None

# If set to "None", you must provide dnsConfig.

dnsPolicy: "Default"

# dnsConfig allows fine-grained DNS configuration for the pod.

# Only used when dnsPolicy is set to "None" or when custom DNS settings are needed.

# Example:

# dnsConfig:

# nameservers:

# - 8.8.8.8

# searches:

# - my.dns.search.suffix

# options:

# - name: ndots

# value: "2"

dnsConfig: {}

# Configures initcontainers for the coredns deployment.

initContainers: []