apiVersion: v1
kind: ServiceAccount
metadata:
  name: socialweb-node-dns
  namespace: kube-system
  labels:
    app.kubernetes.io/name: socialweb-node-dns
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: socialweb-node-dns
  labels:
    app.kubernetes.io/name: socialweb-node-dns
rules:
  - apiGroups: [""]
    resources: ["endpoints", "services", "pods", "namespaces"]
    verbs: ["list", "watch"]
  - apiGroups: ["discovery.k8s.io"]
    resources: ["endpointslices"]
    verbs: ["list", "watch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: socialweb-node-dns
  labels:
    app.kubernetes.io/name: socialweb-node-dns
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: socialweb-node-dns
subjects:
  - kind: ServiceAccount
    name: socialweb-node-dns
    namespace: kube-system
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: socialweb-node-dns
  namespace: kube-system
  labels:
    app.kubernetes.io/name: socialweb-node-dns
data:
  Corefile: |
    .:53 {
        bind 169.254.20.10
        errors
        health 169.254.20.10:8080
        ready 169.254.20.10:8181
        kubernetes cluster.local in-addr.arpa ip6.arpa {
            pods insecure
            fallthrough in-addr.arpa ip6.arpa
            ttl 30
        }
        forward . /etc/resolv.conf
        cache 30
        loop
        reload
        loadbalance
    }
---
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: socialweb-node-dns
  namespace: kube-system
  labels:
    app.kubernetes.io/name: socialweb-node-dns
spec:
  selector:
    matchLabels:
      app.kubernetes.io/name: socialweb-node-dns
  updateStrategy:
    type: RollingUpdate
    rollingUpdate:
      maxUnavailable: 1
  template:
    metadata:
      labels:
        app.kubernetes.io/name: socialweb-node-dns
    spec:
      serviceAccountName: socialweb-node-dns
      priorityClassName: system-node-critical
      hostNetwork: true
      dnsPolicy: Default
      nodeSelector:
        socialweb.computer/node-local-dns: "true"
      tolerations:
        - operator: Exists
      containers:
        - name: coredns
          image: rancher/mirrored-coredns-coredns:1.14.6@sha256:1ba6f47265602e2e50a9c4669e3a955e4298a0d30dc82f39293d4bf1a851e0ff
          imagePullPolicy: IfNotPresent
          args: ["-conf", "/etc/coredns/Corefile"]
          resources:
            requests:
              cpu: 25m
              memory: 32Mi
            limits:
              memory: 170Mi
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            capabilities:
              add: ["NET_BIND_SERVICE"]
              drop: ["all"]
          livenessProbe:
            httpGet:
              host: 169.254.20.10
              path: /health
              port: 8080
            initialDelaySeconds: 10
            periodSeconds: 10
            failureThreshold: 3
          readinessProbe:
            httpGet:
              host: 169.254.20.10
              path: /ready
              port: 8181
            periodSeconds: 2
          volumeMounts:
            - name: config
              mountPath: /etc/coredns
              readOnly: true
      volumes:
        - name: config
          configMap:
            name: socialweb-node-dns
            items:
              - key: Corefile
                path: Corefile