derived from kube-dns/kube-dns.yaml.base

parts/k8s/addons/kubernetesmasteraddons-kube-dns-deployment.yaml

@@ -1,22 +1,33 @@
+# Copyright 2016 The Kubernetes Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Should keep target in cluster/addons/dns-horizontal-autoscaler/dns-horizontal-autoscaler.yaml
+# in sync with this file.
+
 apiVersion: v1
-kind: ServiceAccount
+kind: Service
 metadata:
   name: kube-dns
   namespace: kube-system
-  labels:
-    kubernetes.io/cluster-service: "true"
-    addonmanager.kubernetes.io/mode: Reconcile
----
-apiVersion: v1
-kind: Service
-metadata:
   labels:
     k8s-app: kube-dns
     kubernetes.io/cluster-service: "true"
-    kubernetes.io/name: KubeDNS
-  name: kube-dns
-  namespace: kube-system
+    addonmanager.kubernetes.io/mode: Reconcile
+    kubernetes.io/name: "KubeDNS"
 spec:
+  selector:
+    k8s-app: kube-dns
   clusterIP: <kubeDNSServiceIP>
   ports:
   - name: dns
@@ -25,75 +36,101 @@ spec:
   - name: dns-tcp
     port: 53
     protocol: TCP
-  selector:
-    k8s-app: kube-dns
 ---
-apiVersion: apps/v1beta1
-kind: Deployment
+apiVersion: v1
+kind: ServiceAccount
 metadata:
+  name: kube-dns
+  namespace: kube-system
   labels:
     kubernetes.io/cluster-service: "true"
-    k8s-app: kube-dns
-    version: v20
-  name: kube-dns-v20
+    addonmanager.kubernetes.io/mode: Reconcile
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: kube-dns
+  namespace: kube-system
+  labels:
+    addonmanager.kubernetes.io/mode: EnsureExists
+---
+apiVersion: extensions/v1beta1
+kind: Deployment
+metadata:
+  name: kube-dns
   namespace: kube-system
+  labels:
+    k8s-app: kube-dns
+    kubernetes.io/cluster-service: "true"
+    addonmanager.kubernetes.io/mode: Reconcile
 spec:
-  replicas: 2
+  # replicas: not specified here:
+  # 1. In order to make Addon Manager do not reconcile this replicas parameter.
+  # 2. Default is 1.
+  # 3. Will be tuned in real time if DNS horizontal auto-scaling is turned on.
+  strategy:
+    rollingUpdate:
+      maxSurge: 10%
+      maxUnavailable: 0
   selector:
     matchLabels:
       k8s-app: kube-dns
-      version: v20
   template:
     metadata:
-      annotations:
-        scheduler.alpha.kubernetes.io/critical-pod: ""
-        prometheus.io/scrape: "true"
-        prometheus.io/port: "10055"
       labels:
         k8s-app: kube-dns
-        kubernetes.io/cluster-service: "true"
-        version: v20
+      annotations:
+        scheduler.alpha.kubernetes.io/critical-pod: ''
+        seccomp.security.alpha.kubernetes.io/pod: 'docker/default'
     spec:
-      affinity:
-        podAntiAffinity:
-          preferredDuringSchedulingIgnoredDuringExecution:
-          - weight: 100
-            podAffinityTerm:
-              labelSelector:
-                matchExpressions:
-                - key: k8s-app
-                  operator: In
-                  values:
-                  - kube-dns
-              topologyKey: kubernetes.io/hostname
+      priorityClassName: system-cluster-critical
       tolerations:
-      - key: CriticalAddonsOnly
-        operator: Exists
+      - key: "CriticalAddonsOnly"
+        operator: "Exists"
       volumes:
       - name: kube-dns-config
         configMap:
           name: kube-dns
           optional: true
       containers:
-      - args:
-        - "--domain=<kubernetesKubeletClusterDomain>."
-        - "--dns-port=10053"
-        - "--v=2"
-        - "--config-dir=/kube-dns-config"
-        env:
-        - name: PROMETHEUS_PORT
-          value: "10055"
+      - name: kubedns
         image: <kubernetesKubeDNSSpec>
+        resources:
+          # TODO: Set memory limits when we've profiled the container for large
+          # clusters, then set request = limit to keep this container in
+          # guaranteed class. Currently, this container falls into the
+          # "burstable" category so the kubelet doesn't backoff from restarting it.
+          limits:
+            memory: 170Mi
+          requests:
+            cpu: 100m
+            memory: 70Mi
         livenessProbe:
-          failureThreshold: 5
           httpGet:
-            path: "/healthcheck/kubedns"
+            path: /healthcheck/kubedns
             port: 10054
             scheme: HTTP
           initialDelaySeconds: 60
+          timeoutSeconds: 5
           successThreshold: 1
+          failureThreshold: 5
+        readinessProbe:
+          httpGet:
+            path: /readiness
+            port: 8081
+            scheme: HTTP
+          # we poll on pod startup for the Kubernetes master service and
+          # only setup the /readiness HTTP server once that's available.
+          initialDelaySeconds: 3
           timeoutSeconds: 5
-        name: kubedns
+        args:
+        - --domain=<kubernetesKubeletClusterDomain>.
+        - --dns-port=10053
+        - --config-dir=/kube-dns-config
+        - --v=2
+        env:
+        - name: PROMETHEUS_PORT
+          value: "10055"
         ports:
         - containerPort: 10053
           name: dns-local
@@ -104,76 +141,47 @@ spec:
         - containerPort: 10055
           name: metrics
           protocol: TCP
-        readinessProbe:
-          httpGet:
-            path: "/readiness"
-            port: 8081
-            scheme: HTTP
-          initialDelaySeconds: 30
-          timeoutSeconds: 5
-        resources:
-          limits:
-            memory: 170Mi
-          requests:
-            cpu: 100m
-            memory: 70Mi
         volumeMounts:
         - name: kube-dns-config
           mountPath: /kube-dns-config
-      - args:
-        - "-v=2"
-        - "-logtostderr"
-        - "-configDir=/kube-dns-config"
-        - "-restartDnsmasq=true"
-        - "--"
-        - "-k"
-        - "--cache-size=1000"
-        - "--no-resolv"
-        - "--server=127.0.0.1#10053"
-        - "--server=/in-addr.arpa/127.0.0.1#10053"
-        - "--server=/ip6.arpa/127.0.0.1#10053"
-        - "--log-facility=-"
+      - name: dnsmasq
         image: <kubernetesDNSMasqSpec>
-        name: dnsmasq
-        ports:
-        - containerPort: 53
-          name: dns
-          protocol: UDP
-        - containerPort: 53
-          name: dns-tcp
-          protocol: TCP
-        volumeMounts:
-        - mountPath: /kube-dns-config
-          name: kube-dns-config
-      - args:
-        - "-v=2"
-        - "-restartDnsmasq=true"
-        - "--cmd=nslookup kubernetes.default.svc.<kubernetesKubeletClusterDomain> 127.0.0.1 >/dev/null"
-        - "--url=/healthz-dnsmasq"
-        - "--cmd=nslookup kubernetes.default.svc.<kubernetesKubeletClusterDomain> 127.0.0.1:10053 >/dev/null"
-        - "--url=/healthz-kubedns"
-        - "--port=8080"
-        - "--quiet"
-        image: <kubernetesExecHealthzSpec>
         livenessProbe:
-          failureThreshold: 5
           httpGet:
-            path: "/healthcheck/dnsmasq"
+            path: /healthcheck/dnsmasq
             port: 10054
             scheme: HTTP
           initialDelaySeconds: 60
-          successThreshold: 1
           timeoutSeconds: 5
-        name: healthz
+          successThreshold: 1
+          failureThreshold: 5
+        args:
+        - -v=2
+        - -logtostderr
+        - -configDir=/etc/k8s/dns/dnsmasq-nanny
+        - -restartDnsmasq=true
+        - --
+        - -k
+        - --cache-size=1000
+        - --no-negcache
+        - --log-facility=-
+        - --server=/in-addr.arpa/127.0.0.1#10053
+        - --server=/ip6.arpa/127.0.0.1#10053
         ports:
-        - containerPort: 8080
+        - containerPort: 53
+          name: dns
+          protocol: UDP
+        - containerPort: 53
+          name: dns-tcp
           protocol: TCP
+        # see: https://github.com/kubernetes/kubernetes/issues/29055 for details
         resources:
-          limits:
-            memory: 50Mi
           requests:
-            cpu: 10m
-            memory: 50Mi
+            cpu: 150m
+            memory: 20Mi
+        volumeMounts:
+        - name: kube-dns-config
+          mountPath: /etc/k8s/dns/dnsmasq-nanny
       - name: sidecar
         image: k8s.gcr.io/k8s-dns-sidecar-amd64:1.14.10
         livenessProbe:
@@ -200,7 +208,5 @@ spec:
             cpu: 10m
       dnsPolicy: Default  # Don't use cluster DNS.
       serviceAccountName: kube-dns
-      dnsPolicy: Default
-      serviceAccountName: kube-dns
       nodeSelector:
-        beta.kubernetes.io/os: linux
+        beta.kubernetes.io/os: linux