49 lines
1.9 KiB
YAML
49 lines
1.9 KiB
YAML
|
---
|
||
|
|
# Strategic-merge patch capping the node-exporter pod's DNS at three
|
||
|
|
# upstream servers to silence Kubernetes' DNSConfigForming warning
|
||
|
|
# (DEV-527).
|
||
|
|
#
|
||
|
|
# The Hetzner OS publishes four systemd-resolved upstreams
|
||
|
|
# (2a01:4ff:ff00::add:2, 2a01:4ff:ff00::add:1, 185.12.64.1, 185.12.64.2),
|
||
|
|
# and kubelet drops the fourth because Kubernetes limits pod resolv.conf
|
||
|
|
# to three nameservers. On hostNetwork pods that inherit the node's
|
||
|
|
# resolv.conf, this fires a per-pod `DNSConfigForming` Warning event on
|
||
|
|
# every kubelet DNS refresh.
|
||
|
|
#
|
||
|
|
# We keep the same three servers kubelet would have picked (the two
|
||
|
|
# Hetzner IPv6 anycast entries plus the first IPv4 entry) so runtime
|
||
|
|
# behaviour is unchanged; only the noisy warning goes away. `dnsPolicy:
|
||
|
|
# None` is required for `dnsConfig` to be authoritative — otherwise
|
||
|
|
# kubelet still merges the node's resolv.conf on top and we would still
|
||
|
|
# exceed the three-nameserver limit.
|
||
|
|
#
|
||
|
|
# node-exporter is `hostNetwork: true` and does not talk to cluster DNS,
|
||
|
|
# so upstream-only resolution is correct.
|
||
|
|
#
|
||
|
|
# The kube-prometheus-stack chart is Helm-managed (release
|
||
|
|
# `kube-prometheus-stack` in `observability`) and is NOT currently
|
||
|
|
# tracked in ArgoCD, so a direct DaemonSet patch is the pragmatic
|
||
|
|
# wiring path. If the chart moves under GitOps, fold these values
|
||
|
|
# into the chart values as `prometheus-node-exporter.dnsPolicy` +
|
||
|
|
# `.dnsConfig` instead of maintaining this patch.
|
||
|
|
#
|
||
|
|
# Apply / re-apply with:
|
||
|
|
# kubectl -n observability patch daemonset \
|
||
|
|
# kube-prometheus-stack-prometheus-node-exporter \
|
||
|
|
# --type=strategic \
|
||
|
|
# --patch-file=apps/observability/patches/node-exporter-dns-config.yaml
|
||
|
|
spec:
|
||
|
|
template:
|
||
|
|
spec:
|
||
|
|
dnsPolicy: None
|
||
|
|
dnsConfig:
|
||
|
|
nameservers:
|
||
|
|
- 2a01:4ff:ff00::add:2
|
||
|
|
- 2a01:4ff:ff00::add:1
|
||
|
|
- 185.12.64.1
|
||
|
|
searches:
|
||
|
|
- .
|
||
|
|
options:
|
||
|
|
- name: edns0
|
||
|
|
- name: trust-ad
|