---
# Strategic-merge patch capping the node-exporter pod's DNS at three
# upstream servers to silence Kubernetes' DNSConfigForming warning
# (DEV-527).
#
# The Hetzner OS publishes four systemd-resolved upstreams
# (2a01:4ff:ff00::add:2, 2a01:4ff:ff00::add:1, 185.12.64.1, 185.12.64.2),
# and kubelet drops the fourth because Kubernetes limits pod resolv.conf
# to three nameservers. On hostNetwork pods that inherit the node's
# resolv.conf, this fires a per-pod `DNSConfigForming` Warning event on
# every kubelet DNS refresh.
#
# We keep the same three servers kubelet would have picked (the two
# Hetzner IPv6 anycast entries plus the first IPv4 entry) so runtime
# behaviour is unchanged; only the noisy warning goes away. `dnsPolicy:
# None` is required for `dnsConfig` to be authoritative — otherwise
# kubelet still merges the node's resolv.conf on top and we would still
# exceed the three-nameserver limit.
#
# node-exporter is `hostNetwork: true` and does not talk to cluster DNS,
# so upstream-only resolution is correct.
#
# The kube-prometheus-stack chart is Helm-managed (release
# `kube-prometheus-stack` in `observability`) and is NOT currently
# tracked in ArgoCD, so a direct DaemonSet patch is the pragmatic
# wiring path. If the chart moves under GitOps, fold these values
# into the chart values as `prometheus-node-exporter.dnsPolicy` +
# `.dnsConfig` instead of maintaining this patch.
#
# Apply / re-apply with:
#   kubectl -n observability patch daemonset \
#     kube-prometheus-stack-prometheus-node-exporter \
#     --type=strategic \
#     --patch-file=apps/observability/patches/node-exporter-dns-config.yaml
spec:
  template:
    spec:
      dnsPolicy: None
      dnsConfig:
        nameservers:
          - 2a01:4ff:ff00::add:2
          - 2a01:4ff:ff00::add:1
          - 185.12.64.1
        searches:
          - .
        options:
          - name: edns0
          - name: trust-ad