apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: coredns
  namespace: network-dns
  labels:
    app.kubernetes.io/name: coredns
    app.kubernetes.io/instance: network-dns
    app.kubernetes.io/component: authoritative-dns
spec:
  revisionHistoryLimit: 3
  selector:
    matchLabels:
      app.kubernetes.io/name: coredns
      app.kubernetes.io/instance: network-dns
  updateStrategy:
    type: RollingUpdate
    rollingUpdate:
      maxUnavailable: 0
      maxSurge: 1
  template:
    metadata:
      labels:
        app.kubernetes.io/name: coredns
        app.kubernetes.io/instance: network-dns
        app.kubernetes.io/component: authoritative-dns
    spec:
      serviceAccountName: coredns
      automountServiceAccountToken: false
      securityContext:
        runAsNonRoot: true
        runAsUser: 10001
        runAsGroup: 10001
        fsGroup: 10001
        seccompProfile:
          type: RuntimeDefault
      containers:
        - name: coredns
          image: rancher/mirrored-coredns-coredns:1.15.0@sha256:0a9d8c8ddf34347eb59aad9a8784f0710de88d6d112726d11d271f9bc6daca26
          imagePullPolicy: IfNotPresent
          args:
            - -conf
            - /etc/coredns/Corefile
          readinessProbe:
            tcpSocket:
              port: dot
            periodSeconds: 2
            timeoutSeconds: 1
            failureThreshold: 1
          lifecycle:
            preStop:
              sleep:
                seconds: 3
          ports:
            - name: dns-udp
              containerPort: 53
              protocol: UDP
            - name: dns-tcp
              containerPort: 53
              protocol: TCP
            - name: dot
              containerPort: 853
              protocol: TCP
            - name: metrics
              containerPort: 9153
              protocol: TCP
          resources:
            requests:
              cpu: 25m
              memory: 64Mi
            limits:
              memory: 256Mi
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            capabilities:
              drop:
                - ALL
              add:
                - NET_BIND_SERVICE
          volumeMounts:
            - name: corefile
              mountPath: /etc/coredns
              readOnly: true
            - name: zones
              mountPath: /zones
              readOnly: true
            - name: dot-tls
              mountPath: /tls
              readOnly: true
      volumes:
        - name: corefile
          configMap:
            name: network-dns-corefile
        - name: zones
          configMap:
            name: network-dns-zones
        - name: dot-tls
          secret:
            secretName: coredns-dot-tls