feat(coredns): migrate docker-provider CoreDNS from Deployment to HelmRelease

k8s/providers/docker/infrastructure/controllers/coredns/helm-release.yaml

@@ -0,0 +1,109 @@
+# TODO(#14): CoreDNS Deployment -> HelmRelease. Docker-provider only — Talos's own
+# CoreDNS is disabled via talos-local/cluster/disable-coredns.yaml (cluster.coreDNS.disabled:
+# true) so this chart owns the whole stack (ServiceAccount + RBAC + Deployment + Service +
+# ConfigMap + PDB). `coreDNS.disabled` skips Talos's CoreDNS bootstrap entirely on a fresh
+# cluster (not just the Deployment) — verified against CodeRabbit's upstream research on
+# #62 — so serviceAccount.create/rbac.create must stay true; the chart owns its own identity
+# rather than assuming a preexisting Talos-created one. The Service is pinned to the kube-dns
+# name + Talos's default kube-dns ClusterIP (10.96.0.10, from the 10.96.0.0/12 service
+# subnet) so it adopts the address kubelet/kube-proxy already expect, instead of Talos's
+# bootstrapped kube-dns Service. The hetzner provider is untouched (stays on Talos-managed
+# CoreDNS + a Corefile patch).
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: coredns
+  namespace: kube-system
+  labels:
+    helm.toolkit.fluxcd.io/helm-test: enabled
+    helm.toolkit.fluxcd.io/remediation: enabled
+spec:
+  interval: 2m
+  timeout: 10m
+  install:
+    remediation:
+      retries: -1
+  upgrade:
+    remediation:
+      retries: -1
+      remediateLastFailure: true
+  chart:
+    spec:
+      chart: coredns
+      version: 1.46.0
+      sourceRef:
+        kind: HelmRepository
+        name: coredns
+  # https://github.com/coredns/helm/blob/master/charts/coredns/values.yaml
+  values:
+    replicaCount: 2
+    k8sAppLabelOverride: kube-dns
+    image:
+      repository: registry.k8s.io/coredns/coredns
+      tag: v1.14.3
+    serviceAccount:
+      create: true
+      name: coredns
+    rbac:
+      create: true
+    service:
+      name: kube-dns
+      clusterIP: 10.96.0.10
+    podDisruptionBudget:
+      minAvailable: 1
+    resources:
+      limits:
+        memory: 170Mi
+      requests:
+        cpu: 100m
+        memory: 70Mi
+    priorityClassName: system-cluster-critical
+    nodeSelector:
+      kubernetes.io/os: linux
+    tolerations:
+      - key: CriticalAddonsOnly
+        operator: Exists
+      - effect: NoSchedule
+        key: node-role.kubernetes.io/control-plane
+    affinity:
+      podAntiAffinity:
+        preferredDuringSchedulingIgnoredDuringExecution:
+          - podAffinityTerm:
+              labelSelector:
+                matchExpressions:
+                  - key: k8s-app
+                    operator: In
+                    values:
+                      - kube-dns
+              topologyKey: kubernetes.io/hostname
+            weight: 100
+    servers:
+      - zones:
+          - zone: .
+        port: 53
+        plugins:
+          - name: errors
+          - name: health
+            configBlock: |-
+              lameduck 5s
+          - name: ready
+          - name: kubernetes
+            parameters: cluster.local in-addr.arpa ip6.arpa
+            configBlock: |-
+              pods insecure
+              fallthrough in-addr.arpa ip6.arpa
+              ttl 30
+          - name: prometheus
+            parameters: :9153
+          - name: forward
+            parameters: . /etc/resolv.conf
+            configBlock: |-
+              max_concurrent 1000
+          - name: cache
+            parameters: 30
+            configBlock: |-
+              disable success cluster.local
+              disable denial cluster.local
+          - name: loop
+          - name: reload
+          - name: loadbalance

k8s/providers/docker/infrastructure/controllers/coredns/helm-repository.yaml

@@ -0,0 +1,7 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: coredns
+  namespace: kube-system
+spec:
+  url: https://coredns.github.io/helm

k8s/providers/docker/infrastructure/controllers/coredns/kustomization.yaml

@@ -1,6 +1,5 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-  - ../../../../../bases/infrastructure/controllers/coredns/
-  - deployment.yaml
-  - pod-disruption-budget.yaml
+  - helm-release.yaml
+  - helm-repository.yaml

talos-local/cluster/disable-coredns.yaml

@@ -0,0 +1,3 @@
+cluster:
+  coreDNS:
+    disabled: true