---
apiVersion: apps/v1
items:
- apiVersion: apps/v1
  kind: DaemonSet
  metadata:
    annotations:
      deprecated.daemonset.template.generation: "1"
    creationTimestamp: "2022-03-08T10:39:51Z"
    generation: 1
    labels:
      dns.operator.openshift.io/owning-dns: default
    managedFields:
    - apiVersion: apps/v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            .: {}
            f:deprecated.daemonset.template.generation: {}
          f:labels:
            .: {}
            f:dns.operator.openshift.io/owning-dns: {}
          f:ownerReferences:
            .: {}
            k:{"uid":"7c55026f-b6f8-47dd-8bf6-cc19bce502d9"}:
              .: {}
              f:apiVersion: {}
              f:controller: {}
              f:kind: {}
              f:name: {}
              f:uid: {}
        f:spec:
          f:revisionHistoryLimit: {}
          f:selector:
            f:matchLabels:
              .: {}
              f:dns.operator.openshift.io/daemonset-dns: {}
          f:template:
            f:metadata:
              f:labels:
                .: {}
                f:dns.operator.openshift.io/daemonset-dns: {}
            f:spec:
              f:containers:
                k:{"name":"dns"}:
                  .: {}
                  f:args: {}
                  f:command: {}
                  f:image: {}
                  f:imagePullPolicy: {}
                  f:livenessProbe:
                    .: {}
                    f:failureThreshold: {}
                    f:httpGet:
                      .: {}
                      f:path: {}
                      f:port: {}
                      f:scheme: {}
                    f:initialDelaySeconds: {}
                    f:periodSeconds: {}
                    f:successThreshold: {}
                    f:timeoutSeconds: {}
                  f:name: {}
                  f:ports:
                    .: {}
                    k:{"containerPort":5353,"protocol":"TCP"}:
                      .: {}
                      f:containerPort: {}
                      f:name: {}
                      f:protocol: {}
                    k:{"containerPort":5353,"protocol":"UDP"}:
                      .: {}
                      f:containerPort: {}
                      f:name: {}
                      f:protocol: {}
                  f:readinessProbe:
                    .: {}
                    f:failureThreshold: {}
                    f:httpGet:
                      .: {}
                      f:path: {}
                      f:port: {}
                      f:scheme: {}
                    f:initialDelaySeconds: {}
                    f:periodSeconds: {}
                    f:successThreshold: {}
                    f:timeoutSeconds: {}
                  f:resources:
                    .: {}
                    f:limits:
                      .: {}
                      f:memory: {}
                    f:requests:
                      .: {}
                      f:cpu: {}
                      f:memory: {}
                  f:terminationMessagePath: {}
                  f:terminationMessagePolicy: {}
                  f:volumeMounts:
                    .: {}
                    k:{"mountPath":"/etc/coredns"}:
                      .: {}
                      f:mountPath: {}
                      f:name: {}
                      f:readOnly: {}
                k:{"name":"dns-node-resolver"}:
                  .: {}
                  f:command: {}
                  f:env:
                    .: {}
                    k:{"name":"CLUSTER_DOMAIN"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"NAMESERVER"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                    k:{"name":"SERVICES"}:
                      .: {}
                      f:name: {}
                      f:value: {}
                  f:image: {}
                  f:imagePullPolicy: {}
                  f:name: {}
                  f:resources:
                    .: {}
                    f:requests:
                      .: {}
                      f:cpu: {}
                  f:securityContext:
                    .: {}
                    f:privileged: {}
                  f:terminationMessagePath: {}
                  f:terminationMessagePolicy: {}
                  f:volumeMounts:
                    .: {}
                    k:{"mountPath":"/etc/hosts"}:
                      .: {}
                      f:mountPath: {}
                      f:name: {}
                k:{"name":"kube-rbac-proxy"}:
                  .: {}
                  f:args: {}
                  f:image: {}
                  f:imagePullPolicy: {}
                  f:name: {}
                  f:ports:
                    .: {}
                    k:{"containerPort":9154,"protocol":"TCP"}:
                      .: {}
                      f:containerPort: {}
                      f:name: {}
                      f:protocol: {}
                  f:resources:
                    .: {}
                    f:requests:
                      .: {}
                      f:cpu: {}
                      f:memory: {}
                  f:terminationMessagePath: {}
                  f:terminationMessagePolicy: {}
                  f:volumeMounts:
                    .: {}
                    k:{"mountPath":"/etc/tls/private"}:
                      .: {}
                      f:mountPath: {}
                      f:name: {}
                      f:readOnly: {}
              f:dnsPolicy: {}
              f:nodeSelector:
                .: {}
                f:kubernetes.io/os: {}
              f:priorityClassName: {}
              f:restartPolicy: {}
              f:schedulerName: {}
              f:securityContext: {}
              f:serviceAccount: {}
              f:serviceAccountName: {}
              f:terminationGracePeriodSeconds: {}
              f:tolerations: {}
              f:volumes:
                .: {}
                k:{"name":"config-volume"}:
                  .: {}
                  f:configMap:
                    .: {}
                    f:defaultMode: {}
                    f:items: {}
                    f:name: {}
                  f:name: {}
                k:{"name":"hosts-file"}:
                  .: {}
                  f:hostPath:
                    .: {}
                    f:path: {}
                    f:type: {}
                  f:name: {}
                k:{"name":"metrics-tls"}:
                  .: {}
                  f:name: {}
                  f:secret:
                    .: {}
                    f:defaultMode: {}
                    f:secretName: {}
          f:updateStrategy:
            f:rollingUpdate:
              .: {}
              f:maxUnavailable: {}
            f:type: {}
      manager: dns-operator
      operation: Update
      time: "2022-03-08T10:39:51Z"
    - apiVersion: apps/v1
      fieldsType: FieldsV1
      fieldsV1:
        f:status:
          f:currentNumberScheduled: {}
          f:desiredNumberScheduled: {}
          f:numberAvailable: {}
          f:numberReady: {}
          f:observedGeneration: {}
          f:updatedNumberScheduled: {}
      manager: kube-controller-manager
      operation: Update
      time: "2022-03-08T10:48:10Z"
    name: dns-default
    namespace: openshift-dns
    ownerReferences:
    - apiVersion: operator.openshift.io/v1
      controller: true
      kind: DNS
      name: default
      uid: 7c55026f-b6f8-47dd-8bf6-cc19bce502d9
    resourceVersion: "21483"
    selfLink: /apis/apps/v1/namespaces/openshift-dns/daemonsets/dns-default
    uid: 2fea6b62-0759-4ef8-9dd4-1d3812596a84
  spec:
    revisionHistoryLimit: 10
    selector:
      matchLabels:
        dns.operator.openshift.io/daemonset-dns: default
    template:
      metadata:
        creationTimestamp: null
        labels:
          dns.operator.openshift.io/daemonset-dns: default
      spec:
        containers:
        - args:
          - -conf
          - /etc/coredns/Corefile
          command:
          - coredns
          image: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:4bfcb018947b57966ce4bc55f9d96768ffc0127195ae207324f3f8cde8ee1ebf
          imagePullPolicy: IfNotPresent
          livenessProbe:
            failureThreshold: 5
            httpGet:
              path: /health
              port: 8080
              scheme: HTTP
            initialDelaySeconds: 60
            periodSeconds: 10
            successThreshold: 1
            timeoutSeconds: 5
          name: dns
          ports:
          - containerPort: 5353
            name: dns
            protocol: UDP
          - containerPort: 5353
            name: dns-tcp
            protocol: TCP
          readinessProbe:
            failureThreshold: 3
            httpGet:
              path: /ready
              port: 8181
              scheme: HTTP
            initialDelaySeconds: 10
            periodSeconds: 3
            successThreshold: 1
            timeoutSeconds: 3
          resources:
            limits:
              memory: 512Mi
            requests:
              cpu: 50m
              memory: 70Mi
          terminationMessagePath: /dev/termination-log
          terminationMessagePolicy: FallbackToLogsOnError
          volumeMounts:
          - mountPath: /etc/coredns
            name: config-volume
            readOnly: true
        - args:
          - --logtostderr
          - --secure-listen-address=:9154
          - --tls-cipher-suites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_RSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
          - --upstream=http://127.0.0.1:9153/
          - --tls-cert-file=/etc/tls/private/tls.crt
          - --tls-private-key-file=/etc/tls/private/tls.key
          image: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:533973e0b3b8e64b0fd672a78ebabc5accc5f9a969c6a610ce14aa73d9685874
          imagePullPolicy: IfNotPresent
          name: kube-rbac-proxy
          ports:
          - containerPort: 9154
            name: metrics
            protocol: TCP
          resources:
            requests:
              cpu: 10m
              memory: 40Mi
          terminationMessagePath: /dev/termination-log
          terminationMessagePolicy: File
          volumeMounts:
          - mountPath: /etc/tls/private
            name: metrics-tls
            readOnly: true
        - command:
          - /bin/bash
          - -c
          - |
            #!/bin/bash
            set -uo pipefail

            trap 'jobs -p | xargs kill || true; wait; exit 0' TERM

            OPENSHIFT_MARKER="openshift-generated-node-resolver"
            HOSTS_FILE="/etc/hosts"
            TEMP_FILE="/etc/hosts.tmp"

            IFS=', ' read -r -a services <<< "${SERVICES}"

            # Make a temporary file with the old hosts file's attributes.
            cp -f --attributes-only "${HOSTS_FILE}" "${TEMP_FILE}"

            while true; do
              declare -A svc_ips
              for svc in "${services[@]}"; do
                # Fetch service IP from cluster dns if present. We make several tries
                # to do it: IPv4, IPv6, IPv4 over TCP and IPv6 over TCP. The two last ones
                # are for deployments with Kuryr on older OpenStack (OSP13) - those do not
                # support UDP loadbalancers and require reaching DNS through TCP.
                cmds=('dig -t A @"${NAMESERVER}" +short "${svc}.${CLUSTER_DOMAIN}"|grep -v "^;"'
                      'dig -t AAAA @"${NAMESERVER}" +short "${svc}.${CLUSTER_DOMAIN}"|grep -v "^;"'
                      'dig -t A +tcp +retry=0 @"${NAMESERVER}" +short "${svc}.${CLUSTER_DOMAIN}"|grep -v "^;"'
                      'dig -t AAAA +tcp +retry=0 @"${NAMESERVER}" +short "${svc}.${CLUSTER_DOMAIN}"|grep -v "^;"')
                for i in ${!cmds[*]}
                do
                  ips=($(eval "${cmds[i]}"))
                  if [[ "$?" -eq 0 && "${#ips[@]}" -ne 0 ]]; then
                    svc_ips["${svc}"]="${ips[@]}"
                    break
                  fi
                done
              done

              # Update /etc/hosts only if we get valid service IPs
              # We will not update /etc/hosts when there is coredns service outage or api unavailability
              # Stale entries could exist in /etc/hosts if the service is deleted
              if [[ -n "${svc_ips[*]-}" ]]; then
                # Build a new hosts file from /etc/hosts with our custom entries filtered out
                grep -v "# ${OPENSHIFT_MARKER}" "${HOSTS_FILE}" > "${TEMP_FILE}"

                # Append resolver entries for services
                for svc in "${!svc_ips[@]}"; do
                  for ip in ${svc_ips[${svc}]}; do
                    echo "${ip} ${svc} ${svc}.${CLUSTER_DOMAIN} # ${OPENSHIFT_MARKER}" >> "${TEMP_FILE}"
                  done
                done

                # TODO: Update /etc/hosts atomically to avoid any inconsistent behavior
                # Replace /etc/hosts with our modified version if needed
                cmp "${TEMP_FILE}" "${HOSTS_FILE}" || cp -f "${TEMP_FILE}" "${HOSTS_FILE}"
                # TEMP_FILE is not removed to avoid file create/delete and attributes copy churn
              fi
              sleep 60 & wait
              unset svc_ips
            done
          env:
          - name: SERVICES
            value: image-registry.openshift-image-registry.svc
          - name: NAMESERVER
            value: 172.30.0.10
          - name: CLUSTER_DOMAIN
            value: cluster.local
          image: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:f95ac948edf7e12a3d46e88cbab8c7010ef9c3af6df2ff002af28ba76445247d
          imagePullPolicy: IfNotPresent
          name: dns-node-resolver
          resources:
            requests:
              cpu: 5m
          securityContext:
            privileged: true
          terminationMessagePath: /dev/termination-log
          terminationMessagePolicy: FallbackToLogsOnError
          volumeMounts:
          - mountPath: /etc/hosts
            name: hosts-file
        dnsPolicy: Default
        nodeSelector:
          kubernetes.io/os: linux
        priorityClassName: system-node-critical
        restartPolicy: Always
        schedulerName: default-scheduler
        securityContext: {}
        serviceAccount: dns
        serviceAccountName: dns
        terminationGracePeriodSeconds: 30
        tolerations:
        - operator: Exists
        volumes:
        - configMap:
            defaultMode: 420
            items:
            - key: Corefile
              path: Corefile
            name: dns-default
          name: config-volume
        - hostPath:
            path: /etc/hosts
            type: File
          name: hosts-file
        - name: metrics-tls
          secret:
            defaultMode: 420
            secretName: dns-default-metrics-tls
    updateStrategy:
      rollingUpdate:
        maxUnavailable: 10%
      type: RollingUpdate
  status:
    currentNumberScheduled: 6
    desiredNumberScheduled: 6
    numberAvailable: 6
    numberMisscheduled: 0
    numberReady: 6
    observedGeneration: 1
    updatedNumberScheduled: 6
kind: DaemonSetList
metadata:
  resourceVersion: "82672"
  selfLink: /apis/apps/v1/namespaces/openshift-dns/daemonsets
