apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: dnsmasq-node
  namespace: kube-system
  labels:
    application: dnsmasq-node
spec:
  selector:
    matchLabels:
      application: dnsmasq-node
  updateStrategy:
    type: OnDelete
  template:
    metadata:
      labels:
        application: dnsmasq-node
    spec:
      affinity:
        nodeAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            nodeSelectorTerms:
            - matchExpressions:
              - key: cluster-dns
                operator: In
                values:
                - dnsmasq
      priorityClassName: system-node-critical
      serviceAccountName: system
      tolerations:
      - operator: Exists
        effect: NoSchedule
      - operator: Exists
        effect: NoExecute
      volumes:
      - name: kube-dns-config
        configMap:
          name: kube-dns
          optional: true
      containers:
      - name: dnsmasq
        image: registry.opensource.zalan.do/teapot/k8s-dns-dnsmasq-nanny-amd64:1.14.10
        securityContext:
          privileged: true
        livenessProbe:
          httpGet:
            path: /healthcheck/dnsmasq
            port: 9054
            scheme: HTTP
          initialDelaySeconds: 60
          timeoutSeconds: 5
          successThreshold: 1
          failureThreshold: 5
        args:
        - -v=2
        - -logtostderr
        - -configDir=/etc/k8s/dns/dnsmasq-nanny
        - -restartDnsmasq=true
        - --
        - -k
        - --cache-size=10000
        - --no-negcache
        - --server=/cluster.local/10.3.0.11#53
        - --server=/in-addr.arpa/10.3.0.11#53
        - --server=/ip6.arpa/10.3.0.11#53
        ports:
        - containerPort: 53
          name: dns
          protocol: UDP
        - containerPort: 53
          name: dns-tcp
          protocol: TCP
        # see: https://github.com/kubernetes/kubernetes/issues/29055 for details
        resources:
          requests:
            cpu: 100m
            memory: 25Mi
        volumeMounts:
        - name: kube-dns-config
          mountPath: /etc/k8s/dns/dnsmasq-nanny
      - name: sidecar
        image: registry.opensource.zalan.do/teapot/k8s-dns-sidecar-amd64:1.14.10
        securityContext:
          privileged: true
        livenessProbe:
          httpGet:
            path: /metrics
            port: 9054
            scheme: HTTP
          initialDelaySeconds: 60
          timeoutSeconds: 5
          successThreshold: 1
          failureThreshold: 5
        args:
        - --v=2
        - --logtostderr
        - --probe=dnsmasq,127.0.0.1:53,ec2.amazonaws.com,5,A
        - --prometheus-port=9054
        ports:
        - containerPort: 9054
          name: metrics
          protocol: TCP
        resources:
          requests:
            memory: 15Mi
      hostNetwork: true
      dnsPolicy: Default
      automountServiceAccountToken: false
