# Copyright 2016 The Kubernetes Authors.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.


apiVersion: apps/v1
kind: Deployment
metadata:
  name: kube-dns
  namespace: kube-system
  labels:
    k8s-app: kube-dns
    version: v20
    addonmanager.kubernetes.io/mode: Reconcile
spec:
  replicas: 1
  selector:
    matchLabels:
      k8s-app: kube-dns
  template:
    metadata:
      labels:
        k8s-app: kube-dns
      annotations:
        scheduler.alpha.kubernetes.io/critical-pod: ''
    spec:
      tolerations:
        - key: "CriticalAddonsOnly"
          operator: "Exists"
      volumes:
        - name: kube-dns-config
          configMap:
            name: kube-dns
            optional: true
      containers:
        - name: kubedns
          image: k8s.gcr.io/k8s-dns-kube-dns-amd64:1.14.5
          imagePullPolicy: IfNotPresent
          resources:
            # TODO: Set memory limits when we've profiled the container for large
            # clusters, then set request = limit to keep this container in
            # guaranteed class. Currently, this container falls into the
            # "burstable" category so the kubelet doesn't backoff from restarting it.
            limits:
              memory: 170Mi
            requests:
              cpu: 100m
              memory: 70Mi
          livenessProbe:
            httpGet:
              path: /healthcheck/kubedns
              port: 10054
              scheme: HTTP
            initialDelaySeconds: 60
            timeoutSeconds: 5
            successThreshold: 1
            failureThreshold: 5
          readinessProbe:
            httpGet:
              path: /readiness
              port: 8081
              scheme: HTTP
            # we poll on pod startup for the Kubernetes master service and
            # only setup the /readiness HTTP server once that's available.
            initialDelaySeconds: 3
            timeoutSeconds: 5
          args:
            - --domain=cluster.local.
            - --dns-port=10053
            - --config-map=kube-dns
            - --v=2
          env:
            - name: PROMETHEUS_PORT
              value: "10055"
          ports:
            - containerPort: 10053
              name: dns-local
              protocol: UDP
            - containerPort: 10053
              name: dns-tcp-local
              protocol: TCP
            - containerPort: 10055
              name: metrics
              protocol: TCP
          volumeMounts:
            - name: kube-dns-config
              mountPath: /kube-dns-config
        - name: dnsmasq
          image: k8s.gcr.io/k8s-dns-dnsmasq-nanny-amd64:1.14.5
          imagePullPolicy: IfNotPresent
          livenessProbe:
            httpGet:
              path: /healthcheck/dnsmasq
              port: 10054
              scheme: HTTP
            initialDelaySeconds: 60
            timeoutSeconds: 5
            successThreshold: 1
            failureThreshold: 5
          args:
            - -v=2
            - -logtostderr
            - -configDir=/etc/k8s/dns/dnsmasq-nanny
            - -restartDnsmasq=true
            - --
            - -k
            - --cache-size=1000
            - --log-facility=-
            - --server=/cluster.local/127.0.0.1#10053
            - --server=/in-addr.arpa/127.0.0.1#10053
            - --server=/ip6.arpa/127.0.0.1#10053
          ports:
            - containerPort: 53
              name: dns
              protocol: UDP
            - containerPort: 53
              name: dns-tcp
              protocol: TCP
          # see: https://github.com/kubernetes/kubernetes/issues/29055 for details
          resources:
            requests:
              cpu: 150m
              memory: 20Mi
          volumeMounts:
            - name: kube-dns-config
              mountPath: /etc/k8s/dns/dnsmasq-nanny
        - name: sidecar
          image: k8s.gcr.io/k8s-dns-sidecar-amd64:1.14.5
          imagePullPolicy: IfNotPresent
          livenessProbe:
            httpGet:
              path: /metrics
              port: 10054
              scheme: HTTP
            initialDelaySeconds: 60
            timeoutSeconds: 5
            successThreshold: 1
            failureThreshold: 5
          args:
            - --v=2
            - --logtostderr
            - --probe=kubedns,127.0.0.1:10053,kubernetes.default.svc.cluster.local.,5,A
            - --probe=dnsmasq,127.0.0.1:53,kubernetes.default.svc.cluster.local.,5,A
          ports:
            - containerPort: 10054
              name: metrics
              protocol: TCP
          resources:
            requests:
              memory: 20Mi
              cpu: 10m
      dnsPolicy: Default  # Don't use cluster DNS.