unbound-pre.yaml

apiVersion: v1
automountServiceAccountToken: false
kind: ServiceAccount
metadata:
  name: unbound
  namespace: internet-egress
---
apiVersion: v1
data:
  unbound.conf: |
    server:
      do-daemonize: no
      interface: 0.0.0.0
      port: 1053
      interface-automatic: yes
      access-control: 10.64.0.0/12 allow
      chroot: ""
      username: ""
      directory: "/etc/unbound"
      logfile: ""
      use-syslog: no
      log-time-ascii: yes
      log-queries: yes
      log-replies: yes
      log-local-actions: yes
      log-servfail: yes
      num-threads: 4
      incoming-num-tcp: 2240
      outgoing-num-tcp: 1000
      num-queries-per-thread: 4096
      outgoing-range: 8192
      rrset-roundrobin: yes
      minimal-responses: yes
      extended-statistics: yes
      rrset-cache-size: 256m
      rrset-cache-slabs: 4
      msg-cache-size: 256m
      msg-cache-slabs: 4
      infra-cache-slabs: 4
      key-cache-slabs: 4
      so-rcvbuf: 4m
      pidfile: "/tmp/unbound.pid"
      infra-host-ttl: 60
      prefetch: yes
      root-hints: "/usr/local/unbound/etc/unbound/root.hints"
      trust-anchor-file: "/usr/local/unbound/etc/unbound/root.key"
    remote-control:
      control-enable: yes
      control-interface: 127.0.0.1
      control-use-cert: no
kind: ConfigMap
metadata:
  name: unbound
  namespace: internet-egress
---
apiVersion: v1
kind: Service
metadata:
  name: unbound
  namespace: internet-egress
spec:
  ports:
  - name: dns
    port: 53
    protocol: UDP
    targetPort: 1053
  - name: dns-tcp
    port: 53
    protocol: TCP
    targetPort: 1053
  selector:
    app.kubernetes.io/name: unbound
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: unbound
  namespace: internet-egress
spec:
  replicas: 2
  selector:
    matchLabels:
      app.kubernetes.io/name: unbound
  strategy:
    rollingUpdate:
      maxUnavailable: 1
    type: RollingUpdate
  template:
    metadata:
      labels:
        app.kubernetes.io/name: unbound
    spec:
      affinity:
        podAntiAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
          - podAffinityTerm:
              labelSelector:
                matchExpressions:
                - key: app.kubernetes.io/name
                  operator: In
                  values:
                  - unbound
              topologyKey: cke.cybozu.com/rack
            weight: 100
          requiredDuringSchedulingIgnoredDuringExecution:
          - labelSelector:
              matchExpressions:
              - key: app.kubernetes.io/name
                operator: In
                values:
                - unbound
            topologyKey: kubernetes.io/hostname
      containers:
      - args:
        - -c
        - /etc/unbound/unbound.conf
        image: ghcr.io/cybozu/unbound:1.20.0.2
        imagePullPolicy: IfNotPresent
        lifecycle:
          preStop:
            exec:
              command:
              - sleep
              - "5"
        livenessProbe:
          failureThreshold: 6
          initialDelaySeconds: 1
          periodSeconds: 1
          tcpSocket:
            port: 1053
        name: unbound
        ports:
        - containerPort: 1053
          name: dns
          protocol: UDP
        - containerPort: 1053
          name: dns-tcp
          protocol: TCP
        readinessProbe:
          periodSeconds: 1
          tcpSocket:
            port: 1053
        resources:
          limits:
            cpu: 250m
            memory: 1700Mi
          requests:
            cpu: 25m
            memory: 170Mi
        securityContext:
          readOnlyRootFilesystem: true
          runAsGroup: 10000
          runAsUser: 10000
        volumeMounts:
        - mountPath: /etc/unbound
          name: config-volume
          readOnly: true
        - mountPath: /tmp
          name: temporary-volume
      - args:
        - --unbound.ca=
        - --unbound.cert=
        image: ghcr.io/cybozu/unbound_exporter:0.4.6.2
        imagePullPolicy: IfNotPresent
        name: exporter
        ports:
        - containerPort: 9167
          name: metrics
        resources:
          requests:
            cpu: 100m
        securityContext:
          readOnlyRootFilesystem: true
          runAsGroup: 10000
          runAsUser: 10000
      serviceAccountName: unbound
      tolerations:
      - effect: NoSchedule
        key: node-role.kubernetes.io/master
      - effect: NoSchedule
        key: node-role.kubernetes.io/control-plane
      - key: CriticalAddonsOnly
        operator: Exists
      - effect: NoExecute
        key: node.cybozu.io/cluster-not-ready
        operator: Exists
      volumes:
      - configMap:
          items:
          - key: unbound.conf
            path: unbound.conf
          name: unbound
        name: config-volume
      - emptyDir: {}
        name: temporary-volume
---
apiVersion: policy/v1
kind: PodDisruptionBudget
metadata:
  name: unbound-pdb
  namespace: internet-egress
spec:
  maxUnavailable: 1
  selector:
    matchLabels:
      app.kubernetes.io/name: unbound