Fix: fix tunnel dns setup (#961)

openyurtio · Aug 22, 2022 · 27514fc · 27514fc
1 parent 8896ea6
commit 27514fc
Showing 1 changed file with 54 additions and 0 deletions.
diff --git a/config/setup/yurt-tunnel-dns.yaml b/config/setup/yurt-tunnel-dns.yaml
@@ -1,4 +1,52 @@
 apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: yurt-tunnel-dns
+  namespace: kube-system
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  labels:
+    kubernetes.io/bootstrapping: rbac-defaults
+  name: system:yurt-tunnel-dns
+rules:
+  - apiGroups:
+    - ""
+    resources:
+    - endpoints
+    - services
+    - pods
+    - namespaces
+    verbs:
+    - list
+    - watch
+  - apiGroups:
+    - discovery.k8s.io
+    resources:
+    - endpointslices
+    verbs:
+    - list
+    - watch
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  annotations:
+    rbac.authorization.kubernetes.io/autoupdate: "true"
+  labels:
+    kubernetes.io/bootstrapping: rbac-defaults
+  name: system:yurt-tunnel-dns
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: system:yurt-tunnel-dns
+subjects:
+- kind: ServiceAccount
+  name: yurt-tunnel-dns
+  namespace: kube-system
+---
+apiVersion: v1
 kind: ConfigMap
 metadata:
   name: yurt-tunnel-dns
@@ -15,6 +63,11 @@ data:
             reload 300ms
             fallthrough
         }
+        kubernetes cluster.local in-addr.arpa ip6.arpa {
+           pods insecure
+           fallthrough in-addr.arpa ip6.arpa
+           ttl 30
+        }
         prometheus :9153
         forward . /etc/resolv.conf {
           max_concurrent 1000
@@ -55,6 +108,7 @@ spec:
       labels:
         k8s-app: yurt-tunnel-dns
     spec:
+      serviceAccountName: yurt-tunnel-dns
       priorityClassName: system-cluster-critical
       tolerations:
         - operator: "Exists"