Kubernetes manifest need rework about deployment

[johnbelamaric]

Thanks for your thorough review. You are right this is not really up-to-date, and we will get on that ASAP (PRs are welcome too!).

You may also be interested in kubernetes/kubernetes#52501 and kubernetes/minikube#1995.

@rajansandeep PTAL

[chrisohaver]

Thanks again for the review. Summarizing what we have fixed so far...

• Removed the pre 1.6 version, leaving only one manifest.
• Corrected the deprecated "cidrs" in the ConfigMap.
• Moved tolerations to spec element
• Added master NoSchedule taint toleration
• Use current release, not "latest".
• main repo README updated

not addressed yet:

• CoreDNS master affinity - kube-dns does not have master node affinity. Actually we may want to use antiAffinity to make sure replicas don't land all on one node.
• Exposed metrics port - kube-dns appears to also expose the metrics port in its default configuration... I found this issue kubernetes/kubernetes#52184 scroll to "7. Exposed /metrics APIs Allow for Pod/Svc Enumeration" ... the risk seems low enough to be an OK default. As they are now, CoreDNS metrics are aggregations (e.g. you cant enumerate services or pods based on them).
• RollingUpdate strategy - I think 2 replicas + maxUnavailable: 1 is a sensible minimal default. @johnbelamaric, what do you think?

[ae6rt]

Nice work.

I'd be somewhat sorry to see the non-RBAC manifests removed. Not every cluster uses RBAC yet, and if not, experimenting with CoreDNS with the RBAC manifest would be challenging.

[johnbelamaric]

@chrisohaver yes on the RollingUpdate strategy. Also update to 0.9.10 and get rid of the "CIDR needs to be on a /8 boundary" comment. What about kubernetes.io/cluster-service? Should we remove it here?

[chrisohaver]

For stability and security purposes ... CoreDNS should only run on master nodes ...

Most every thing here is in the deployment now, except for the above. In fact, we have recently merged a change that does the exact opposite of this, never allowing coredns to be scheduled on the master node. See discussion #50.