Set dnsPolicy to ClusterFirstWithHostNet when hostNetwork is true (#4843)

2026-02-01 17:48:12 -03:30 · 2019-06-05 12:17:56 +02:00
parent 045acc724b
commit 818aa7aeb1
27 changed files with 30 additions and 4 deletions
--- a/roles/network_plugin/calico/templates/calico-node.yml.j2
+++ b/roles/network_plugin/calico/templates/calico-node.yml.j2
@@ -29,6 +29,7 @@ spec:
      priorityClassName: system-node-critical
 {% endif %}
      hostNetwork: true
+      dnsPolicy: ClusterFirstWithHostNet
      serviceAccountName: calico-node
      tolerations:
        - effect: NoExecute
--- a/roles/network_plugin/calico/templates/calico-typha.yml.j2
+++ b/roles/network_plugin/calico/templates/calico-typha.yml.j2
@@ -51,6 +51,7 @@ spec:
      nodeSelector:
        beta.kubernetes.io/os: linux
      hostNetwork: true
+      dnsPolicy: ClusterFirstWithHostNet
      tolerations:
        # Mark the pod as a critical add-on for rescheduling.
        - key: CriticalAddonsOnly
--- a/roles/network_plugin/canal/templates/canal-node.yaml.j2
+++ b/roles/network_plugin/canal/templates/canal-node.yaml.j2
@@ -19,6 +19,7 @@ spec:
      priorityClassName: system-node-critical
 {% endif %}
      hostNetwork: true
+      dnsPolicy: ClusterFirstWithHostNet
      serviceAccountName: canal
      tolerations:
        - operator: Exists
--- a/roles/network_plugin/cilium/templates/cilium-ds.yml.j2
+++ b/roles/network_plugin/cilium/templates/cilium-ds.yml.j2
@@ -172,6 +172,7 @@ spec:
                - "NET_ADMIN"
            privileged: true
      hostNetwork: true
+      dnsPolicy: ClusterFirstWithHostNet
      volumes:
        # To keep state between restarts / upgrades
        - name: cilium-run
--- a/roles/network_plugin/contiv/templates/contiv-api-proxy.yml.j2
+++ b/roles/network_plugin/contiv/templates/contiv-api-proxy.yml.j2
@@ -22,6 +22,7 @@ spec:
      # The API proxy must run in the host network namespace so that
      # it isn't governed by policy that would prevent it from working.
      hostNetwork: true
+      dnsPolicy: ClusterFirstWithHostNet
      hostPID: true
      nodeSelector:
        node-role.kubernetes.io/master: ""
--- a/roles/network_plugin/contiv/templates/contiv-cleanup.yml.j2
+++ b/roles/network_plugin/contiv/templates/contiv-cleanup.yml.j2
@@ -19,6 +19,7 @@ spec:
      priorityClassName: system-node-critical
 {% endif %}
      hostNetwork: true
+      dnsPolicy: ClusterFirstWithHostNet
      hostPID: true
      tolerations:
        - operator: Exists
--- a/roles/network_plugin/contiv/templates/contiv-etcd-proxy.yml.j2
+++ b/roles/network_plugin/contiv/templates/contiv-etcd-proxy.yml.j2
@@ -19,6 +19,7 @@ spec:
      priorityClassName: system-node-critical
 {% endif %}
      hostNetwork: true
+      dnsPolicy: ClusterFirstWithHostNet
      hostPID: true
      affinity:
       nodeAffinity:
--- a/roles/network_plugin/contiv/templates/contiv-etcd.yml.j2
+++ b/roles/network_plugin/contiv/templates/contiv-etcd.yml.j2
@@ -19,6 +19,7 @@ spec:
      priorityClassName: system-node-critical
 {% endif %}
      hostNetwork: true
+      dnsPolicy: ClusterFirstWithHostNet
      hostPID: true
      nodeSelector:
        node-role.kubernetes.io/master: ""
--- a/roles/network_plugin/contiv/templates/contiv-netmaster.yml.j2
+++ b/roles/network_plugin/contiv/templates/contiv-netmaster.yml.j2
@@ -22,6 +22,7 @@ spec:
      # The netmaster must run in the host network namespace so that
      # it isn't governed by policy that would prevent it from working.
      hostNetwork: true
+      dnsPolicy: ClusterFirstWithHostNet
      hostPID: true
      nodeSelector:
        node-role.kubernetes.io/master: ""
--- a/roles/network_plugin/contiv/templates/contiv-netplugin.yml.j2
+++ b/roles/network_plugin/contiv/templates/contiv-netplugin.yml.j2
@@ -24,6 +24,7 @@ spec:
      priorityClassName: system-node-critical
 {% endif %}
      hostNetwork: true
+      dnsPolicy: ClusterFirstWithHostNet
      hostPID: true
      tolerations:
        - operator: Exists
--- a/roles/network_plugin/contiv/templates/contiv-ovs.yml.j2
+++ b/roles/network_plugin/contiv/templates/contiv-ovs.yml.j2
@@ -21,6 +21,7 @@ spec:
      priorityClassName: system-node-critical
 {% endif %}
      hostNetwork: true
+      dnsPolicy: ClusterFirstWithHostNet
      hostPID: true
      tolerations:
        - operator: Exists
--- a/roles/network_plugin/flannel/templates/cni-flannel.yml.j2
+++ b/roles/network_plugin/flannel/templates/cni-flannel.yml.j2
@@ -110,6 +110,7 @@ spec:
        - name: host-cni-bin
          mountPath: /host/opt/cni/bin/
      hostNetwork: true
+      dnsPolicy: ClusterFirstWithHostNet
      tolerations:
        - operator: Exists
        # Mark pod as critical for rescheduling (Will have no effect starting with kubernetes 1.12)
--- a/roles/network_plugin/kube-router/templates/kube-router.yml.j2
+++ b/roles/network_plugin/kube-router/templates/kube-router.yml.j2
@@ -152,6 +152,7 @@ spec:
        - name: kubeconfig
          mountPath: /var/lib/kube-router
      hostNetwork: true
+      dnsPolicy: ClusterFirstWithHostNet
 {% if kube_router_enable_dsr %}
      hostIPC: true
      hostPID: true
--- a/roles/network_plugin/multus/templates/multus-daemonset.yml.j2
+++ b/roles/network_plugin/multus/templates/multus-daemonset.yml.j2
@@ -15,6 +15,7 @@ spec:
        app: multus
    spec:
      hostNetwork: true
+      dnsPolicy: ClusterFirstWithHostNet
      nodeSelector:
        beta.kubernetes.io/arch: amd64
      tolerations:
--- a/roles/network_plugin/weave/templates/weave-net.yml.j2
+++ b/roles/network_plugin/weave/templates/weave-net.yml.j2
@@ -216,6 +216,7 @@ items:
                - name: xtables-lock
                  mountPath: /run/xtables.lock
          hostNetwork: true
+          dnsPolicy: ClusterFirstWithHostNet
          hostPID: true
          restartPolicy: Always
          securityContext: