Skip to content

Autodelegate #48

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
azgabur wants to merge 7 commits into
base: main
Choose a base branch
from
Open

Autodelegate #48

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
6469936
Revert "Split CoreDNS service into separate TCP/UDP services"
azgabur Sep 23, 2025
96ef651
Coredns deamonset improvements
azgabur Sep 23, 2025
415e079
Add autodelegate script
azgabur Feb 9, 2026
932b296
Revert "Coredns deamonset improvements"
azgabur Apr 21, 2026
fbe9ed9
Revert "Add externalTrafficPolicy: Local"
azgabur Apr 21, 2026
0cc8a70
Move coredns to kuadrant-instances chart
azgabur Apr 22, 2026
1b34daf
Improvements to autodelegate
azgabur Apr 22, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,6 +36,7 @@ If you choose to install tools charts:
- Redis
- Dragonfly
- Valkey
- Coredns
Comment thread
azgabur marked this conversation as resolved.

# How to run

Expand Down
7 changes: 7 additions & 0 deletions charts/kuadrant-instances/templates/coredns/00-namespace.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,7 @@
{{ if .Values.coredns.enable }}
apiVersion: v1
kind: Namespace
metadata:
name: {{ .Values.coredns.namespace }}
spec: {}
{{ end }}
6 changes: 3 additions & 3 deletions ...-instances/templates/coredns/00-rbac.yaml → ...-instances/templates/coredns/00-rbac.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,9 +1,9 @@
{{ if .Values.tools.coredns.enable }}
{{ if .Values.coredns.enable }}
kind: ServiceAccount
apiVersion: v1
metadata:
name: coredns-service
namespace: {{ .Values.tools.namespace }}
namespace: {{ .Values.coredns.namespace }}
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
Expand Down Expand Up @@ -47,5 +47,5 @@ roleRef:
subjects:
- kind: ServiceAccount
name: coredns-service
namespace: {{ .Values.tools.namespace }}
namespace: {{ .Values.coredns.namespace }}
{{ end }}
20 changes: 11 additions & 9 deletions ...nces/templates/coredns/01-deployment.yaml → ...nces/templates/coredns/01-deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,12 +1,17 @@
{{ if .Values.tools.coredns.enable }}
{{ if .Values.coredns.enable }}
apiVersion: apps/v1
kind: DaemonSet
kind: Deployment
metadata:
name: coredns
namespace: {{ .Values.tools.namespace }}
namespace: {{ .Values.coredns.namespace }}
labels:
app: coredns
spec:
replicas: 1
strategy:
type: RollingUpdate
rollingUpdate:
maxUnavailable: 1
Comment thread
azgabur marked this conversation as resolved.
selector:
matchLabels:
app: coredns
Expand All @@ -19,7 +24,7 @@ spec:
serviceAccountName: coredns-service
containers:
- name: "coredns"
image: {{ .Values.tools.coredns.image }}
image: {{ .Values.coredns.image }}
imagePullPolicy: Always
env:
- name: WATCH_NAMESPACES
Expand All @@ -42,7 +47,7 @@ spec:
- containerPort: 5300
name: "tcp-53"
protocol: TCP
{{- if .Values.tools.coredns.metrics }}
{{- if .Values.coredns.metrics }}
- containerPort: 9153
name: "tcp-9153"
protocol: TCP
Expand Down Expand Up @@ -78,11 +83,8 @@ spec:
volumes:
- name: config-volume
configMap:
name: coredns
name: corefile
items:
- key: Corefile
path: Corefile
tolerations:
- key: node-role.kubernetes.io/master
operator: Exists
{{ end }}
37 changes: 9 additions & 28 deletions ...stances/templates/coredns/03-service.yaml → ...stances/templates/coredns/03-service.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,31 +1,9 @@
{{ if .Values.tools.coredns.enable }}
{{ if .Values.coredns.enable }}
apiVersion: v1
kind: Service
metadata:
name: coredns-tcp
namespace: {{ .Values.tools.namespace }}
annotations:
service.beta.kubernetes.io/aws-load-balancer-type: "nlb"
labels:
app: coredns
spec:
selector:
app: coredns
ports:
- name: "tcp-53"
protocol: TCP
port: 53
targetPort: "tcp-53"
type: LoadBalancer
externalTrafficPolicy: Local
---
apiVersion: v1
kind: Service
metadata:
name: coredns-udp
namespace: {{ .Values.tools.namespace }}
annotations:
service.beta.kubernetes.io/aws-load-balancer-type: "nlb"
name: coredns
namespace: {{ .Values.coredns.namespace }}
labels:
app: coredns
spec:
Expand All @@ -36,15 +14,18 @@ spec:
protocol: UDP
port: 53
targetPort: "udp-53"
- name: "tcp-53"
protocol: TCP
port: 53
targetPort: "tcp-53"
type: LoadBalancer
externalTrafficPolicy: Local
---
{{ if .Values.tools.coredns.metrics }}
{{ if .Values.coredns.metrics }}
apiVersion: v1
kind: Service
metadata:
name: coredns-metrics
namespace: {{ .Values.tools.namespace }}
namespace: {{ .Values.coredns.namespace }}
labels:
app: coredns
component: metrics
Expand Down
26 changes: 12 additions & 14 deletions ...tances/templates/coredns/04-corefile.yaml → ...tances/templates/coredns/04-corefile.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,30 +1,24 @@
{{ if .Values.tools.coredns.enable }}
{{ if .Values.coredns.enable }}
apiVersion: v1
kind: ConfigMap
metadata:
name: coredns
namespace: {{ .Values.tools.namespace }}
name: corefile
namespace: {{ .Values.coredns.namespace }}
labels:
app: coredns
data:
Corefile: |-
kdrnt {
debug
errors
. {
health {
lameduck 5s
}
ready
log
transfer {
to *
}
kuadrant
prometheus 0.0.0.0:9153
}
{{ .Values.tools.coredns.zone }} {
{{- range .Values.coredns.zones }}
{{ . }} {
debug
errors
ready
log
geoip GeoLite2-City-demo.mmdb {
edns-subnet
Expand All @@ -33,7 +27,11 @@ data:
transfer {
to *
}
kuadrant
kuadrant {
rname kuadrant-qe-infra@redhat.com
}
prometheus 0.0.0.0:9153
}
{{ end }}

{{ end }}
6 changes: 3 additions & 3 deletions .../templates/coredns/05-serviceMonitor.yaml → .../templates/coredns/05-serviceMonitor.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,15 +1,15 @@
{{ if and .Values.tools.coredns.enable .Values.tools.coredns.metrics }}
{{ if and .Values.coredns.enable .Values.coredns.metrics }}
apiVersion: monitoring.coreos.com/v1
kind: ServiceMonitor
metadata:
name: coredns
namespace: {{ .Values.tools.namespace }}
namespace: {{ .Values.coredns.namespace }}
labels:
app: coredns
spec:
namespaceSelector:
matchNames:
- {{ .Values.tools.namespace }}
- {{ .Values.coredns.namespace }}
selector:
matchLabels:
app: coredns
Expand Down
6 changes: 3 additions & 3 deletions ...ates/coredns/06-remoteServiceAccount.yaml → ...ates/coredns/06-remoteServiceAccount.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,9 +1,9 @@
{{ if .Values.tools.coredns.enable }}
{{ if and .Values.coredns.enable .Values.tools.enabled }}
Comment thread
coderabbitai[bot] marked this conversation as resolved.
kind: ServiceAccount
apiVersion: v1
metadata:
name: coredns
namespace: {{ .Values.tools.namespace }}
namespace: {{ .Values.coredns.namespace }}
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
Expand Down Expand Up @@ -38,5 +38,5 @@ roleRef:
subjects:
- kind: ServiceAccount
name: coredns
namespace: {{ .Values.tools.namespace }}
namespace: {{ .Values.coredns.namespace }}
{{ end }}
43 changes: 43 additions & 0 deletions charts/kuadrant-instances/templates/coredns/autodelegate/00-rbac.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,43 @@
{{ if and .Values.coredns.enable .Values.coredns.autoDelegate }}
apiVersion: v1
kind: ServiceAccount
metadata:
name: post-install-autodelegate-sa
namespace: {{ .Values.coredns.namespace }}
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: post-install-autodelegate-role
namespace: {{ .Values.coredns.namespace }}
rules:
- apiGroups:
- ""
resources:
- services
verbs:
- get
- list
- watch
- apiGroups:
- ""
resources:
- secrets
verbs:
- get
- create
Comment on lines +22 to +28

@coderabbitai coderabbitai Bot Apr 22, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Verify no kubectl secret operations in the autodelegate scripts
rg -nP --type=yaml -C2 '\bsecret(s)?\b' charts/kuadrant-instances/templates/coredns/autodelegate/01-configMap-script.yaml
rg -nP -C2 'kubectl\s+(get|create|apply).*secret' charts/kuadrant-instances/templates/coredns/autodelegate/

Repository: Kuadrant/helm-charts-olm

Length of output: 1805

🏁 Script executed:

#!/bin/bash
# Attempt to locate and examine the coredns autodelegate scripts
find . -path "*/charts/kuadrant-instances/templates/coredns/autodelegate/*" -type f 2>/dev/null | head -20

Repository: Kuadrant/helm-charts-olm

Length of output: 468

🏁 Script executed:

#!/bin/bash
# Read the ConfigMap script file to see what the create.sh and delete.sh do
cat -n ./charts/kuadrant-instances/templates/coredns/autodelegate/01-configMap-script.yaml

Repository: Kuadrant/helm-charts-olm

Length of output: 6796

🏁 Script executed:

#!/bin/bash
# Check the job definitions to see how they access credentials
cat -n ./charts/kuadrant-instances/templates/coredns/autodelegate/02-create-job.yaml
echo "---"
cat -n ./charts/kuadrant-instances/templates/coredns/autodelegate/04-delete-job.yaml

Repository: Kuadrant/helm-charts-olm

Length of output: 2264

🏁 Script executed:

#!/bin/bash
# Check the secret definition and full RBAC
cat -n ./charts/kuadrant-instances/templates/coredns/autodelegate/05-coredns-config-secret.yaml
echo "---"
cat -n ./charts/kuadrant-instances/templates/coredns/autodelegate/00-rbac.yaml

Repository: Kuadrant/helm-charts-olm

Length of output: 1773

🏁 Script executed:

#!/bin/bash
# Search for where coredns-autodelegate secret is created
rg -r 'coredns-autodelegate' --type=yaml ./charts/kuadrant-instances/templates/coredns/
echo "---"
# Also check if there's any kubectl secret operation in the entire autodelegate directory
rg -i 'kubectl.*secret|secret.*kubectl' --type=yaml ./charts/kuadrant-instances/templates/coredns/autodelegate/

Repository: Kuadrant/helm-charts-olm

Length of output: 71

🏁 Script executed:

#!/bin/bash
# Broader search for coredns-autodelegate in the entire repository
rg 'coredns-autodelegate' ./charts/ --type=yaml
echo "---"
# Also check if any secret creation happens in shell scripts
rg -i 'kubectl.*create.*secret|kubectl.*apply.*secret' ./charts/kuadrant-instances/templates/coredns/ --type=yaml

Repository: Kuadrant/helm-charts-olm

Length of output: 313

🏁 Script executed:

#!/bin/bash
# Check if coredns-autodelegate secret is created by any Job or external process
rg 'coredns-autodelegate' ./charts/ --type=yaml -B5 -A5
echo "---"
# Also check if there are any other references or comments about secret creation
rg -i 'secret.*create|create.*secret' ./charts/kuadrant-instances/templates/coredns/autodelegate/ --type=yaml

Repository: Kuadrant/helm-charts-olm

Length of output: 2478

Remove unused secrets: [get, create] RBAC rule.

The create.sh and delete.sh scripts perform no kubectl secret operations—they only use kubectl get and kubectl wait on services. AWS credentials are injected via envFrom referencing the coredns-autodelegate secret, which is provided externally, not created by the Job. The secrets rule therefore violates the principle of least privilege and should be removed.

🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In `@charts/kuadrant-instances/templates/coredns/autodelegate/00-rbac.yaml` around
lines 22 - 28, Remove the unused RBAC permission for Kubernetes secrets by
deleting the resources: - secrets block (and its verbs: - get / - create) from
the Role/ClusterRole in the coredns autodelegate RBAC manifest; specifically
remove the rule that lists apiGroups: [""] with resources: ["secrets"] and verbs
including "get" and "create" so the Role/ClusterRole only grants the remaining
necessary permissions (e.g., service-related verbs), preserving YAML structure
and indentation for the surrounding rules.

---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: post-install-autodelegate-rb
namespace: {{ .Values.coredns.namespace }}
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: post-install-autodelegate-role
subjects:
- kind: ServiceAccount
name: post-install-autodelegate-sa
namespace: {{ .Values.coredns.namespace }}
{{ end }}
Loading
Loading