coredns.yaml

---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: istio-coredns-plugin
  namespace: istio-system
---
# Source: istio/charts/pilot/templates/clusterrole.yaml
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRole
metadata:
  name: istio-coredns-plugin
  namespace: istio-system
rules:
- apiGroups: ["networking.istio.io"]
  resources: ["*"]
  verbs: ["get", "watch", "list"]
---
# Source: istio/charts/pilot/templates/clusterrolebinding.yaml
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
  name: istio-coredns-plugin
  namespace: istio-system
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: istio-coredns-plugin
subjects:
  - kind: ServiceAccount
    name: istio-coredns-plugin
    namespace: istio-system
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: coredns
  namespace: istio-system
data:
  Corefile: |
    .:53 {
        errors
        health
        proxy global 127.0.0.1:8053 {
          protocol grpc insecure
        }
        prometheus :9153
        proxy . /etc/resolv.conf
        cache 30
        reload
    }
---
apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  name: coredns
  namespace: istio-system
spec:
  replicas: 1
  template:
    metadata:
      labels:
        app: coredns
    spec:
      serviceAccountName: istio-coredns-plugin
      containers:
      - name: coredns
        image: coredns/coredns:1.1.2
        imagePullPolicy: IfNotPresent
        args: [ "-conf", "/etc/coredns/Corefile" ]
        volumeMounts:
        - name: config-volume
          mountPath: /etc/coredns
        ports:
        - containerPort: 53
          name: dns
          protocol: UDP
        - containerPort: 53
          name: dns-tcp
          protocol: TCP
        - containerPort: 9153
          name: metrics
          protocol: TCP
        livenessProbe:
          httpGet:
            path: /health
            port: 8080
            scheme: HTTP
          initialDelaySeconds: 60
          timeoutSeconds: 5
          successThreshold: 1
          failureThreshold: 5
      - name: istio-coredns-plugin
        command:
        - /usr/local/bin/plugin
        image: rshriram/istio-coredns-plugin:latest
        imagePullPolicy: Always
        ports:
        - containerPort: 8053
          name: dns-grpc
          protocol: TCP
      dnsPolicy: Default
      volumes:
        - name: config-volume
          configMap:
            name: coredns
            items:
            - key: Corefile
              path: Corefile
---
apiVersion: v1
kind: Service
metadata:
  name: coredns
  namespace: istio-system
spec:
  selector:
    app: coredns
  ports:
  - name: dns
    port: 53
    protocol: UDP
  - name: dns-tcp
    port: 53
    protocol: TCP