From dd2c56bcaf616ba11fc0ae8a76bb2057e7b407c2 Mon Sep 17 00:00:00 2001 From: drfaust92 Date: Sun, 19 Jul 2026 21:31:39 -0400 Subject: [PATCH 1/2] feat(helm): support dnsConfig on the forwarder deployment The runner Deployment already supported a configurable dnsPolicy / dnsConfig, but the forwarder (kubewatch) did not and was stuck on the implicit ClusterFirst policy. Extract the runner's inline dnsConfig logic into a shared `robusta.dnsConfig` helper (including the "None requires config" guard and the ClusterFirst fallback) and use it from both the runner and the forwarder. Add a matching `kubewatch.dnsConfig` block to values.yaml. Defaults are unchanged: dnsConfig.enabled is false, so both deployments still render `dnsPolicy: ClusterFirst`. The runner's rendered output is byte-for-byte identical. Co-Authored-By: Claude Opus 4.8 (1M context) --- helm/robusta/templates/_helpers.tpl | 33 +++++++++++++++++++++++++++ helm/robusta/templates/forwarder.yaml | 1 + helm/robusta/templates/runner.yaml | 27 +--------------------- helm/robusta/values.yaml | 6 +++++ 4 files changed, 41 insertions(+), 26 deletions(-) diff --git a/helm/robusta/templates/_helpers.tpl b/helm/robusta/templates/_helpers.tpl index 95520fb38..12bae4e32 100644 --- a/helm/robusta/templates/_helpers.tpl +++ b/helm/robusta/templates/_helpers.tpl @@ -11,6 +11,39 @@ If release name contains chart name it will be used as a full name. {{- end }} {{- end }} +{{/* +Render dnsPolicy (+ optional dnsConfig) for a component. +Pass the component's dnsConfig dict as the context, e.g.: + {{- include "robusta.dnsConfig" .Values.runner.dnsConfig | nindent 6 }} +When disabled (or unset) it falls back to dnsPolicy: ClusterFirst. +*/}} +{{- define "robusta.dnsConfig" -}} +{{- if .enabled -}} +{{- $hasConfig := or .nameservers .searches .options -}} +{{- if and (eq .policy "None") (not $hasConfig) -}} +{{- fail "dnsConfig: when dnsPolicy is 'None', you must set at least one of nameservers, searches, or options" -}} +{{- end -}} +dnsPolicy: {{ .policy | quote }} +{{- if $hasConfig }} +dnsConfig: + {{- with .nameservers }} + nameservers: + {{- toYaml . | nindent 4 }} + {{- end }} + {{- with .searches }} + searches: + {{- toYaml . | nindent 4 }} + {{- end }} + {{- with .options }} + options: + {{- toYaml . | nindent 4 }} + {{- end }} +{{- end }} +{{- else -}} +dnsPolicy: ClusterFirst +{{- end -}} +{{- end -}} + {{ define "robusta.configfile" -}} playbook_repos: {{ toYaml .Values.playbookRepos | indent 2 }} diff --git a/helm/robusta/templates/forwarder.yaml b/helm/robusta/templates/forwarder.yaml index 99c7d577e..e4190806d 100644 --- a/helm/robusta/templates/forwarder.yaml +++ b/helm/robusta/templates/forwarder.yaml @@ -40,6 +40,7 @@ spec: securityContext: {{- toYaml . | nindent 8 }} {{- end }} + {{- include "robusta.dnsConfig" .Values.kubewatch.dnsConfig | nindent 6 }} containers: - name: kubewatch # this is a custom version of kubewatch built from https://github.com/aantn/kubewatch diff --git a/helm/robusta/templates/runner.yaml b/helm/robusta/templates/runner.yaml index f7d9bd177..7cf65d837 100644 --- a/helm/robusta/templates/runner.yaml +++ b/helm/robusta/templates/runner.yaml @@ -43,32 +43,7 @@ spec: securityContext: {{- toYaml . | nindent 8 }} {{- end }} - {{- if .Values.runner.dnsConfig.enabled }} - {{- $policy := .Values.runner.dnsConfig.policy }} - {{- $hasConfig := or .Values.runner.dnsConfig.nameservers .Values.runner.dnsConfig.searches .Values.runner.dnsConfig.options }} - - {{- if and (eq $policy "None") (not $hasConfig) }} - {{- fail "dnsConfig: when dnsPolicy is 'None', you must set at least one of nameservers, searches, or options" }} - {{- end }} - dnsPolicy: {{ $policy | quote }} - {{- if $hasConfig }} - dnsConfig: - {{- with .Values.runner.dnsConfig.nameservers }} - nameservers: - {{- toYaml . | nindent 10 }} - {{- end }} - {{- with .Values.runner.dnsConfig.searches }} - searches: - {{- toYaml . | nindent 10 }} - {{- end }} - {{- with .Values.runner.dnsConfig.options }} - options: - {{- toYaml . | nindent 10 }} - {{- end }} - {{- end }} - {{ else }} - dnsPolicy: ClusterFirst - {{- end }} + {{- include "robusta.dnsConfig" .Values.runner.dnsConfig | nindent 6 }} {{- if .Values.runner.hardenedFs }} initContainers: - name: setup-venv diff --git a/helm/robusta/values.yaml b/helm/robusta/values.yaml index 243c183c7..00f0f2c15 100644 --- a/helm/robusta/values.yaml +++ b/helm/robusta/values.yaml @@ -658,6 +658,12 @@ kubewatch: tolerations: [] annotations: {} nodeSelector: ~ + dnsConfig: + enabled: false + policy: ClusterFirst + nameservers: [] + searches: [] + options: [] # set to override global.imagePullSecrets for kubewatch; leave empty to inherit the global imagePullSecrets: [] config: From 04e30f00aa0aef910535dfe124041857f8167751 Mon Sep 17 00:00:00 2001 From: drfaust92 Date: Sun, 19 Jul 2026 22:46:03 -0400 Subject: [PATCH 2/2] fix(helm): harden dnsConfig helper per review Address CodeRabbit feedback on the dnsConfig helper: - When dnsPolicy is "None", Kubernetes requires at least one nameserver (searches/options alone are rejected by the API server). Tighten the guard to require .nameservers specifically instead of any config field. - Tolerate a null/missing dnsConfig object (`and . .enabled`) and default .policy to "ClusterFirst" when unset, so the template never panics or emits an empty `dnsPolicy: ""`. Co-Authored-By: Claude Opus 4.8 (1M context) --- helm/robusta/templates/_helpers.tpl | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/helm/robusta/templates/_helpers.tpl b/helm/robusta/templates/_helpers.tpl index 12bae4e32..ee0faf217 100644 --- a/helm/robusta/templates/_helpers.tpl +++ b/helm/robusta/templates/_helpers.tpl @@ -18,12 +18,13 @@ Pass the component's dnsConfig dict as the context, e.g.: When disabled (or unset) it falls back to dnsPolicy: ClusterFirst. */}} {{- define "robusta.dnsConfig" -}} -{{- if .enabled -}} +{{- if and . .enabled -}} +{{- $policy := default "ClusterFirst" .policy -}} {{- $hasConfig := or .nameservers .searches .options -}} -{{- if and (eq .policy "None") (not $hasConfig) -}} -{{- fail "dnsConfig: when dnsPolicy is 'None', you must set at least one of nameservers, searches, or options" -}} +{{- if and (eq $policy "None") (not .nameservers) -}} +{{- fail "dnsConfig: when dnsPolicy is 'None', you must provide at least one nameserver (Kubernetes requires it)" -}} {{- end -}} -dnsPolicy: {{ .policy | quote }} +dnsPolicy: {{ $policy | quote }} {{- if $hasConfig }} dnsConfig: {{- with .nameservers }}