chore(coredns): keep Flux from pruning the Talos-owned Corefile (1/2) #1449

2026-10-26T08:55:24Z

claude-bot commented

2026-10-26 08:55:24 +00:00

Step 1 of 2 to hand the coredns ConfigMap back to Talos. Cluster DNS then no longer depends on Flux, and running state matches bootstrap.

Why

Two owners: the ConfigMap is a Talos bootstrap manifest (talos-bootstrap-manifests-inventory, CoreDNS not disabled in cluster.yaml), and Flux applies it too. talosctl upgrade-k8s reverts Flux's Corefile; its dry run on 2026-10-26 showed exactly that.
Bootstrap already uses Talos's Corefile: bootstrap.sh never applies the Flux one. CoreDNS forwards to the node resolver (forwardKubeDNSToHost), which asks k8s-gateway first (ResolverConfig, afe00963).
The Flux copy is redundant: k8s-gateway serves zone . with serve_stale 1h, so both Flux customisations (the renner.uno → k8s-gateway block and serve_stale) already happen upstream.

This PR: kustomize.toolkit.fluxcd.io/prune: disabled on the ConfigMap. No functional change.

Step 2 (after merge): remove configmap.yaml from infrastructure/coredns-config; the kube-dns-lb Service stays. The live Corefile stays as it is until the next talosctl upgrade-k8s writes Talos's version.

🤖 Generated with Claude Code

Step 1 of 2 to hand the `coredns` ConfigMap back to Talos. Cluster DNS then no longer depends on Flux, and running state matches bootstrap. **Why** - **Two owners:** the ConfigMap is a Talos bootstrap manifest (`talos-bootstrap-manifests-inventory`, CoreDNS not disabled in `cluster.yaml`), and Flux applies it too. `talosctl upgrade-k8s` reverts Flux's Corefile; its dry run on 2026-10-26 showed exactly that. - **Bootstrap already uses Talos's Corefile:** `bootstrap.sh` never applies the Flux one. CoreDNS forwards to the node resolver (`forwardKubeDNSToHost`), which asks k8s-gateway first (`ResolverConfig`, afe00963). - **The Flux copy is redundant:** k8s-gateway serves zone `.` with `serve_stale 1h`, so both Flux customisations (the `renner.uno` → k8s-gateway block and `serve_stale`) already happen upstream. **This PR:** `kustomize.toolkit.fluxcd.io/prune: disabled` on the ConfigMap. No functional change. **Step 2 (after merge):** remove `configmap.yaml` from `infrastructure/coredns-config`; the `kube-dns-lb` Service stays. The live Corefile stays as it is until the next `talosctl upgrade-k8s` writes Talos's version. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

claude-bot added 1 commit 2026-10-26 08:55:25 +00:00

chore(coredns): keep Flux from pruning the Talos-owned Corefile

ci/woodpecker/pr/ci-manifests-test Pipeline was successful

Details

ci/woodpecker/pr/ci-scripts-test Pipeline was successful

Details

1e26d5cdb2

Step 1 of 2 to hand the coredns ConfigMap back to Talos. It is a Talos
bootstrap manifest (talos-bootstrap-manifests-inventory) that Flux also
applies; talosctl upgrade-k8s reverts Flux's Corefile. Bootstrap already
runs on Talos's Corefile (forward to the node resolver, which asks
k8s-gateway first), and k8s-gateway carries serve_stale for every name,
so the Flux copy is redundant.

With prune disabled, step 2 can drop the file without Flux deleting the
live ConfigMap.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

review-bot approved these changes

2026-10-26 08:55:52 +00:00

review-bot left a comment

🤖 Automated review — model claude-sonnet-5-5, commit 1e26d5cdb2c5b57a3b0d4a5cf5a5cc20e957e52d.

Automated review by the review-bot: it approves only when it found nothing red or yellow, and a human still merges. Push new commits to get a fresh review.

Summary

This PR adds kustomize.toolkit.fluxcd.io/prune: disabled to the coredns ConfigMap in kubernetes/infrastructure/coredns-config/configmap.yaml. That way a later removal of the file from Git (step 2) won't make Flux delete the live ConfigMap. The change is one metadata annotation, with no change to the Corefile data. It is safe to merge.

⚪ Unverified

Annotation survival: the safety of step 2 depends on the annotation staying on the live object. Flux checks the annotation on the cluster object at prune time. If a talosctl upgrade-k8s run (or any Talos re-apply) lands between this PR and step 2 and replaces the ConfigMap's metadata, the annotation could be lost. Step 2 would then delete the ConfigMap and leave CoreDNS without a Corefile. I did not check how Talos applies bootstrap manifests. Before opening step 2, confirm on the live object with kubectl -n kube-system get cm coredns -o jsonpath='{.metadata.annotations}'.
Whether the Flux copy is redundant: I did not check the PR's claim that k8s-gateway already covers both Flux customisations (the renner.uno block and serve_stale). I did not read bootstrap.sh, the k8s-gateway values or ResolverConfig. The claim does not affect this PR, because the PR changes no behaviour. It matters for step 2.
Flux Kustomization settings: I did not read the Flux Kustomization that points at infrastructure/coredns-config. I did not check its prune setting or whether it uses force. If it uses force: true, a recreate would also drop the annotation.

🟢 Nits

The comment Flux must not delete it when this file is removed is accurate. Adding "keep until step 2 is done; remove the file together with this annotation" would help whoever reads it later. Step 2 deletes the whole file, so this is optional.

Tests

No tests apply, since this is a declarative manifest annotation. After merge, check that Flux has reconciled and the annotation is on the live ConfigMap before starting step 2.

Recommendation

Looks reasonable — no blocking issues; comments above are optional.

🤖 **Automated review** — model `claude-sonnet-5-5`, commit `1e26d5cdb2c5b57a3b0d4a5cf5a5cc20e957e52d`. > Automated review by the `review-bot`: it approves only when it found nothing red or yellow, and a human still merges. Push new commits to get a fresh review. --- ## Summary This PR adds `kustomize.toolkit.fluxcd.io/prune: disabled` to the `coredns` ConfigMap in `kubernetes/infrastructure/coredns-config/configmap.yaml`. That way a later removal of the file from Git (step 2) won't make Flux delete the live ConfigMap. The change is one metadata annotation, with no change to the Corefile data. It is safe to merge. ## ⚪ Unverified - **Annotation survival:** the safety of step 2 depends on the annotation staying on the live object. Flux checks the annotation on the cluster object at prune time. If a `talosctl upgrade-k8s` run (or any Talos re-apply) lands between this PR and step 2 and replaces the ConfigMap's metadata, the annotation could be lost. Step 2 would then delete the ConfigMap and leave CoreDNS without a Corefile. I did not check how Talos applies bootstrap manifests. Before opening step 2, confirm on the live object with `kubectl -n kube-system get cm coredns -o jsonpath='{.metadata.annotations}'`. - **Whether the Flux copy is redundant:** I did not check the PR's claim that k8s-gateway already covers both Flux customisations (the `renner.uno` block and `serve_stale`). I did not read `bootstrap.sh`, the k8s-gateway values or `ResolverConfig`. The claim does not affect this PR, because the PR changes no behaviour. It matters for step 2. - **Flux Kustomization settings:** I did not read the Flux `Kustomization` that points at `infrastructure/coredns-config`. I did not check its `prune` setting or whether it uses `force`. If it uses `force: true`, a recreate would also drop the annotation. ## 🟢 Nits - The comment `Flux must not delete it when this file is removed` is accurate. Adding "keep until step 2 is done; remove the file together with this annotation" would help whoever reads it later. Step 2 deletes the whole file, so this is optional. ## Tests No tests apply, since this is a declarative manifest annotation. After merge, check that Flux has reconciled and the annotation is on the live ConfigMap before starting step 2. ## Recommendation Looks reasonable — no blocking issues; comments above are optional.

k.renner merged commit cb697e2812 into main

2026-10-26 08:58:29 +00:00

claude-bot referenced this pull request

2026-10-26 08:59:47 +00:00

chore(coredns): Talos alone owns the Corefile (2/2) #1450

review-bot referenced this pull request

2026-10-26 09:00:55 +00:00

chore(coredns): Talos alone owns the Corefile (2/2) #1450

Sign in to join this conversation.

2 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: konairius/homelab#1449