chore(coredns): Talos alone owns the Corefile (2/2) #1450

2026-10-26T08:59:47Z

claude-bot commented

2026-10-26 08:59:47 +00:00

Step 2 of 2 after #1449.

Corefile: removes infrastructure/coredns-config/configmap.yaml. The kube-dns-lb Service stays.
Live ConfigMap: stays untouched for now, because kustomize.toolkit.fluxcd.io/prune: disabled from #1449 is live (verified on the cluster before opening this). The next talosctl upgrade-k8s replaces it with Talos's Corefile and bumps CoreDNS to v1.14.7.
k8s-gateway comment: its pinned ClusterIP is now explained by the nodes' ResolverConfig instead of the removed Corefile.

After this, cluster DNS depends only on Talos: CoreDNS forwards to the node, the node asks k8s-gateway first, and k8s-gateway falls back to the UDM with serve_stale.

🤖 Generated with Claude Code

Step 2 of 2 after #1449. - **Corefile:** removes `infrastructure/coredns-config/configmap.yaml`. The `kube-dns-lb` Service stays. - **Live ConfigMap:** stays untouched for now, because `kustomize.toolkit.fluxcd.io/prune: disabled` from #1449 is live (verified on the cluster before opening this). The next `talosctl upgrade-k8s` replaces it with Talos's Corefile and bumps CoreDNS to v1.14.7. - **k8s-gateway comment:** its pinned ClusterIP is now explained by the nodes' `ResolverConfig` instead of the removed Corefile. After this, cluster DNS depends only on Talos: CoreDNS forwards to the node, the node asks k8s-gateway first, and k8s-gateway falls back to the UDM with `serve_stale`. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

claude-bot added 1 commit 2026-10-26 08:59:47 +00:00

chore(coredns): Talos alone owns the Corefile

ci/woodpecker/pr/ci-manifests-test Pipeline was successful

Details

ci/woodpecker/pr/ci-scripts-test Pipeline was successful

Details

60d3acc202

Step 2 of 2. The coredns ConfigMap is a Talos bootstrap manifest; Flux
stops applying its own copy (prune is disabled since the previous
commit, so the live ConfigMap stays until talosctl upgrade-k8s writes
Talos's version). CoreDNS forwards to the node resolver, which asks
k8s-gateway first, so cluster DNS no longer depends on Flux.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

review-bot reviewed

2026-10-26 09:00:55 +00:00

review-bot left a comment

🤖 Automated review — model claude-sonnet-5-5, commit 60d3acc2028d1ceceecc51cae0ad25a03a9ae587.

Automated review by the review-bot: it approves only when it found nothing red or yellow, and a human still merges. Push new commits to get a fresh review.

Summary

This PR deletes the Flux-managed coredns ConfigMap (coredns-config/configmap.yaml). It drops the resource from the kustomization and rewrites the comment explaining why k8s-gateway's ClusterIP is pinned. This is step 2 of 2 after #1449, which merged to main as cb697e28 and added prune: disabled. The change is small and consistent with the repo, and I found no blocking defect. The risk is runtime behaviour after the next talosctl upgrade-k8s, which I could not verify from the repo.

⚪ Unverified

Resolver order. The PR relies on the node resolver trying k8s-gateway (10.96.0.11) before the UDM. The repo does set that order: ResolverConfig in kubernetes/talos/patches/site-homelab.yaml lists 10.96.0.11 then 10.2.40.1, and site-hcloud.yaml lists 10.96.0.11 first. I could not confirm how Talos's host DNS proxy picks between upstreams. It may be sequential, random or health-based. If it is not strictly ordered, in-cluster renner.uno Ingress names could sometimes resolve through the UDM instead of k8s-gateway.
Talos default Corefile. The PR says the Talos Corefile forwards to the node and carries a cache that exempts cluster.local. I could not read it in this repo, because it is generated by Talos and not committed. The deleted file did exempt cluster.local from caching, and that guarantee comes from the Talos default after the upgrade.
Other references to the removed file. kubernetes/bootstrap.sh (~137 KB), RUNBOOK-cold-rebuild.md and e2e-test.sh may still mention coredns-config/configmap.yaml or the Flux Corefile. I could not search file contents, and the repository tree listing was truncated. The only search hits for coredns-config were this PR itself.
Live prune guard. The "prune disabled is live on the cluster" claim comes from the author. The repo only shows the annotation merged in #1449 (1e26d5cd). I could not check the cluster.

🟡 Suggestions

kubernetes/infrastructure/coredns-config/configmap.yaml (deleted): the removed comments recorded why things were done, including issues #393 and #439 and the "template plugin broke cluster DNS in 7a09bad5" warning. That history is now gone from the tree, and k8s-gateway's helmrelease.yaml keeps only the #393 cache note. Consider keeping a line in the k8s-gateway/helmrelease.yaml comments or the commit body saying the Talos Corefile deliberately has no template/serve_stale tuning, so nobody re-adds a Flux-owned Corefile.
kubernetes/infrastructure/coredns-config/kustomization.yaml:3-4: until talosctl upgrade-k8s runs, the live Corefile is still the old Flux copy and no longer matches the repo. Add a note in the PR or a runbook that DNS behaviour changes at that upgrade, not at merge. Consider checking renner.uno resolution from a pod right after it.

Tests

No tests are expected for a pure manifest deletion. The only way to check it is in place: Flux reconciles without deleting the live coredns ConfigMap, and after the next upgrade-k8s a pod resolves *.renner.uno, public names and cluster.local.

Recommendation

Looks reasonable — no blocking issues; comments above are optional.

🤖 **Automated review** — model `claude-sonnet-5-5`, commit `60d3acc2028d1ceceecc51cae0ad25a03a9ae587`. > Automated review by the `review-bot`: it approves only when it found nothing red or yellow, and a human still merges. Push new commits to get a fresh review. --- ## Summary This PR deletes the Flux-managed `coredns` ConfigMap (`coredns-config/configmap.yaml`). It drops the resource from the kustomization and rewrites the comment explaining why k8s-gateway's ClusterIP is pinned. This is step 2 of 2 after #1449, which merged to `main` as cb697e28 and added `prune: disabled`. The change is small and consistent with the repo, and I found no blocking defect. The risk is runtime behaviour after the next `talosctl upgrade-k8s`, which I could not verify from the repo. ## ⚪ Unverified - **Resolver order.** The PR relies on the node resolver trying k8s-gateway (10.96.0.11) before the UDM. The repo does set that order: `ResolverConfig` in `kubernetes/talos/patches/site-homelab.yaml` lists `10.96.0.11` then `10.2.40.1`, and `site-hcloud.yaml` lists `10.96.0.11` first. I could not confirm how Talos's host DNS proxy picks between upstreams. It may be sequential, random or health-based. If it is not strictly ordered, in-cluster `renner.uno` Ingress names could sometimes resolve through the UDM instead of k8s-gateway. - **Talos default Corefile.** The PR says the Talos Corefile forwards to the node and carries a cache that exempts `cluster.local`. I could not read it in this repo, because it is generated by Talos and not committed. The deleted file did exempt `cluster.local` from caching, and that guarantee comes from the Talos default after the upgrade. - **Other references to the removed file.** `kubernetes/bootstrap.sh` (~137 KB), `RUNBOOK-cold-rebuild.md` and `e2e-test.sh` may still mention `coredns-config/configmap.yaml` or the Flux Corefile. I could not search file contents, and the repository tree listing was truncated. The only search hits for `coredns-config` were this PR itself. - **Live prune guard.** The "prune disabled is live on the cluster" claim comes from the author. The repo only shows the annotation merged in #1449 (1e26d5cd). I could not check the cluster. ## 🟡 Suggestions - `kubernetes/infrastructure/coredns-config/configmap.yaml` (deleted): the removed comments recorded why things were done, including issues #393 and #439 and the "`template` plugin broke cluster DNS in 7a09bad5" warning. That history is now gone from the tree, and k8s-gateway's `helmrelease.yaml` keeps only the #393 cache note. Consider keeping a line in the `k8s-gateway/helmrelease.yaml` comments or the commit body saying the Talos Corefile deliberately has no `template`/`serve_stale` tuning, so nobody re-adds a Flux-owned Corefile. - `kubernetes/infrastructure/coredns-config/kustomization.yaml:3-4`: until `talosctl upgrade-k8s` runs, the live Corefile is still the old Flux copy and no longer matches the repo. Add a note in the PR or a runbook that DNS behaviour changes at that upgrade, not at merge. Consider checking `renner.uno` resolution from a pod right after it. ## Tests No tests are expected for a pure manifest deletion. The only way to check it is in place: Flux reconciles without deleting the live `coredns` ConfigMap, and after the next `upgrade-k8s` a pod resolves `*.renner.uno`, public names and `cluster.local`. ## Recommendation Looks reasonable — no blocking issues; comments above are optional.

k.renner merged commit 622a4cc593 into main

2026-10-26 09:04:47 +00:00

review-bot referenced this pull request

2026-10-26 09:05:32 +00:00

feat(music-assistant): PO token server for YouTube Music provider #1451

Sign in to join this conversation.

2 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: konairius/homelab#1450