replicaCount: 2
image:
    repository: coredns/coredns
    tag: 1.14.3
    pullPolicy: IfNotPresent
deployment:
    dnsPolicy: ClusterFirst
    strategy:
        type: RollingUpdate
        rollingUpdate:
            maxUnavailable: 0
            maxSurge: 1
livenessProbe:
    httpGet:
        path: /health
        port: 8080
    initialDelaySeconds: 10
    periodSeconds: 10
    timeoutSeconds: 5
    failureThreshold: 3
readinessProbe:
    httpGet:
        path: /ready
        port: 8181
    initialDelaySeconds: 5
    periodSeconds: 5
    timeoutSeconds: 3
    failureThreshold: 3
resources:
    limits:
        cpu: 100m
        memory: 128Mi
    requests:
        cpu: 50m
        memory: 64Mi
serviceType: ClusterIP
service:
    annotations:
        io.cilium/lb-ipam-ips: ""
servers:
    - zones:
        - zone: cluster.local
      port: 53
      plugins:
        - name: kubernetes
          parameters: cluster.local in-addr.arpa ip6.arpa
          configBlock: |-
            pods insecure
            fallthrough in-addr.arpa ip6.arpa
            ttl 30
    - zones:
        - zone: .
      port: 53
      plugins:
        - name: errors
        - name: health
          configBlock: lameduck 5s
        - name: ready
        - name: debug
        - name: file
          parameters: /etc/coredns/zones/lan.zone lan
          configBlock: |-
            reload 10s
            fallthrough
        - name: etcd
          parameters: lan
          configBlock: |-
            path /skydns
            endpoint http://etcd.coredns.svc.cluster.local:2379
            fallthrough
        - name: cache
          parameters: 30
        - name: loadbalance
        - name: log
extraVolumeMounts:
    - name: zone-config
      mountPath: /etc/coredns/zones
      readOnly: true
extraVolumes:
    - name: zone-config
      configMap:
        name: coredns-lan-zone
# Tolerate failover nodes
tolerations:
    - key: ENC[AES256_GCM,data:TD6fwhFKP054jWvEGAT4xwhZNT/MP8k0r+Z003ZNxZAAgvA+yQ==,iv:0BoyRY0bMER/w/xhcfyG8rypVwnAX5Mx4GY/uw3EWaw=,tag:Wa+XMBfOZFmozPkkrCC22A==,type:str]
      operator: Exists
      effect: NoSchedule
    - key: ENC[AES256_GCM,data:MmpjgvMIVnwY,iv:UczUocGrbKPWtHvqroPSM0fENcFKA1/q5gg897FQ2os=,tag:VjIXXMqFKZpuJLDcCwrihA==,type:str]
      operator: Equal
      value: ENC[AES256_GCM,data:wQt4J0CGyvA=,iv:96KUByHzR0rYzUd5SwvD+KADFJLzEq6tp93WkidjqRk=,tag:6cdRiLbkFam2Op9eL2iNkw==,type:str]
      effect: NoSchedule
sops:
    lastmodified: "2026-08-26T19:28:04Z"
    mac: ENC[AES256_GCM,data:JeqUi3IuWEHkXOinYmL1zTnRJzngIZ0YnAsEk4/yAly6MpXEjvaQTC+YCutr+rLd3UKENcpeenqVuJiFni4EVpUUunVV+2TCGuK7rMAUaUBHgdscbnJPxg2rvTnmhDmKwFrEcgM0k4bszzRJnRONCnjf3NDZxbNNUuFDiu88ZFE=,iv:+d4VOxM9fCICHvgl9O4Nm9sZUYkzgqhYqiyDjULPfgk=,tag:wvtKkcdgYcbmtFrUD6Ycxg==,type:str]
    pgp:
        - created_at: "2026-08-26T19:28:04Z"
          enc: |-
            -----BEGIN PGP MESSAGE-----

            hQIMA7uy4qQr71wiAQ/9EkvguGI0a/J6jP6h4c6jbvf5EFkF9qUtWimjMgfB/S3F
            DZjX1YO8lyQmoyMThK2O5U/ocq5/rdQ1P9I9ZZY9+rIy6Gewcw5xBfwivuLUo0aq
            JRIC98dGeJN14sGJFwiatmGp4Oq31TE6Z9yOam1Qvxcm6X1kURTAa0FYXo6BlLH4
            sjfdfRAiGScV6jBKsIDc/fct++3FK2TIvwwHgyyXjoDq6Fp2i4hPT7Q97M+nm1d6
            0HoRO9RcEZzPjulyhMQCl9J037IMGZsA4dpy85jzvF7wsI/XmhTAj5GkETD1ARtS
            dYGhgz/CUPG78JsRjbP8oEztsUw6blORlhvooB+8gMVPihnpjiiApzHzjVBxz4gJ
            nxDIUFTqz6sIoAA8W1/auS8zpw6/+bObSA1A+5Uzqc41B0DuqSQLVqx8fO4Yvnt9
            a0+J05qgOLvSm3uduXCeKnm8nLSMm8YQSKYV3qYSyrqyp0j7pJJ8I2amm1Lq3wdz
            roMNO5yj4g085x9+6El1+Oaovz1cQM2OlNjV9nYhhJfqZ/zzjuGE2P0VUWfYK1u0
            +wFe+9ZEgGmwjD5Y8cd+2EFbuY0L2Uuq1LG0eLJKORL4nUy7Bam+sh+WEZ/+hqSi
            56lcyY/3btMS/GGYekbJ9KU5nsqnw6CAcXxofdhC+VaX5DKwHLSrMXZ7p/a/H+jS
            XgH4WbiGrBaFDeWLMXnJW0fmR/kn6bt7dLsigkuCxqZ100sD29Qwx+GriOBuqTHD
            RCSk+he3rUnvCBlSjCf2842cQRlvwg4m7hWHOKJhpPLSXoW9OTK3Fh0RDP8c2Ew=
            =UIlP
            -----END PGP MESSAGE-----
          fp: DC6910268E657FF70BA7EC289974494E76938DDC
    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$
    mac_only_encrypted: true
    version: 3.10.2