feat(self-host): expose dnsConfig/dnsPolicy on component pods

[fer]

Problem

On clusters where the kubelet injects the default options ndots:5 and the pod inherits corporate DNS search domains, automatic licensing/billing sync fails. The 2-dot cloud endpoints (identity.bitwarden.eu, api.bitwarden.eu, selfhost.bitwarden.com) get search-expanded first; when the corporate resolver returns SERVFAIL for the bogus expanded name (e.g. identity.bitwarden.eu.corp.example), the Alpine/musl getaddrinfo in our images aborts the entire lookup and never tries the real name. .NET surfaces it as SocketException 0xFFFDFFFF "Name does not resolve"; nslookup/curl use a different resolver path and succeed, which makes it hard to diagnose. glibc does not abort on SERVFAIL during search — this is musl-specific and by design.

Why a chart change

The fix is a standard Pod dnsConfig (options: ndots:2), but the chart exposes no dnsConfig/dnsPolicy field. The only workaround is an out-of-band kubectl patch, which helm upgrade overwrites.

Change

Adds general.dnsPolicy / general.dnsConfig with per-component overrides under component.<name>, rendered into each component Deployment's pod spec — same override pattern as nodeSelector/tolerations. Includes values.schema.json entries and bumps the chart 2.0.1 -> 2.1.0 (appVersion unchanged).

Result:

general:
  dnsConfig:
    options:
      - name: ndots
        value: "2"

Upgrade-safe, supported value instead of a manual patch.

Test plan

• helm template with and without general.dnsConfig → block present/absent in each Deployment.
• Per-component override beats general.
• helm lint passes with the schema entries (validated).
• Repro: cluster with ndots:5 + a search domain whose resolver SERVFAILs the expanded name → getent hosts identity.bitwarden.eu empty before, resolves after setting ndots:2.

Root-cause references

• musl src/network/lookup_name.c — name_from_dns returns EAI_AGAIN on SERVFAIL (rcode 2), 0 on NXDOMAIN (rcode 3); name_from_dns_search aborts on the non-zero return.
• dotnet/runtime src/native/libs/System.Native/pal_networking.c — SystemNative_GetHostEntryForName calls libc getaddrinfo directly.
• Kubernetes DNS docs — options ndots:5 default; dnsConfig.options "merged to the options generated from the specified DNS policy. Duplicate entries are removed."

[bitwarden-bot]

Thank you for your contribution! We've added this to our internal tracking system for review.
ID: PM-39061
Link: https://bitwarden.atlassian.net/browse/PM-39061

Details on our contribution process can be found here: https://contributing.bitwarden.com/contributing/pull-requests/community-pr-process.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[keithhubner]

branch now out of date and failed tests, please update branch.