From f2f1168e6015784e97beff8986b35bec4478cec2 Mon Sep 17 00:00:00 2001 From: fer <21882+fer@users.noreply.github.com> Date: Thu, 2 Jul 2026 17:48:05 +0200 Subject: [PATCH] feat(self-host): expose dnsConfig/dnsPolicy on component pods Adds general.dnsConfig/dnsPolicy (with per-component overrides) rendered into each component Deployment pod spec, same pattern as nodeSelector/tolerations. Lets self-host clusters override pod DNS (e.g. ndots:2) so deployments with the kubelet default ndots:5 plus corporate search domains that return SERVFAIL can resolve cloud endpoints (identity/api.bitwarden.eu) for license/billing sync. The Alpine/musl getaddrinfo aborts the search on SERVFAIL where glibc would not. Includes generated values.schema.json and bumps chart 2.0.2 -> 2.1.0. --- charts/self-host/templates/admin.yaml | 11 +++++++++++ charts/self-host/templates/api.yaml | 11 +++++++++++ charts/self-host/templates/attachments.yaml | 11 +++++++++++ charts/self-host/templates/events.yaml | 11 +++++++++++ charts/self-host/templates/icons.yaml | 11 +++++++++++ charts/self-host/templates/identity.yaml | 11 +++++++++++ charts/self-host/templates/notifications.yaml | 11 +++++++++++ charts/self-host/templates/scim.yaml | 11 +++++++++++ charts/self-host/templates/sso.yaml | 11 +++++++++++ charts/self-host/templates/web.yaml | 11 +++++++++++ charts/self-host/values.schema.json | 12 ++++++++++++ charts/self-host/values.yaml | 7 +++++++ 12 files changed, 129 insertions(+) diff --git a/charts/self-host/templates/admin.yaml b/charts/self-host/templates/admin.yaml index 52a7a5f3e..36d399d72 100644 --- a/charts/self-host/templates/admin.yaml +++ b/charts/self-host/templates/admin.yaml @@ -67,6 +67,17 @@ spec: {{ toYaml .Values.general.tolerations | nindent 8 }} {{- end }} {{- end }} + {{- if or .Values.component.admin.dnsPolicy .Values.general.dnsPolicy }} + dnsPolicy: {{ default .Values.general.dnsPolicy .Values.component.admin.dnsPolicy }} + {{- end }} + {{- if or .Values.component.admin.dnsConfig .Values.general.dnsConfig }} + dnsConfig: + {{- if .Values.component.admin.dnsConfig }} + {{ toYaml .Values.component.admin.dnsConfig | nindent 8 }} + {{- else }} + {{ toYaml .Values.general.dnsConfig | nindent 8 }} + {{- end }} + {{- end }} {{- if .Values.component.admin.podServiceAccount }} serviceAccount: {{ .Values.component.admin.podServiceAccount | quote }} serviceAccountName: {{ .Values.component.admin.podServiceAccount | quote }} diff --git a/charts/self-host/templates/api.yaml b/charts/self-host/templates/api.yaml index c03aa97b2..3940f8692 100644 --- a/charts/self-host/templates/api.yaml +++ b/charts/self-host/templates/api.yaml @@ -67,6 +67,17 @@ spec: {{ toYaml .Values.general.tolerations | nindent 8 }} {{- end }} {{- end }} + {{- if or .Values.component.api.dnsPolicy .Values.general.dnsPolicy }} + dnsPolicy: {{ default .Values.general.dnsPolicy .Values.component.api.dnsPolicy }} + {{- end }} + {{- if or .Values.component.api.dnsConfig .Values.general.dnsConfig }} + dnsConfig: + {{- if .Values.component.api.dnsConfig }} + {{ toYaml .Values.component.api.dnsConfig | nindent 8 }} + {{- else }} + {{ toYaml .Values.general.dnsConfig | nindent 8 }} + {{- end }} + {{- end }} {{- if .Values.component.api.podServiceAccount }} serviceAccount: {{ .Values.component.api.podServiceAccount | quote }} serviceAccountName: {{ .Values.component.api.podServiceAccount | quote }} diff --git a/charts/self-host/templates/attachments.yaml b/charts/self-host/templates/attachments.yaml index e6f5c1d56..147ac56c8 100644 --- a/charts/self-host/templates/attachments.yaml +++ b/charts/self-host/templates/attachments.yaml @@ -66,6 +66,17 @@ spec: {{ toYaml .Values.general.tolerations | nindent 8 }} {{- end }} {{- end }} + {{- if or .Values.component.attachments.dnsPolicy .Values.general.dnsPolicy }} + dnsPolicy: {{ default .Values.general.dnsPolicy .Values.component.attachments.dnsPolicy }} + {{- end }} + {{- if or .Values.component.attachments.dnsConfig .Values.general.dnsConfig }} + dnsConfig: + {{- if .Values.component.attachments.dnsConfig }} + {{ toYaml .Values.component.attachments.dnsConfig | nindent 8 }} + {{- else }} + {{ toYaml .Values.general.dnsConfig | nindent 8 }} + {{- end }} + {{- end }} {{- if .Values.component.attachments.podServiceAccount }} serviceAccount: {{ .Values.component.attachments.podServiceAccount | quote }} serviceAccountName: {{ .Values.component.attachments.podServiceAccount | quote }} diff --git a/charts/self-host/templates/events.yaml b/charts/self-host/templates/events.yaml index b899fe69b..a3d73f41d 100644 --- a/charts/self-host/templates/events.yaml +++ b/charts/self-host/templates/events.yaml @@ -67,6 +67,17 @@ spec: {{ toYaml .Values.general.tolerations | nindent 8 }} {{- end }} {{- end }} + {{- if or .Values.component.events.dnsPolicy .Values.general.dnsPolicy }} + dnsPolicy: {{ default .Values.general.dnsPolicy .Values.component.events.dnsPolicy }} + {{- end }} + {{- if or .Values.component.events.dnsConfig .Values.general.dnsConfig }} + dnsConfig: + {{- if .Values.component.events.dnsConfig }} + {{ toYaml .Values.component.events.dnsConfig | nindent 8 }} + {{- else }} + {{ toYaml .Values.general.dnsConfig | nindent 8 }} + {{- end }} + {{- end }} {{- if .Values.component.events.podServiceAccount }} serviceAccount: {{ .Values.component.events.podServiceAccount | quote }} serviceAccountName: {{ .Values.component.events.podServiceAccount | quote }} diff --git a/charts/self-host/templates/icons.yaml b/charts/self-host/templates/icons.yaml index 9033fd151..b7540120a 100644 --- a/charts/self-host/templates/icons.yaml +++ b/charts/self-host/templates/icons.yaml @@ -66,6 +66,17 @@ spec: {{ toYaml .Values.general.tolerations | nindent 8 }} {{- end }} {{- end }} + {{- if or .Values.component.icons.dnsPolicy .Values.general.dnsPolicy }} + dnsPolicy: {{ default .Values.general.dnsPolicy .Values.component.icons.dnsPolicy }} + {{- end }} + {{- if or .Values.component.icons.dnsConfig .Values.general.dnsConfig }} + dnsConfig: + {{- if .Values.component.icons.dnsConfig }} + {{ toYaml .Values.component.icons.dnsConfig | nindent 8 }} + {{- else }} + {{ toYaml .Values.general.dnsConfig | nindent 8 }} + {{- end }} + {{- end }} {{- if .Values.component.icons.podServiceAccount }} serviceAccount: {{ .Values.component.icons.podServiceAccount | quote }} serviceAccountName: {{ .Values.component.icons.podServiceAccount | quote }} diff --git a/charts/self-host/templates/identity.yaml b/charts/self-host/templates/identity.yaml index 935a0308c..eaa057742 100644 --- a/charts/self-host/templates/identity.yaml +++ b/charts/self-host/templates/identity.yaml @@ -67,6 +67,17 @@ spec: {{ toYaml .Values.general.tolerations | nindent 8 }} {{- end }} {{- end }} + {{- if or .Values.component.identity.dnsPolicy .Values.general.dnsPolicy }} + dnsPolicy: {{ default .Values.general.dnsPolicy .Values.component.identity.dnsPolicy }} + {{- end }} + {{- if or .Values.component.identity.dnsConfig .Values.general.dnsConfig }} + dnsConfig: + {{- if .Values.component.identity.dnsConfig }} + {{ toYaml .Values.component.identity.dnsConfig | nindent 8 }} + {{- else }} + {{ toYaml .Values.general.dnsConfig | nindent 8 }} + {{- end }} + {{- end }} {{- if .Values.component.identity.podServiceAccount }} serviceAccount: {{ .Values.component.identity.podServiceAccount | quote }} serviceAccountName: {{ .Values.component.identity.podServiceAccount | quote }} diff --git a/charts/self-host/templates/notifications.yaml b/charts/self-host/templates/notifications.yaml index 0cae495ff..b972db55e 100644 --- a/charts/self-host/templates/notifications.yaml +++ b/charts/self-host/templates/notifications.yaml @@ -66,6 +66,17 @@ spec: {{ toYaml .Values.general.tolerations | nindent 8 }} {{- end }} {{- end }} + {{- if or .Values.component.notifications.dnsPolicy .Values.general.dnsPolicy }} + dnsPolicy: {{ default .Values.general.dnsPolicy .Values.component.notifications.dnsPolicy }} + {{- end }} + {{- if or .Values.component.notifications.dnsConfig .Values.general.dnsConfig }} + dnsConfig: + {{- if .Values.component.notifications.dnsConfig }} + {{ toYaml .Values.component.notifications.dnsConfig | nindent 8 }} + {{- else }} + {{ toYaml .Values.general.dnsConfig | nindent 8 }} + {{- end }} + {{- end }} {{- if .Values.component.notifications.podServiceAccount }} serviceAccount: {{ .Values.component.notifications.podServiceAccount | quote }} serviceAccountName: {{ .Values.component.notifications.podServiceAccount | quote }} diff --git a/charts/self-host/templates/scim.yaml b/charts/self-host/templates/scim.yaml index 0eb0596e9..4e7a305de 100644 --- a/charts/self-host/templates/scim.yaml +++ b/charts/self-host/templates/scim.yaml @@ -68,6 +68,17 @@ spec: {{ toYaml .Values.general.tolerations | nindent 8 }} {{- end }} {{- end }} + {{- if or .Values.component.scim.dnsPolicy .Values.general.dnsPolicy }} + dnsPolicy: {{ default .Values.general.dnsPolicy .Values.component.scim.dnsPolicy }} + {{- end }} + {{- if or .Values.component.scim.dnsConfig .Values.general.dnsConfig }} + dnsConfig: + {{- if .Values.component.scim.dnsConfig }} + {{ toYaml .Values.component.scim.dnsConfig | nindent 8 }} + {{- else }} + {{ toYaml .Values.general.dnsConfig | nindent 8 }} + {{- end }} + {{- end }} {{- if .Values.component.scim.podServiceAccount }} serviceAccount: {{ .Values.component.scim.podServiceAccount | quote }} serviceAccountName: {{ .Values.component.scim.podServiceAccount | quote }} diff --git a/charts/self-host/templates/sso.yaml b/charts/self-host/templates/sso.yaml index add161926..ee3323b67 100644 --- a/charts/self-host/templates/sso.yaml +++ b/charts/self-host/templates/sso.yaml @@ -67,6 +67,17 @@ spec: {{ toYaml .Values.general.tolerations | nindent 8 }} {{- end }} {{- end }} + {{- if or .Values.component.sso.dnsPolicy .Values.general.dnsPolicy }} + dnsPolicy: {{ default .Values.general.dnsPolicy .Values.component.sso.dnsPolicy }} + {{- end }} + {{- if or .Values.component.sso.dnsConfig .Values.general.dnsConfig }} + dnsConfig: + {{- if .Values.component.sso.dnsConfig }} + {{ toYaml .Values.component.sso.dnsConfig | nindent 8 }} + {{- else }} + {{ toYaml .Values.general.dnsConfig | nindent 8 }} + {{- end }} + {{- end }} {{- if .Values.component.sso.podServiceAccount }} serviceAccount: {{ .Values.component.sso.podServiceAccount | quote }} serviceAccountName: {{ .Values.component.sso.podServiceAccount | quote }} diff --git a/charts/self-host/templates/web.yaml b/charts/self-host/templates/web.yaml index b908ca567..937cafc83 100644 --- a/charts/self-host/templates/web.yaml +++ b/charts/self-host/templates/web.yaml @@ -66,6 +66,17 @@ spec: {{ toYaml .Values.general.tolerations | nindent 8 }} {{- end }} {{- end }} + {{- if or .Values.component.web.dnsPolicy .Values.general.dnsPolicy }} + dnsPolicy: {{ default .Values.general.dnsPolicy .Values.component.web.dnsPolicy }} + {{- end }} + {{- if or .Values.component.web.dnsConfig .Values.general.dnsConfig }} + dnsConfig: + {{- if .Values.component.web.dnsConfig }} + {{ toYaml .Values.component.web.dnsConfig | nindent 8 }} + {{- else }} + {{ toYaml .Values.general.dnsConfig | nindent 8 }} + {{- end }} + {{- end }} {{- if .Values.component.web.podServiceAccount }} serviceAccount: {{ .Values.component.web.podServiceAccount | quote }} serviceAccountName: {{ .Values.component.web.podServiceAccount | quote }} diff --git a/charts/self-host/values.schema.json b/charts/self-host/values.schema.json index 68852002b..a1c8884b7 100644 --- a/charts/self-host/values.schema.json +++ b/charts/self-host/values.schema.json @@ -2710,6 +2710,18 @@ "title": "distributedCache", "type": "object" }, + "dnsConfig": { + "description": "Pod DNS config for all components, mapped to a Pod's spec.dnsConfig (override per component).\nUse on clusters where the kubelet default ndots:5 plus corporate search domains break outbound\nresolution from the Alpine/musl images. Example: options ndots \"2\".", + "required": [], + "title": "dnsConfig", + "type": "object" + }, + "dnsPolicy": { + "default": "", + "description": "Pod DNS policy for all components (override per component under component.\u003cname\u003e.dnsPolicy).\nEmpty uses the Kubernetes default (ClusterFirst).", + "title": "dnsPolicy", + "type": "string" + }, "domain": { "default": "REPLACE", "description": "Domain name for the service", diff --git a/charts/self-host/values.yaml b/charts/self-host/values.yaml index b52980d37..32f223b22 100644 --- a/charts/self-host/values.yaml +++ b/charts/self-host/values.yaml @@ -138,6 +138,13 @@ general: enforceSsoPolicyForAllUsers: false # Custom labels to add throughout the installation labels: {} + # Pod DNS policy for all components (override per component under component..dnsPolicy). + # Empty uses the Kubernetes default (ClusterFirst). + dnsPolicy: "" + # Pod DNS config for all components, mapped to a Pod's spec.dnsConfig (override per component). + # Use on clusters where the kubelet default ndots:5 plus corporate search domains break outbound + # resolution from the Alpine/musl images. Example: options ndots "2". + dnsConfig: {} # Custom annotations to add throughout the installation annotations: {} # Additional default pod labels