**FAILURE** rebase-release-4.22-4.22.0-0.nightly-2026-04-01-151631_amd64-2026-04-01_arm64-2026-04-02

assets/components/openshift-dns/dns/daemonset.yaml

@@ -1,120 +1,94 @@
 kind: DaemonSet
 apiVersion: apps/v1
+# name, namespace and labels are set at runtime
 spec:
   # minReadySeconds should be 3x the readiness probe's polling interval (i.e. periodSeconds).
   minReadySeconds: 9
   template:
     metadata:
       annotations:
         target.workload.openshift.io/management: '{"effect": "PreferredDuringScheduling"}'
-      labels:
-        dns.operator.openshift.io/daemonset-dns: default
     spec:
       serviceAccountName: dns
       priorityClassName: system-node-critical
       containers:
-        - name: dns
-          imagePullPolicy: IfNotPresent
-          terminationMessagePolicy: FallbackToLogsOnError
-          command: ["coredns"]
-          args: ["-conf", "/etc/coredns/Corefile"]
-          volumeMounts:
-            - name: config-volume
-              mountPath: /etc/coredns
-              readOnly: true
-            - mountPath: /tmp
-              name: tmp-dir
-            {{- if .HostsEnabled }}
-            - mountPath: /tmp/hosts
-              name: hosts
-              readOnly: true
-            {{- end }}
-          ports:
-            - containerPort: 5353
-              name: dns
-              protocol: UDP
-            - containerPort: 5353
-              name: dns-tcp
-              protocol: TCP
-          readinessProbe:
-            httpGet:
-              path: /ready
-              port: 8181
-              scheme: HTTP
-            initialDelaySeconds: 10
-            periodSeconds: 3 # Update the daemonset's spec.minReadySeconds above if you change this value!
-            successThreshold: 1
-            failureThreshold: 3
-            timeoutSeconds: 3
-          livenessProbe:
-            httpGet:
-              path: /health
-              port: 8080
-              scheme: HTTP
-            initialDelaySeconds: 60
-            timeoutSeconds: 5
-            successThreshold: 1
-            failureThreshold: 5
-          resources:
-            requests:
-              cpu: 50m
-              memory: 70Mi
-          securityContext:
-            readOnlyRootFilesystem: true
-          image: '{{ .ReleaseImage.coredns }}'
-        - name: kube-rbac-proxy
-          ports:
-            - containerPort: 9154
-              name: metrics
-          resources:
-            requests:
-              cpu: 10m
-              memory: 40Mi
-          terminationMessagePolicy: FallbackToLogsOnError
-          volumeMounts:
-            - mountPath: /etc/tls/private
-              name: metrics-tls
-              readOnly: true
-            - mountPath: /tmp
-              name: tmp-dir
-          securityContext:
-            readOnlyRootFilesystem: true
-          image: '{{ .ReleaseImage.kube_rbac_proxy }}'
-          args:
-            - --secure-listen-address=:9154
-            - --tls-cipher-suites={{ .TLSCipherSuites }}
-            - --tls-min-version={{ .TLSMinVersion }}
-            - --upstream=http://127.0.0.1:9153/
-            - --tls-cert-file=/etc/tls/private/tls.crt
-            - --tls-private-key-file=/etc/tls/private/tls.key
-          imagePullPolicy: IfNotPresent
+      - name: dns
+        # image is set at runtime
+        imagePullPolicy: IfNotPresent
+        terminationMessagePolicy: FallbackToLogsOnError
+        command: [ "coredns" ]
+        args: [ "-conf", "/etc/coredns/Corefile" ]
+        volumeMounts:
+        - name: config-volume
+          mountPath: /etc/coredns
+          readOnly: true
+        - mountPath: /tmp
+          name: tmp-dir
+        ports:
+        - containerPort: 5353
+          name: dns
+          protocol: UDP
+        - containerPort: 5353
+          name: dns-tcp
+          protocol: TCP
+        readinessProbe:
+          httpGet:
+            path: /ready
+            port: 8181
+            scheme: HTTP
+          initialDelaySeconds: 10
+          periodSeconds: 3 # Update the daemonset's spec.minReadySeconds above if you change this value!
+          successThreshold: 1
+          failureThreshold: 3
+          timeoutSeconds: 3
+        livenessProbe:
+          httpGet:
+            path: /health
+            port: 8080
+            scheme: HTTP
+          initialDelaySeconds: 60
+          timeoutSeconds: 5
+          successThreshold: 1
+          failureThreshold: 5
+        resources:
+          requests:
+            cpu: 50m
+            memory: 70Mi
+        securityContext:
+          readOnlyRootFilesystem: true
+      - name: kube-rbac-proxy
+        # image and args are set at runtime by the operator based on the
+        # centralized TLS security profile from apiservers.config.openshift.io/cluster
+        ports:
+        - containerPort: 9154
+          name: metrics
+        resources:
+          requests:
+            cpu: 10m
+            memory: 40Mi
+        terminationMessagePolicy: FallbackToLogsOnError
+        volumeMounts:
+        - mountPath: /etc/tls/private
+          name: metrics-tls
+          readOnly: true
+        - mountPath: /tmp
+          name: tmp-dir
+        securityContext:
+          readOnlyRootFilesystem: true
       dnsPolicy: Default
+      # nodeSelector is set at runtime.
       volumes:
-        - name: config-volume
-          configMap:
-            items:
-              - key: Corefile
-                path: Corefile
-            name: dns-default
-        - name: metrics-tls
-          secret:
-            defaultMode: 420
-            secretName: dns-default-metrics-tls
-        {{- if .HostsEnabled }}
-        - name: hosts
-          configMap:
-            name: hosts-file
-            items:
-              - key: hosts
-                path: hosts
-        {{- end }}
-        - name: tmp-dir
-          emptyDir: {}
-      nodeSelector:
-        kubernetes.io/os: linux
-      tolerations:
-        - key: node-role.kubernetes.io/master
-          operator: Exists
+      - name: config-volume
+        configMap:
+        # Name is set at runtime
+          items:
+          - key: Corefile
+            path: Corefile
+      - name: metrics-tls
+        # secretName is set at runtime
+      - name: tmp-dir
+        emptyDir: {}
+      # tolerations is set at runtime.
   updateStrategy:
     type: RollingUpdate
     rollingUpdate:
@@ -126,11 +100,3 @@ spec:
       maxSurge: 10%
       # maxUnavailable must be zero when maxSurge is nonzero.
       maxUnavailable: 0
-  selector:
-    matchLabels:
-      dns.operator.openshift.io/daemonset-dns: default
-metadata:
-  name: dns-default
-  namespace: openshift-dns
-  labels:
-    dns.operator.openshift.io/owning-dns: default

assets/components/openshift-dns/dns/service.yaml

@@ -1,25 +1,20 @@
 kind: Service
 apiVersion: v1
+# name, namespace,labels and annotations are set at runtime
 spec:
+  # clusterIP will be automatically managed.
+  # selector is set at runtime
   trafficDistribution: PreferSameNode
   ports:
-    - name: dns
-      port: 53
-      targetPort: dns
-      protocol: UDP
-    - name: dns-tcp
-      port: 53
-      targetPort: dns-tcp
-      protocol: TCP
-    - name: metrics
-      port: 9154
-      targetPort: metrics
-      protocol: TCP
-  clusterIP: '{{.ClusterIP}}'
-  selector:
-    dns.operator.openshift.io/daemonset-dns: default
-metadata:
-  annotations:
-    service.beta.openshift.io/serving-cert-secret-name: dns-default-metrics-tls
-  name: dns-default
-  namespace: openshift-dns
+  - name: dns
+    port: 53
+    targetPort: dns
+    protocol: UDP
+  - name: dns-tcp
+    port: 53
+    targetPort: dns-tcp
+    protocol: TCP
+  - name: metrics
+    port: 9154
+    targetPort: metrics
+    protocol: TCP