66 lines
1.9 KiB
YAML
66 lines
1.9 KiB
YAML
# Production-specific values for unbound DNS resolver
|
|
# Overrides for the production environment
|
|
#
|
|
# ARCHITECTURE NOTE:
|
|
# Unbound provides DNSSEC validation required by Mailu (rspamd for DKIM/SPF/DMARC).
|
|
# CoreDNS does NOT support DNSSEC, so we need Unbound as a dedicated resolver.
|
|
#
|
|
# Two deployment options:
|
|
# 1. Mailu-only: Only Mailu pods use Unbound (via dnsPolicy: None)
|
|
# - CoreDNS forwards to public DNS (8.8.8.8, 1.1.1.1)
|
|
# - Lower resource usage, simpler architecture
|
|
#
|
|
# 2. Cluster-wide: CoreDNS forwards ALL external queries to Unbound
|
|
# - All pods get DNSSEC validation
|
|
# - Higher resource usage, single point of failure for DNS
|
|
|
|
# Use official image for production
|
|
image:
|
|
repository: "mvance/unbound"
|
|
tag: "latest"
|
|
pullPolicy: "IfNotPresent"
|
|
|
|
# Production resource settings - MINIMAL for single-node clusters
|
|
# Unbound is very lightweight - DNS queries use minimal CPU
|
|
resources:
|
|
requests:
|
|
cpu: "50m"
|
|
memory: "64Mi"
|
|
limits:
|
|
cpu: "200m"
|
|
memory: "256Mi"
|
|
|
|
# Single replica for single-node clusters (saves resources)
|
|
# Increase to 2 for multi-node HA deployments
|
|
replicaCount: 1
|
|
|
|
# Production annotations
|
|
podAnnotations:
|
|
environment: "production"
|
|
critical: "true"
|
|
|
|
# Anti-affinity disabled for single-node clusters
|
|
# Uncomment for multi-node HA deployments
|
|
# affinity:
|
|
# podAntiAffinity:
|
|
# preferredDuringSchedulingIgnoredDuringExecution:
|
|
# - weight: 100
|
|
# podAffinityTerm:
|
|
# labelSelector:
|
|
# matchExpressions:
|
|
# - key: app.kubernetes.io/name
|
|
# operator: In
|
|
# values:
|
|
# - unbound
|
|
# topologyKey: "kubernetes.io/hostname"
|
|
|
|
# Production probe settings (more conservative)
|
|
probes:
|
|
readiness:
|
|
initialDelaySeconds: 10
|
|
periodSeconds: 30
|
|
command: "sh -c 'echo \"\" | nc -w 3 127.0.0.1 53 || exit 1'"
|
|
liveness:
|
|
initialDelaySeconds: 30
|
|
periodSeconds: 60
|
|
command: "sh -c 'echo \"\" | nc -w 3 127.0.0.1 53 || exit 1'" |