The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point in your pull request via creating an issue comment (i.e. comment on the pull request page) using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

packages/system/coredns/Makefile (1)

10-10: Echoing prior feedback: pin the pulled chart version (1.43.2).
This avoids accidental upstream changes on rebuilds.

packages/apps/kubernetes/templates/helmreleases/coredns.yaml (2)

29-32: Avoid infinite retry loops

Set finite retries to surface persistent failures.

   install:
     createNamespace: true
     remediation:
-      retries: -1
+      retries: 5
   upgrade:
     remediation:
-      retries: -1
+      retries: 5

---

19-19: Pin the chart version to a safe range

Avoid unbounded upgrades from '>= 0.0.0-0'. Pin to a minor range.

-      version: '>= 0.0.0-0'
+      version: '~0.1.0'

packages/system/coredns/charts/coredns/.helmignore (2)

23-23: Reconsider *.tests; it’s non-standard and may be unnecessary.

Helm tests are typically YAML under templates/tests/. Unless you truly generate files with a .tests extension that must be excluded, drop this to avoid surprising ignores.

-*.tests

---

1-23: Add common dev artifacts and chart archives to avoid bloating packages.

Recommend ignoring common local/tooling files and prebuilt chart tarballs.

 # Various IDEs
 .project
 .idea/
 *.tmproj
 OWNERS
-*.tests
+
+# Editors/IDEs
+.vscode/
+*.iml
+
+# Local envs and deps
+node_modules/
+venv/
+.venv/
+.env
+.env.*
+.envrc
+
+# Local override values
+values.local.yaml
+*.local.yaml
+
+# Avoid packaging previously built charts accidentally copied here
+*.tgz

packages/apps/kubernetes/README.md (1)

142-143: Fix casing: CoreDNS.
Use the proper project casing for consistency with other addons.

-| `addons.coredns`                              | Coredns                                                                                                                                                                           | `object`   | `{}`      |
+| `addons.coredns`                              | CoreDNS                                                                                                                                                                           | `object`   | `{}`      |

Optional: add a note that CoreDNS is required/always enabled (only valuesOverride is supported), to avoid confusion versus addons that have an enabled flag.

packages/system/coredns/charts/coredns/templates/NOTES.txt (2)

10-16: LoadBalancer: handle both IP and hostname.

Some clouds expose .hostname instead of .ip. Output both.

-    export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ template "coredns.fullname" . }} -o jsonpath='{.status.loadBalancer.ingress[0].ip}')
-    echo $SERVICE_IP
+    export SERVICE_ADDR=$(kubectl -n {{ .Release.Namespace }} get svc {{ template "coredns.fullname" . }} \
+      -o jsonpath='{.status.loadBalancer.ingress[0].ip}{"\n"}{.status.loadBalancer.ingress[0].hostname}')
+    echo $SERVICE_ADDR

---

4-6: Minor phrasing improvement for user output.

Tighten the sentence.

-CoreDNS is now running in the cluster.
-It can be accessed using the below endpoint
+CoreDNS is now running in the cluster.
+Use the following endpoint:

packages/system/coredns/charts/coredns/README.md (3)

17-18: Fix typos and grammar in deployment modes.

-... exposed outside the cluster by using using either the NodePort or LoadBalancer ...
+... exposed outside the cluster by using either the NodePort or LoadBalancer ...
-This is a sub case of 'external dns service' ...
+This is a subcase of 'external DNS service' ...
-This deployment mode as a dependency on `etcd-operator` chart, which needs to be pre-installed.
+This deployment mode has a dependency on the `etcd-operator` chart, which must be pre-installed.

---

257-259: Correct typos and capitalization in autoscaler section.

-... enabled for Coredns deployment. This can scale number of replicas based on meitrics ...
+... enabled for CoreDNS deployment. This can scale the number of replicas based on metrics ...

---

275-276: Fix minor typos.

-... ensure there are no changes/diffs.s If
+... ensure there are no changes/diffs. If
-... now under management of helm.
+... now under management of Helm.

packages/system/coredns/values.yaml (1)

1-3: Confirm Service CIDR compatibility and IP availability.

Hardcoding 10.95.0.10 requires tenant clusters’ Service CIDR to include and not already use this IP. Consider documenting the constraint inline.

 coredns:
   service:
-    clusterIP: "10.95.0.10"
+    # NOTE: Must be within the tenant cluster Service CIDR and free (not already allocated).
+    # Override per-tenant if your Service CIDR differs.
+    clusterIP: "10.95.0.10"

packages/system/coredns/charts/coredns/templates/serviceaccount-autoscaler.yaml (1)

8-11: Nest customLabels under metadata.labels with nindent for predictable YAML

Make the structure explicit and avoid edge cases where indentation/newline trimming could misplace keys.

-  labels: {{- include "coredns.labels.autoscaler" . | nindent 4 }}
-{{- if .Values.customLabels }}
-{{ toYaml .Values.customLabels | indent 4 }}
-{{- end }}
+  labels:
+    {{- include "coredns.labels.autoscaler" . | nindent 4 }}
+    {{- with .Values.customLabels }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}

packages/system/coredns/charts/coredns/templates/clusterrole-autoscaler.yaml (2)

7-10: Nest customLabels under metadata.labels with nindent

Same rationale as the ServiceAccount: clearer structure and safer rendering.

-  labels: {{- include "coredns.labels.autoscaler" . | nindent 4 }}
-{{- if .Values.customLabels }}
-{{ toYaml .Values.customLabels | indent 4 }}
-{{- end }}
+  labels:
+    {{- include "coredns.labels.autoscaler" . | nindent 4 }}
+    {{- with .Values.customLabels }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}

---

25-29: Update stale GitHub reference in comment

The project moved from kubernetes-incubator to kubernetes-sigs.

-# kubernetes-incubator/cluster-proportional-autoscaler#16
+# kubernetes-sigs/cluster-proportional-autoscaler#16

packages/system/coredns/charts/coredns/tests/clusterrole_test.yaml (2)

13-13: Remove trailing whitespace

Minor formatting cleanup to satisfy linters.

-    pspEnable: true
-    
+    pspEnable: true

---

15-54: Optional: add a negative test for PSP rule when disabled

Guard against regressions by asserting the PSP rule is absent when rbac.pspEnable=false on clusters >=1.25.

Example additional test case:

- it: should not include PSP rule when pspEnable is false
  set:
    rbac:
      pspEnable: false
  asserts:
    - isKind:
        of: ClusterRole
    - notContains:
        path: rules[2].resources
        content: podsecuritypolicies

packages/system/coredns/charts/coredns/tests/servicemonitor_test.yaml (2)

20-23: Nit: Drop unused isClusterService in this test.

ServiceMonitor rendering usually doesn’t depend on isClusterService. Keeping only values that affect the template reduces cognitive load for future readers.

-  isClusterService: true

---

28-65: Add a negative-path test for namespaceSelector omission.

When prometheus.monitor.namespace equals .Release.Namespace, namespaceSelector should not be present. Add a second test to prevent accidental regressions.

+  - it: should omit namespaceSelector when monitor namespace equals release namespace
+    set:
+      deployment:
+        enabled: true
+      prometheus:
+        monitor:
+          enabled: true
+          namespace: default
+    asserts:
+      - notExists:
+          path: spec.namespaceSelector

packages/system/coredns/charts/coredns/tests/clusterrolebinding_autoscaler_test.yaml (1)

7-16: Add “does not render” guards when flags are off.

Ensure the template is gated by both autoscaler.enabled and rbac.create by adding two negative tests.

+  - it: should not render when autoscaler is disabled
+    set:
+      autoscaler:
+        enabled: false
+      rbac:
+        create: true
+    asserts:
+      - hasDocuments:
+          count: 0
+
+  - it: should not render when rbac.create is false
+    set:
+      autoscaler:
+        enabled: true
+      rbac:
+        create: false
+    asserts:
+      - hasDocuments:
+          count: 0

packages/system/coredns/charts/coredns/tests/configmap_test.yaml (1)

6-42: Add a guard for skipConfig=true to avoid accidental ConfigMap renders.

A negative test will ensure deployment.skipConfig effectively disables the ConfigMap.

+  - it: "should not render when skipConfig is true"
+    set:
+      deployment:
+        enabled: true
+        skipConfig: true
+    asserts:
+      - hasDocuments:
+          count: 0

packages/system/coredns/charts/coredns/tests/deployment_test.yaml (2)

22-35: Strengthen tolerations assertion to verify content, not just existence.

Validate that the provided toleration is included to catch template regressions.

       asserts:
-      - exists:
-          path: spec.template.spec.tolerations
+      - contains:
+          path: spec.template.spec.tolerations
+          content:
+            key: CriticalAddonsOnly
+            operator: Exists

---

7-63: Add “deployment.enabled=false” guard test.

Prevents accidental rendering when disabled.

+  - it: should not render deployment when disabled
+    set:
+      deployment:
+        enabled: false
+    template: templates/deployment.yaml
+    asserts:
+      - hasDocuments:
+          count: 0

packages/system/coredns/charts/coredns/templates/clusterrolebinding.yaml (1)

4-7: Add optional metadata.annotations for consistency with other resources.

Other templates/tests support customAnnotations; mirror that here to keep RBAC resources consistent.

 metadata:
   name: {{ template "coredns.clusterRoleName" . }}
   labels: {{- include "coredns.labels" . | nindent 4 }}
+  {{- with .Values.customAnnotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}

packages/system/coredns/charts/coredns/tests/clusterrolebinding_test.yaml (1)

20-52: Good, focused assertions.

Covers kind, naming, roleRef, and subject wiring. Consider adding one label assertion (e.g., app.kubernetes.io/name) to catch regressions in helper labels.

packages/system/coredns/charts/coredns/templates/clusterrolebinding-autoscaler.yaml (2)

7-14: Use nindent for customLabels and keep annotations block consistent.

Minor templating polish: prefer nindent for deterministic leading newline; matches the style used for included labels and annotations.

Apply:

-  labels: {{- include "coredns.labels.autoscaler" . | nindent 4 }}
-{{- if .Values.customLabels }}
-{{ toYaml .Values.customLabels | indent 4 }}
-{{- end }}
+  labels: {{- include "coredns.labels.autoscaler" . | nindent 4 }}
+{{- if .Values.customLabels }}
+{{ toYaml .Values.customLabels | nindent 4 }}
+{{- end }}

---

1-3: YAMLLint false-positive on Go template preamble.

The error at Line 1 is expected for unrendered templates. Exclude chart templates from yamllint or use a relaxed rule-set for Helm templates to avoid noise.

packages/system/coredns/charts/coredns/tests/serviceaccount_autoscaler_test.yaml (1)

24-48: Solid coverage of name/ns/labels/annotations/pullSecrets.

Add a negative test ensuring the SA does not render when autoscaler.enabled=false (same values minus the flag).

packages/system/coredns/charts/coredns/tests/service-metrics_test.yaml (1)

33-82: Nice validation of selector override and metadata.

Optional: assert Service type (defaults to ClusterIP) to catch future accidental changes.

packages/system/coredns/charts/coredns/templates/service-metrics.yaml (3)

35-38: Prefer named targetPort to decouple from container port numbers.

If the container port is named "metrics", target the name for resilience to numeric changes.

   ports:
   - name: metrics
     port: 9153
-    targetPort: 9153
+    targetPort: metrics

---

12-23: Annotation merge guard is fine; keep style consistent.

Good use of or-gate. Consider using nindent consistently (already used) and keep this pattern across templates for readability.

---

1-1: YAMLLint warning is a template parsing false-positive.

Same as other templates: configure yamllint to ignore Helm templates or apply a Helm-aware linter (helm lint/chart-testing) to avoid spurious failures.

packages/system/coredns/charts/coredns/templates/poddisruptionbudget.yaml (1)

18-23: Nit: normalize indentation under matchLabels.

Keys under matchLabels are indented with 8 spaces; the rest of the chart typically uses 2-space steps. Align for consistency.

-    matchLabels:
-        app.kubernetes.io/instance: {{ .Release.Name | quote }}
-        {{- if .Values.isClusterService }}
-        k8s-app: {{ template "coredns.k8sapplabel" . }}
-        {{- end }}
-        app.kubernetes.io/name: {{ template "coredns.name" . }}
+    matchLabels:
+      app.kubernetes.io/instance: {{ .Release.Name | quote }}
+      {{- if .Values.isClusterService }}
+      k8s-app: {{ template "coredns.k8sapplabel" . }}
+      {{- end }}
+      app.kubernetes.io/name: {{ template "coredns.name" . }}

packages/system/coredns/charts/coredns/templates/servicemonitor.yaml (1)

18-22: Render namespaceSelector only when an override is set.

With ne alone, a nil monitor.namespace still triggers a selector to the release namespace. Harmless but noisy; guard with existence.

-  {{- if ne .Values.prometheus.monitor.namespace .Release.Namespace }}
+  {{- if and .Values.prometheus.monitor.namespace (ne .Values.prometheus.monitor.namespace .Release.Namespace) }}
   namespaceSelector:
     matchNames:
     - {{ .Release.Namespace }}
   {{- end }}

packages/system/coredns/charts/coredns/tests/clusterrole-autoscaler_test.yaml (2)

8-41: Add assertions for apiGroups and verbs to harden RBAC expectations

Strengthen the positive case by asserting the empty apiGroup and verbs for the first rule.

       - equal:
         path: rules[0].resources
         value: ["nodes"]
+      - equal:
+          path: rules[0].apiGroups
+          value: [""]
+      - equal:
+          path: rules[0].verbs
+          value: ["list", "watch"]

---

62-62: Add a trailing newline

Fixes the YAMLlint warning.

-          count: 0
+          count: 0
+

packages/apps/kubernetes/templates/helmreleases/coredns.yaml (1)

38-44: Verify lookup-based conditional dependsOn won’t flap

Conditional inclusion of a dependency via lookup can change the rendered spec across reconciliations. If stability matters, consider making the dependency explicit or guarding with a chart value.

Would you like me to refactor this to a values-gated toggle (e.g., addons.core.kubernetesDep.enabled) so dependsOn is deterministic?

packages/apps/kubernetes/values.schema.json (1)

104-121: Nit: capitalize “CoreDNS” in descriptions

Align with upstream naming used elsewhere.

-          "description": "Coredns",
+          "description": "CoreDNS",

packages/system/coredns/charts/coredns/tests/hpa_test.yaml (2)

41-47: Assert autoscaling API version explicitly.

Add an assertion for apiVersion (autoscaling/v2) to avoid regressions if the template switches versions.

       - isKind:
           of: HorizontalPodAutoscaler
+      - equal:
+          path: apiVersion
+          value: autoscaling/v2

---

60-67: Consider covering scaleDown behavior too.

If your template supports behavior.scaleDown, add at least one assertion to catch accidental omissions.

packages/system/coredns/charts/coredns/tests/deployment-autoscaler_test.yaml (1)

18-30: Also verify rollout checksum and serviceAccountName.

These are easy to regress; add assertions for the configmap checksum annotation and serviceAccountName.

     asserts:
       - isKind:
           of: Deployment
       - equal:
           path: metadata.name
           value: RELEASE-NAME-coredns-autoscaler
+      - exists:
+          path: spec.template.metadata.annotations.checksum/configmap
+      - equal:
+          path: spec.template.spec.serviceAccountName
+          value: RELEASE-NAME-coredns-autoscaler
       - equal:
           path: spec.template.spec.containers[0].image
           value: autoscaler:v1.0.0
       - equal:
           path: spec.template.spec.containers[0].imagePullPolicy
           value: IfNotPresent

packages/system/coredns/charts/coredns/tests/service_test.yaml (2)

66-73: Optional: validate at least one port.

If the service template exposes DNS, assert one port exists to catch accidental removals.

       - equal:
           path: spec.clusterIP
           value: 10.96.0.10
+      - exists:
+          path: spec.ports[0]

---

102-109: TrafficDistribution is version-sensitive.

This field is gated by cluster version/feature gates. Consider templating it only when set AND the cluster version supports it; add a unit test that omits it and ensures the field is absent.

packages/system/coredns/charts/coredns/templates/deployment-autoscaler.yaml (1)

45-66: Optional hardening: add pod/container security contexts.

Consider setting runAsNonRoot and seccompProfile to align with cluster-baseline standards.

     spec:
       serviceAccountName: {{ template "coredns.fullname" . }}-autoscaler
+      securityContext:
+        seccompProfile:
+          type: RuntimeDefault
       {{- $priorityClassName := default .Values.priorityClassName .Values.autoscaler.priorityClassName }}
@@
       containers:
       - name: autoscaler
+        securityContext:
+          allowPrivilegeEscalation: false
+          runAsNonRoot: true
+          readOnlyRootFilesystem: true

packages/system/coredns/charts/coredns/values.yaml (1)

282-287: Clarify label/annotation scope.

The note says these apply “Including autoscaler if enabled.” Ensure templates consistently include customLabels/customAnnotations on autoscaler ConfigMap and Deployment metadata/pod template. From the Deployment they’re applied; double-check ConfigMap coverage and add tests if missing.

packages/system/coredns/charts/coredns/templates/configmap-autoscaler.yaml (2)

8-11: Simplify labels/annotations blocks with with; fixes indentation noise and keeps structure tight

Use with blocks to avoid duplicated ifs and reduce YAMLlint noise around indentation under labels/annotations.

-  labels: {{- include "coredns.labels.autoscaler" . | nindent 4 }}
-    {{- if .Values.customLabels }}
-    {{- toYaml .Values.customLabels | nindent 4 }}
-    {{- end }}
+  labels:
+    {{- include "coredns.labels.autoscaler" . | nindent 4 }}
+    {{- with .Values.customLabels }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}

-  {{- if or .Values.autoscaler.configmap.annotations .Values.customAnnotations }}
-  annotations:
-    {{- if .Values.customAnnotations }}
-    {{- toYaml .Values.customAnnotations | nindent 4 }}
-    {{- end }}
-    {{- if .Values.autoscaler.configmap.annotations -}}
-    {{ toYaml .Values.autoscaler.configmap.annotations | nindent 4 }}
-    {{- end }}
-  {{- end }}
+  {{- if or .Values.autoscaler.configmap.annotations .Values.customAnnotations }}
+  annotations:
+    {{- with .Values.customAnnotations }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+    {{- with .Values.autoscaler.configmap.annotations }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+  {{- end }}

Also applies to: 12-20

---

7-7: Nit: remove extra space after colon

Minor whitespace polish; keeps diffs cleaner.

-  namespace:  {{ .Release.Namespace }}
+  namespace: {{ .Release.Namespace }}

packages/system/coredns/charts/coredns/templates/service.yaml (1)

8-11: Align labels/annotations structure

Render labels/annotations under metadata with with blocks for clarity and consistent indentation.

-  labels: {{- include "coredns.labels" . | nindent 4 }}
-{{- if .Values.customLabels }}
-{{ toYaml .Values.customLabels | indent 4 }}
-{{- end }}
+  labels:
+    {{- include "coredns.labels" . | nindent 4 }}
+    {{- with .Values.customLabels }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}

-  {{- if or .Values.service.annotations .Values.customAnnotations }}
-  annotations:
-    {{- if .Values.service.annotations }}
-    {{- toYaml .Values.service.annotations | nindent 4 }}
-    {{- end }}
-    {{- if .Values.customAnnotations }}
-    {{- toYaml .Values.customAnnotations | nindent 4 }}
-    {{- end }}
-  {{- end }}
+  {{- if or .Values.service.annotations .Values.customAnnotations }}
+  annotations:
+    {{- with .Values.service.annotations }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+    {{- with .Values.customAnnotations }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+  {{- end }}

Also applies to: 12-20

packages/system/coredns/charts/coredns/templates/deployment.yaml (1)

55-57: Remove deprecated scheduler.alpha.kubernetes.io/tolerations annotation

This annotation is long-deprecated and has no effect on modern clusters; it can be dropped to reduce noise.

-        {{- if .Values.isClusterService }}
-        scheduler.alpha.kubernetes.io/tolerations: '[{"key":"CriticalAddonsOnly", "operator":"Exists"}]'
-        {{- end }}

If you still need CriticalAddonsOnly semantics, rely on PriorityClass and tolerations fields instead.

packages/system/coredns/charts/coredns/templates/_helpers.tpl (1)

66-133: Map mutation style is correct but overuses :=; streamline to avoid shadowing

set mutates in place; repeated := rebinds new locals and is confusing. Using = (or calling set without reassignment) is clearer.

Example refactor (pattern):

-{{- $ports := set $ports $port (dict "istcp" false "isudp" false "serviceport" $serviceport) -}}
+{{- $ports = set $ports $port (dict "istcp" false "isudp" false "serviceport" $serviceport) -}}

Apply similarly to later $ports/$innerdict reassignments in both servicePorts and containerPorts.

Also applies to: 138-214

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

💡 Knowledge Base configuration:

• MCP integration is disabled by default for public repositories
• Jira integration is disabled by default for public repositories
• Linear integration is disabled by default for public repositories

You can enable these sources in your CodeRabbit configuration.

packages/system/coredns/charts/coredns/README.md (1)

41-46: Version mismatch with vendored chart (use 1.43.2 or omit pin).

The OCI example pins 1.38.0, but the vendored Chart.yaml declares version 1.43.2 (appVersion 1.12.3). Align to avoid confusion.

-```console
-$ helm --namespace=kube-system install coredns oci://ghcr.io/coredns/charts/coredns --version 1.38.0
-```
-
-The command deploys the `1.38.0` version of CoreDNS on the Kubernetes cluster in the default configuration.
+```console
+$ helm --namespace=kube-system install coredns oci://ghcr.io/coredns/charts/coredns --version 1.43.2
+```
+
+The command deploys the `1.43.2` version of CoreDNS on the Kubernetes cluster in the default configuration.

Alternatively, drop --version and add a note that it pulls the latest.

packages/system/coredns/Makefile (1)

6-10: Pin chart version, add PHONY/all/clean/test, and make update idempotent.

Prevents surprise upgrades, satisfies checkmake warnings, and avoids failures if the repo already exists.

+SHELL := bash
+.PHONY: all update clean test
+CHART_NAME     ?= coredns
+CHART_REPO     ?= cozy-coredns
+CHART_REPO_URL ?= https://coredns.github.io/helm
+CHART_VERSION  ?= 1.43.2
+
 export NAME=coredns
 export NAMESPACE=coredns
 
 include ../../../scripts/package.mk
 
-update:
-	rm -rf charts
-	helm repo add cozy-coredns https://coredns.github.io/helm
-	helm repo update cozy-coredns
-	helm pull cozy-coredns/coredns --untar --untardir charts
+all: update
+
+update:
+	rm -rf charts
+	-helm repo add $(CHART_REPO) $(CHART_REPO_URL)
+	helm repo update
+	helm pull $(CHART_REPO)/$(CHART_NAME) --version $(CHART_VERSION) --untar --untardir charts
+
+clean:
+	rm -rf charts
+
+test:
+	helm lint .

packages/apps/kubernetes/templates/helmreleases/delete.yaml (1)

44-45: Added CoreDNS to suspend list – resolved.
Including {{ .Release.Name }}-coredns in the pre-delete patch list addresses earlier feedback.

packages/system/coredns/charts/coredns/templates/NOTES.txt (1)

6-19: Use exact equality for serviceType, and drop namespace on kubectl get nodes.
Avoid substring matches and fix cluster-scoped resource query.

-{{- if contains "NodePort" .Values.serviceType }}
+{{- if eq .Values.serviceType "NodePort" }}
   export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ template "coredns.fullname" . }})
-  export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}")
+  export NODE_IP=$(kubectl get nodes -o jsonpath="{.items[0].status.addresses[0].address}")
   echo "$NODE_IP:$NODE_PORT"
-{{- else if contains "LoadBalancer" .Values.serviceType }}
+{{- else if eq .Values.serviceType "LoadBalancer" }}
   NOTE: It may take a few minutes for the LoadBalancer IP to be available.
         You can watch the status by running 'kubectl get svc -w {{ template "coredns.fullname" . }}'
 
     export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ template "coredns.fullname" . }} -o jsonpath='{.status.loadBalancer.ingress[0].ip}')
     echo $SERVICE_IP
-{{- else if contains "ClusterIP"  .Values.serviceType }}
+{{- else if eq .Values.serviceType "ClusterIP" }}
     "{{ template "coredns.fullname" . }}.{{ .Release.Namespace }}.svc.cluster.local"
     from within the cluster

packages/apps/kubernetes/templates/helmreleases/coredns.yaml (2)

35-38: Avoid infinite remediation retries.
Use finite retries to surface persistent failures.

-    remediation:
-      retries: -1
+    remediation:
+      retries: 5
---
-  upgrade:
-    remediation:
-      retries: -1
+  upgrade:
+    remediation:
+      retries: 5

---

25-25: Chart version constraint is too permissive; pin to a safe range.
Avoid accidental breaking upgrades.

-      version: '>= 0.0.0-0'
+      version: '~0.1.x'

packages/system/coredns/charts/coredns/templates/_helpers.tpl (1)

185-193: Prometheus port parsing can panic; make it len-safe and numeric-only.
Current code indexes [1] unconditionally; fails for "9153" or malformed values.

-        {{- range .plugins -}}
-            {{- if eq .name "prometheus" -}}
-                {{- $prometheus_addr := toString .parameters -}}
-                {{- $prometheus_addr_list := regexSplit ":" $prometheus_addr -1 -}}
-                {{- $prometheus_port := index $prometheus_addr_list 1 -}}
-                {{- $ports := set $ports $prometheus_port (dict "istcp" true "isudp" false) -}}
-            {{- end -}}
-        {{- end -}}
+        {{- range .plugins -}}
+            {{- if eq .name "prometheus" -}}
+                {{- $addr := toString .parameters -}}
+                {{- $parts := regexSplit ":" $addr -1 -}}
+                {{- $p := "" -}}
+                {{- if ge (len $parts) 2 -}}
+                    {{- $p = index $parts 1 -}}
+                {{- else -}}
+                    {{- $p = index $parts 0 -}}
+                {{- end -}}
+                {{- if regexMatch "^[0-9]+$" $p -}}
+                    {{- $ports = set $ports $p (dict "istcp" true "isudp" false) -}}
+                {{- end -}}
+            {{- end -}}
+        {{- end -}}

packages/system/coredns/charts/coredns/templates/hpa.yaml (1)

27-32: Guard empty metrics block; bare metrics: yields invalid YAML when unset.

Wrap metrics: emission in a conditional. This mirrors the prior review comment.

-  metrics:
-{{ toYaml .Values.hpa.metrics | indent 4 }}
+{{- if .Values.hpa.metrics }}
+  metrics:
+{{ toYaml .Values.hpa.metrics | indent 4 }}
+{{- end }}

packages/system/coredns/charts/coredns/templates/poddisruptionbudget.yaml (2)

1-1: Gate on the boolean flag, not map existence.

Render only when podDisruptionBudget.enabled is true.

-{{- if and .Values.deployment.enabled .Values.podDisruptionBudget -}}
+{{- if and .Values.deployment.enabled (.Values.podDisruptionBudget.enabled | default false) -}}

---

15-25: Do not emit unsupported keys; omit enabled/selector from spec map.

Avoid duplicating selector and leaking enabled into spec.

 spec:
   {{- if not .Values.podDisruptionBudget.selector }}
   selector:
     matchLabels:
         app.kubernetes.io/instance: {{ .Release.Name | quote }}
         {{- if .Values.isClusterService }}
         k8s-app: {{ template "coredns.k8sapplabel" . }}
         {{- end }}
         app.kubernetes.io/name: {{ template "coredns.name" . }}
   {{- end }}
-{{ toYaml .Values.podDisruptionBudget | indent 2 }}
+{{- toYaml (omit .Values.podDisruptionBudget "enabled" "selector") | indent 2 }}

packages/system/coredns/charts/coredns/templates/configmap.yaml (2)

19-21: Deterministic ordering for extraConfig (avoid map iteration nondeterminism).

Sort keys to stabilize Corefile and tests.

-    {{- range $name, $conf := .Values.extraConfig }}
-    {{ $name }}{{ if $conf.parameters }} {{ $conf.parameters }}{{ end }}
-    {{- end }}
+    {{- range $name := keys .Values.extraConfig | sortAlpha }}
+    {{- $conf := index $.Values.extraConfig $name -}}
+    {{ $name }}{{ if $conf.parameters }} {{ $conf.parameters }}{{ end }}
+    {{- end }}

---

33-35: Emit zoneFiles as block scalars to preserve multiline content.

Prevents malformed YAML.

-  {{- range .Values.zoneFiles }}
-  {{ .filename }}: {{ toYaml .contents | indent 4 }}
-  {{- end }}
+  {{- range .Values.zoneFiles }}
+  {{ .filename }}: |-
+{{ .contents | nindent 4 }}
+  {{- end }}

packages/system/coredns/charts/coredns/templates/serviceaccount.yaml (2)

7-10: customLabels must be nested under metadata.labels.

Same issue previously flagged.

-  labels: {{- include "coredns.labels" . | nindent 4 }}
-{{- if .Values.customLabels }}
-{{ toYaml .Values.customLabels | indent 4 }}
-{{- end }}
+  labels:
+    {{- include "coredns.labels" . | nindent 4 }}
+    {{- with .Values.customLabels }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}

---

11-19: Merge annotations once to avoid duplicate keys and define precedence.

Build a single map (custom overrides SA annotations).

-  {{- if or .Values.serviceAccount.annotations .Values.customAnnotations }}
-  annotations:
-    {{- if .Values.customAnnotations }}
-    {{- toYaml .Values.customAnnotations | nindent 4 }}
-    {{- end }}
-    {{- if .Values.serviceAccount.annotations }}
-    {{- toYaml .Values.serviceAccount.annotations | nindent 4 }}
-    {{- end }}
-  {{- end }}
+  {{- $ann := dict -}}
+  {{- with .Values.serviceAccount.annotations }}{{- $_ := merge $ann . -}}{{- end }}
+  {{- with .Values.customAnnotations }}{{- $_ := merge $ann . -}}{{- end }}
+  {{- if $ann }}
+  annotations:
+    {{- toYaml $ann | nindent 4 }}
+  {{- end }}

packages/system/coredns/charts/coredns/templates/clusterrole.yaml (2)

15-24: Add 'get' to verbs for core resources.

Commonly required for initial reads; improves portability.

   verbs:
-  - list
-  - watch
+  - get
+  - list
+  - watch

---

23-24: Add 'get' to verbs for endpointslices.

Align with core resources.

   verbs:
-  - list
-  - watch
+  - get
+  - list
+  - watch

packages/system/coredns/charts/coredns/templates/deployment-autoscaler.yaml (1)

39-41: Remove deprecated scheduler.alpha tolerations annotation.

This legacy annotation is long-deprecated; rely on spec.tolerations only.

       annotations:
         checksum/configmap: {{ include (print $.Template.BasePath "/configmap-autoscaler.yaml") . | sha256sum }}
-        {{- if .Values.isClusterService }}
-        scheduler.alpha.kubernetes.io/tolerations: '[{"key":"CriticalAddonsOnly", "operator":"Exists"}]'
-        {{- end }}
         {{- with .Values.autoscaler.podAnnotations }}
         {{- toYaml . | nindent 8 }}
         {{- end }}

packages/system/coredns/charts/coredns/templates/service.yaml (2)

54-54: Prefer .Values.service.type with fallback to serviceType for schema consistency.

Coalesce to the new location while retaining backward compatibility.

-  type: {{ default "ClusterIP" .Values.serviceType }}
+  type: {{ default "ClusterIP" (coalesce .Values.service.type .Values.serviceType) }}

---

58-61: Bug: trafficDistribution is rendered outside Service.spec and outside the guard.

Move inside spec and before the closing end.

-{{- end }}
-  {{- if .Values.service.trafficDistribution }}
-  trafficDistribution: {{ .Values.service.trafficDistribution }}
-  {{- end }}
+  {{- if .Values.service.trafficDistribution }}
+  trafficDistribution: {{ .Values.service.trafficDistribution }}
+  {{- end }}
+{{- end }}

packages/system/coredns/charts/coredns/templates/deployment.yaml (1)

169-169: Fix defaultMode for secret volume (decimal vs octal).

Kubernetes expects decimal for file modes; 400 is interpreted as 0620. Use 256 (0400) or 420 (0644). Recommend 256 for secrets.

-            defaultMode: {{ default 400 .defaultMode }}
+            defaultMode: {{ default 256 .defaultMode }}

packages/system/coredns/charts/coredns/README.md (11)

16-19: Fix grammar/clarity in deployment modes.

Tighten wording, fix duplication, and minor grammar.

- CoreDNS as a cluster dns service and a drop-in replacement for Kube/SkyDNS. This is the default mode and CoreDNS is deployed as cluster-service in kube-system namespace. This mode is chosen by setting `isClusterService` to true.
+ CoreDNS as a cluster DNS service and a drop-in replacement for kube-dns/SkyDNS. This is the default mode and CoreDNS is deployed as a cluster service in the kube-system namespace. Enable by setting `isClusterService` to true.
- CoreDNS as an external dns service. In this mode CoreDNS is deployed as any kubernetes app in user specified namespace. The CoreDNS service can be exposed outside the cluster by using using either the NodePort or LoadBalancer type of service. This mode is chosen by setting `isClusterService` to false.
+ CoreDNS as an external DNS service. In this mode, CoreDNS is deployed like any Kubernetes app in a user‑specified namespace. Expose it via a Service of type NodePort or LoadBalancer. Enable by setting `isClusterService` to false.
- CoreDNS as an external dns provider for kubernetes federation. This is a sub case of 'external dns service' which uses etcd plugin for CoreDNS backend. This deployment mode as a dependency on `etcd-operator` chart, which needs to be pre-installed.
+ CoreDNS as an external DNS provider for Kubernetes federation. This is a special case of “external DNS service” that uses the etcd plugin as a backend. This deployment mode has a dependency on an etcd operator/cluster, which must be pre‑installed.

---

28-31: Clarify local (vendored) vs remote install to avoid confusion.

Since this chart is vendored in-repo, add an explicit example for installing from the local path.

 The chart can be installed as follows:
 
 ```console
 $ helm repo add coredns https://coredns.github.io/helm
 $ helm --namespace=kube-system install coredns coredns/coredns

+Alternatively, from this repository’s vendored chart:
+
+console +$ cd packages/system/coredns/charts/coredns +$ helm --namespace=kube-system install coredns . +

---

`37-43`: **Rename section and fix OCI example heading.**

Small wording tweak.


```diff
-## OCI installing
+## Installing from OCI

---

63-77: Make helm-unittest invocation path-agnostic.

Use “.” so commands work when run from the chart directory.

-Run all unit tests in the chart folder (e.g., `./coredns`):
+Run all unit tests in the chart folder:
 
 ```bash
-helm unittest ./coredns
+helm unittest .

To output results in JUnit XML format:

mkdir -p test-results
helm unittest --strict \
  --output-type JUnit \
  --output-file test-results/helm-unittest-report.xml \
-  ./coredns
+  .

---

`83-88`: **Template command works better with “.” from chart root.**


```diff
-helm template ./coredns  --debug
+helm template . --debug

---

167-170: Minor formatting/copyedit in Configuration table.

-| `env`                                          | Optional array of environment variables for CoreDNS container                                                                           | []                                                           |
+| `env`                                          | Optional array of environment variables for the CoreDNS container                                                                         | []                                                           |
-| `customAnnotations`                            | Optional annotations for Deployment(s), Pod, Service, ServiceMonitor objects                                                              |
+| `customAnnotations`                            | Optional annotations for Deployment(s), Pod, Service, ServiceMonitor objects                                                              | {}                                                           |

Note: Add {} default for consistency if values.yaml defines it.

---

242-260: Fix typos and casing in Autoscaling section.

-By setting `autoscaler.enabled = true` a
+By setting `autoscaler.enabled = true`, a
@@
-This will default to a coredns replica for every 256 cores, or
+This defaults to a CoreDNS replica for every 256 cores, or
@@
-and `autoscaler.nodesPerReplica`. When cluster is using large nodes (with more
-cores), `coresPerReplica` should dominate. If using small nodes,
+and `autoscaler.nodesPerReplica`. When the cluster is using large nodes (with more
+cores), `coresPerReplica` should dominate. If using small nodes,
 `nodesPerReplica` should dominate.
@@
-By setting `hpa.enabled = true` a [Horizontal Pod Autoscaler](https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale/)
-is enabled for Coredns deployment. This can scale number of replicas based on meitrics
-like CpuUtilization, MemoryUtilization or Custom ones.
+By setting `hpa.enabled = true`, a [Horizontal Pod Autoscaler](https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale/)
+is enabled for the CoreDNS deployment. This can scale the number of replicas based on metrics
+like CPUUtilization, MemoryUtilization, or custom metrics.

---

229-231: Fix values.yaml link to work in this repo.

Absolute “/charts/…” likely 404s here. Use a relative link.

-> **Tip**: You can use the default [values.yaml](/charts/coredns/values.yaml)
+> **Tip**: You can use the default [values.yaml](./values.yaml)

---

275-283: Fix typo and tighten wording in adoption notes.

-Once you have annotated and labeled all the resources this chart specifies, you may need to locally template the chart and compare against existing manifest to ensure there are no changes/diffs.s If
-you have been careful this should not diff and leave all the resources unmodified and now under management of helm.
+Once you have annotated and labeled all resources this chart specifies, locally template the chart and compare against existing manifests to ensure there are no diffs. If
+you have been careful, this should not change resources and they will now be managed by Helm.

---

290-291: Kubernetes kind capitalization.

-This will delete the deployment and leave the replicaset to ensure no downtime in the cluster. You will need to manually delete the replicaset AFTER Helm has released a new deployment.
+This deletes the Deployment and leaves the ReplicaSet to ensure no downtime in the cluster. Manually delete the ReplicaSet after Helm has created a new Deployment.

---

7-10: Optional: Explicitly note Flux/HelmRelease usage in this repo.

Given this repo deploys via Flux HelmRelease, add a short note so readers don’t assume manual helm install is the primary path.

 ```console
 $ helm repo add coredns https://coredns.github.io/helm
 $ helm --namespace=kube-system install coredns coredns/coredns

+Note: In CozyStack, CoreDNS is deployed via Flux using a HelmRelease; manual helm commands here are for local testing only.

</blockquote></details>
<details>
<summary>packages/system/coredns/Makefile (2)</summary><blockquote>

`1-2`: **Prefer overridable vars for NAME/NAMESPACE.**

Keeps defaults while allowing `make NAME=...`.


```diff
-export NAME=coredns
-export NAMESPACE=coredns
+NAME ?= coredns
+NAMESPACE ?= coredns
+export NAME NAMESPACE

---

10-10: Optional: enable provenance verification of the pulled chart.

Gate --verify behind a flag.

+VERIFY ?=
@@
-	helm pull $(CHART_REPO)/$(CHART_NAME) --version $(CHART_VERSION) --untar --untardir charts
+	helm pull $(CHART_REPO)/$(CHART_NAME) --version $(CHART_VERSION) $(VERIFY) --untar --untardir charts

packages/apps/kubernetes/templates/helmreleases/coredns.yaml (1)

1-5: Move template define into helpers to avoid YAML lint errors and reuse.
Place cozystack.defaultCoreDNSValues in a helpers tpl; keep this file pure YAML.

-{{- define "cozystack.defaultCoreDNSValues" -}}
-coredns:
-  service:
-    clusterIP: "10.95.0.10"
-{{- end }}
+

And add to a helpers file (e.g., packages/apps/kubernetes/templates/helmreleases/_helpers.tpl):

{{- define "cozystack.defaultCoreDNSValues" -}}
coredns:
  service:
    clusterIP: "10.95.0.10"
{{- end -}}

Confirm 10.95.0.10 is inside the tenant cluster Service CIDR and does not collide with existing Services.

packages/system/coredns/charts/coredns/templates/_helpers.tpl (1)

227-236: Comment header mismatch (cluster role vs service account).
Minor docs fix to avoid confusion.

-{{/*
-Create the name of the service account to use
-*/}}
+{{/*
+Create the name of the ClusterRole to use
+*/}}

packages/system/coredns/charts/coredns/templates/service-metrics.yaml (1)

35-38: Parameterize metrics port to avoid hard-coding 9153.

Expose overrides and keep 9153 as default. Also allow changing targetPort independently.

   ports:
   - name: metrics
-    port: 9153
-    targetPort: 9153
+    port: {{ default 9153 .Values.prometheus.service.port }}
+    targetPort: {{ default 9153 .Values.prometheus.service.targetPort }}

packages/system/coredns/charts/coredns/templates/serviceaccount-autoscaler.yaml (2)

12-15: Support merging annotations from serviceAccount scope; keep custom last.

Align with common chart conventions: merge .Values.serviceAccount.annotations (or an autoscaler-scoped variant) with .Values.customAnnotations, with custom taking precedence.

-{{- with .Values.customAnnotations }}
-  annotations:
-{{- toYaml . | nindent 4 }}
-{{- end }}
+{{- $ann := dict -}}
+{{- if .Values.serviceAccount.annotations -}}
+{{-   $ann = merge $ann .Values.serviceAccount.annotations -}}
+{{- end -}}
+{{- if .Values.customAnnotations -}}
+{{-   $ann = merge $ann .Values.customAnnotations -}}
+{{- end -}}
+{{- if $ann }}
+  annotations:
+{{ toYaml $ann | nindent 4 }}
+{{- end }}

---

6-7: Allow overriding SA name for autoscaler.

Make the autoscaler ServiceAccount name configurable.

-  name: {{ template "coredns.fullname" . }}-autoscaler
+  name: {{ default (printf "%s-autoscaler" (include "coredns.fullname" .)) .Values.autoscaler.serviceAccount.name }}

packages/system/coredns/charts/coredns/tests/poddisruptionbudget_test.yaml (1)

25-62: Add negative and toggle tests to harden coverage.

Include cases for: disabled deployment (no PDB rendered) and when podDisruptionBudget.maxUnavailable is unset (no PDB or default behavior).

packages/system/coredns/charts/coredns/tests/clusterrole_test.yaml (3)

13-13: Remove trailing whitespace.

Line 13 contains trailing spaces. Drop them to satisfy linters.

-    
+

---

36-53: PSP assertions are brittle across Kubernetes versions; guard by capability or split tests.

PSP is removed since Kubernetes 1.25. If the template rightly gates PSP RBAC by capability, this test should either:

• set capabilities to include PodSecurityPolicy, or
• move PSP checks to a separate test gated by a value like rbac.pspEnable and/or cluster capabilities.

Otherwise this suite will fail on modern clusters despite correct templates.

---

18-22: Also assert apiVersion for RBAC resources.

Add an apiVersion assertion to tighten the contract.

       - isKind:
           of: ClusterRole
+      - equal:
+          path: apiVersion
+          value: rbac.authorization.k8s.io/v1

packages/system/coredns/charts/coredns/templates/clusterrolebinding.yaml (1)

4-15: LGTM; consider adding optional annotations and merging customLabels under metadata.labels (parity with other templates).

Current rendering is correct. For consistency with autoscaler resources and to allow per-install labeling/annotations, merge customLabels into labels and add optional annotations.

 metadata:
   name: {{ template "coredns.clusterRoleName" . }}
-  labels: {{- include "coredns.labels" . | nindent 4 }}
+  labels:
+    {{- include "coredns.labels" . | nindent 4 }}
+    {{- with .Values.customLabels }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+  {{- with .Values.customAnnotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}

packages/system/coredns/charts/coredns/tests/clusterrole-autoscaler_test.yaml (1)

62-62: Add trailing newline.

Keeps linters and some tooling happy.

-          count: 0
+          count: 0
+

packages/system/coredns/charts/coredns/templates/deployment-autoscaler.yaml (1)

71-73: Guard empty resources to avoid rendering an empty/null map.

Avoid emitting a dangling "resources:" when values are unset.

-        resources:
-{{ toYaml .Values.autoscaler.resources | indent 10 }}
+        {{- if .Values.autoscaler.resources }}
+        resources:
+{{ toYaml .Values.autoscaler.resources | indent 10 }}
+        {{- end }}

packages/system/coredns/charts/coredns/templates/deployment.yaml (1)

61-94: Optional: guard empty resources to prevent dangling keys.

Minor hygiene improvement; consistent with autoscaler suggestion.

-        resources:
-{{ toYaml .Values.resources | indent 10 }}
+        {{- if .Values.resources }}
+        resources:
+{{ toYaml .Values.resources | indent 10 }}
+        {{- end }}

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

💡 Knowledge Base configuration:

• MCP integration is disabled by default for public repositories
• Jira integration is disabled by default for public repositories
• Linear integration is disabled by default for public repositories

You can enable these sources in your CodeRabbit configuration.