events.action: opened
events.author: nberlee
events.text: <!--  Thanks for sending a pull request!  Here are some tips for you:
  1. If this is your first time, read our contributor guidelines https://git.k8s.io/community/contributors/guide#your-first-contribution and developer guide https://git.k8s.io/community/contributors/devel/development.md#development-guide
  2. If you want *faster* PR reviews, read how: https://git.k8s.io/community/contributors/guide/pull-requests.md#best-practices-for-faster-reviews
  3. Follow the instructions for writing a release note: https://git.k8s.io/community/contributors/guide/release-notes.md
  4. If the PR is unfinished, see how to mark it: https://git.k8s.io/community/contributors/guide/pull-requests.md#marking-unfinished-pull-requests
  -->
  
  **What this PR does / why we need it**: Make the CoreDNS container more secure by dropping (root) capabilities. Improve the integrity of the of the container by running the whole container in read-only.
  
  **Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
  Fixes #
  
  **Special notes for your reviewer**:
  Same [changes](https://github.com/coredns/deployment/commit/aba0245609821e8bba8b4ecd6a32c1a02a7bf658) as in the CoreDNS deployment repository.
  **Release note**:
  <!--  Write your release note:
  1. Enter your extended release note in the below block. If the PR requires additional action from users switching to the new release, include the string "action required".
  2. If no release note is required, just write "NONE".
  -->
  ```release-note
  NONE
  ```
events.title: Drop capabilities of CoreDNS container and run in read-only
events.type: issue
events.action: created
events.author: stealthybox
events.text: Thanks for this change @nberlee
  
  I'm running a local kubeadm build now to validate the change
events.type: comment
events.action: created
events.author: nberlee
events.text: thx @stealthybox, I will add a release note
events.type: comment
events.action: created
events.author: stealthybox
events.text: /assign @fabriziopandini @bowei
  PTAL
events.type: comment
events.action: created
events.author: nberlee
events.text: /test pull-kubernetes-e2e-kops-aws
  /test pull-kubernetes-kubemark-e2e-gce
events.type: comment
events.action: created
events.author: nberlee
events.text: /test pull-kubernetes-e2e-kops-aws
  /test pull-kubernetes-kubemark-e2e-gce
events.type: comment
events.action: created
events.author: fabriziopandini
events.text: Thanks @nberlee for your contribution!
  Thanks @stealthybox for testing this
  
  I'm ok with the change (it mirrors the [sample deployment](https://github.com/coredns/deployment/blob/aba0245609821e8bba8b4ecd6a32c1a02a7bf658/kubernetes/coredns.yaml.sed#L108) in the core dns repo); I let the final approval to the owners of `cluster` folder
  /lgmt
  /cc @roberthbailey
events.type: comment
events.action: created
events.author: roberthbailey
events.text: /lgtm
events.type: comment
events.action: created
events.author: fabriziopandini
events.text: /lgtm
  /approve
events.type: comment
events.action: created
events.author: roberthbailey
events.text: /lgtm
events.type: comment
events.action: created
events.author: roberthbailey
events.text: /milestone v1.11
events.type: comment
data_with_bots.bot: [APPROVALNOTIFIER] This PR is **NOT APPROVED**
  
  This pull-request has been approved by: *<a href="https://github.com/kubernetes/kubernetes/pull/64473#" title="Author self-approved">nberlee</a>*, *<a href="https://github.com/kubernetes/kubernetes/pull/64473#issuecomment-392940478" title="LGTM">stealthybox</a>*
  To fully approve this pull request, please assign additional approvers.
  We suggest the following additional approvers: **bowei**, **timothysc**
  
  Assign the PR to them by writing `/assign @bowei @timothysc` in a comment when ready.
  
  The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands).
  
  The pull request process is described [here](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process)
  
  <details open>
  Needs approval from an approver in each of these files:
  
  - **[cluster/addons/dns/OWNERS](https://github.com/kubernetes/kubernetes/blob/master/cluster/addons/dns/OWNERS)**
  - **[cmd/kubeadm/OWNERS](https://github.com/kubernetes/kubernetes/blob/master/cmd/kubeadm/OWNERS)**
  
  Approvers can indicate their approval by writing `/approve` in a comment
  Approvers can cancel approval by writing `/approve cancel` in a comment
  </details>
  <!-- META={"approvers":["bowei","timothysc"]} -->
data_with_bots.meta: This message directly preceded comment from bot *k8s-ci-robot* by author *stealthybox*:
data_with_bots.text: Thanks for this change @nberlee
  
  I'm running a local kubeadm build now to validate the change
data_with_bots.bot: @nberlee: The following test **failed**, say `/retest` to rerun them all:
  
  Test name | Commit | Details | Rerun command
  --- | --- | --- | ---
  pull-kubernetes-e2e-kops-aws | 4dd193315bad7cf212b3308c687363d1de17a62f | [link](https://k8s-gubernator.appspot.com/build/kubernetes-jenkins/pr-logs/pull/64473/pull-kubernetes-e2e-kops-aws/91401/) | `/test pull-kubernetes-e2e-kops-aws`
  
  [Full PR test history](https://k8s-gubernator.appspot.com/pr/64473). [Your PR dashboard](https://k8s-gubernator.appspot.com/pr/nberlee). Please help us cut down on flakes by [linking to](https://git.k8s.io/community/contributors/devel/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/kubernetes/kubernetes/issues?q=is:issue+is:open) when you hit one in your PR.
  
  <details>
  
  Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
  </details>
  <!-- test report -->
data_with_bots.meta: This message directly preceded comment from bot *k8s-ci-robot* by author *stealthybox*:
data_with_bots.text: /assign @fabriziopandini @bowei
  PTAL
data_with_bots.bot: @nberlee: The following tests **failed**, say `/retest` to rerun them all:
  
  Test name | Commit | Details | Rerun command
  --- | --- | --- | ---
  pull-kubernetes-kubemark-e2e-gce | 4dd193315bad7cf212b3308c687363d1de17a62f | [link](https://k8s-gubernator.appspot.com/build/kubernetes-jenkins/pr-logs/pull/64473/pull-kubernetes-kubemark-e2e-gce/92968/) | `/test pull-kubernetes-kubemark-e2e-gce`
  pull-kubernetes-e2e-kops-aws | 4dd193315bad7cf212b3308c687363d1de17a62f | [link](https://k8s-gubernator.appspot.com/build/kubernetes-jenkins/pr-logs/pull/64473/pull-kubernetes-e2e-kops-aws/91425/) | `/test pull-kubernetes-e2e-kops-aws`
  
  [Full PR test history](https://k8s-gubernator.appspot.com/pr/64473). [Your PR dashboard](https://k8s-gubernator.appspot.com/pr/nberlee). Please help us cut down on flakes by [linking to](https://git.k8s.io/community/contributors/devel/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/kubernetes/kubernetes/issues?q=is:issue+is:open) when you hit one in your PR.
  
  <details>
  
  Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
  </details>
  <!-- test report -->
data_with_bots.meta: This message directly preceded comment from bot *k8s-ci-robot* by author *nberlee*:
data_with_bots.text: /test pull-kubernetes-e2e-kops-aws
  /test pull-kubernetes-kubemark-e2e-gce
data_with_bots.bot: [APPROVALNOTIFIER] This PR is **NOT APPROVED**
  
  This pull-request has been approved by: *<a href="https://github.com/kubernetes/kubernetes/pull/64473#" title="Author self-approved">nberlee</a>*, *<a href="https://github.com/kubernetes/kubernetes/pull/64473#issuecomment-393051560" title="LGTM">roberthbailey</a>*, *<a href="https://github.com/kubernetes/kubernetes/pull/64473#issuecomment-392940478" title="LGTM">stealthybox</a>*
  To fully approve this pull request, please assign additional approvers.
  We suggest the following additional approver: **fabriziopandini**
  
  Assign the PR to them by writing `/assign @fabriziopandini` in a comment when ready.
  
  The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands).
  
  The pull request process is described [here](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process)
  
  <details open>
  Needs approval from an approver in each of these files:
  
  - ~~[cluster/addons/dns/OWNERS](https://github.com/kubernetes/kubernetes/blob/master/cluster/addons/dns/OWNERS)~~ [roberthbailey]
  - **[cmd/kubeadm/OWNERS](https://github.com/kubernetes/kubernetes/blob/master/cmd/kubeadm/OWNERS)**
  
  Approvers can indicate their approval by writing `/approve` in a comment
  Approvers can cancel approval by writing `/approve cancel` in a comment
  </details>
  <!-- META={"approvers":["fabriziopandini"]} -->
data_with_bots.meta: This message directly preceded comment from bot *k8s-ci-robot* by author *roberthbailey*:
data_with_bots.text: /lgtm
data_with_bots.bot: [APPROVALNOTIFIER] This PR is **APPROVED**
  
  This pull-request has been approved by: *<a href="https://github.com/kubernetes/kubernetes/pull/64473#issuecomment-393574066" title="Approved">fabriziopandini</a>*, *<a href="https://github.com/kubernetes/kubernetes/pull/64473#" title="Author self-approved">nberlee</a>*, *<a href="https://github.com/kubernetes/kubernetes/pull/64473#issuecomment-393051560" title="LGTM">roberthbailey</a>*, *<a href="https://github.com/kubernetes/kubernetes/pull/64473#issuecomment-392940478" title="LGTM">stealthybox</a>*
  
  The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands).
  
  The pull request process is described [here](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process)
  
  <details >
  Needs approval from an approver in each of these files:
  
  - ~~[cluster/addons/dns/OWNERS](https://github.com/kubernetes/kubernetes/blob/master/cluster/addons/dns/OWNERS)~~ [roberthbailey]
  - ~~[cmd/kubeadm/OWNERS](https://github.com/kubernetes/kubernetes/blob/master/cmd/kubeadm/OWNERS)~~ [fabriziopandini]
  
  Approvers can indicate their approval by writing `/approve` in a comment
  Approvers can cancel approval by writing `/approve cancel` in a comment
  </details>
  <!-- META={"approvers":[]} -->
data_with_bots.meta: This message directly preceded comment from bot *k8s-ci-robot* by author *fabriziopandini*:
data_with_bots.text: /lgtm
  /approve
data_with_bots.bot: [APPROVALNOTIFIER] This PR is **APPROVED**
  
  This pull-request has been approved by: *<a href="https://github.com/kubernetes/kubernetes/pull/64473#issuecomment-393574066" title="Approved">fabriziopandini</a>*, *<a href="https://github.com/kubernetes/kubernetes/pull/64473#" title="Author self-approved">nberlee</a>*, *<a href="https://github.com/kubernetes/kubernetes/pull/64473#issuecomment-394755331" title="LGTM">roberthbailey</a>*, *<a href="https://github.com/kubernetes/kubernetes/pull/64473#issuecomment-392940478" title="LGTM">stealthybox</a>*
  
  The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands).
  
  The pull request process is described [here](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process)
  
  <details >
  Needs approval from an approver in each of these files:
  
  - ~~[cluster/addons/dns/OWNERS](https://github.com/kubernetes/kubernetes/blob/master/cluster/addons/dns/OWNERS)~~ [roberthbailey]
  - ~~[cmd/kubeadm/OWNERS](https://github.com/kubernetes/kubernetes/blob/master/cmd/kubeadm/OWNERS)~~ [fabriziopandini]
  
  Approvers can indicate their approval by writing `/approve` in a comment
  Approvers can cancel approval by writing `/approve cancel` in a comment
  </details>
  <!-- META={"approvers":[]} -->
data_with_bots.meta: This message directly preceded comment from bot *k8s-ci-robot* by author *roberthbailey*:
data_with_bots.text: /lgtm
data_with_bots.bot: [MILESTONENOTIFIER] Milestone Pull Request: **Up-to-date for process**
  
  @bowei @fabriziopandini @nberlee @roberthbailey @stealthybox
  
  <details open>
  <summary>Pull Request Labels</summary>
  
  - `sig/cluster-lifecycle`: Pull Request will be escalated to these SIGs if needed.
  - `priority/important-soon`: Escalate to the pull request owners and SIG owner; move out of milestone after several unsuccessful escalation attempts.
  - `kind/feature`: New functionality.
  </details>
  <details>
  <summary>Help</summary>
  <ul>
   <li><a href="https://git.k8s.io/sig-release/ephemera/issues.md">Additional instructions</a></li>
   <li><a href="https://go.k8s.io/bot-commands">Commands for setting labels</a></li>
  </ul>
  </details>
data_with_bots.meta: This message directly preceded comment from bot *k8s-merge-robot* by author *roberthbailey*:
data_with_bots.text: /milestone v1.11
data_without_bots.meta: This message directly preceded comment from bot *k8s-ci-robot* by author *stealthybox*:
data_without_bots.text: Thanks for this change @nberlee
  
  I'm running a local kubeadm build now to validate the change
data_without_bots.meta: This message directly preceded comment from bot *k8s-ci-robot* by author *stealthybox*:
data_without_bots.text: /assign @fabriziopandini @bowei
  PTAL
data_without_bots.meta: This message directly preceded comment from bot *k8s-ci-robot* by author *nberlee*:
data_without_bots.text: /test pull-kubernetes-e2e-kops-aws
  /test pull-kubernetes-kubemark-e2e-gce
data_without_bots.meta: This message directly preceded comment from bot *k8s-ci-robot* by author *roberthbailey*:
data_without_bots.text: /lgtm
data_without_bots.meta: This message directly preceded comment from bot *k8s-ci-robot* by author *fabriziopandini*:
data_without_bots.text: /lgtm
  /approve
data_without_bots.meta: This message directly preceded comment from bot *k8s-ci-robot* by author *roberthbailey*:
data_without_bots.text: /lgtm
data_without_bots.meta: This message directly preceded comment from bot *k8s-merge-robot* by author *roberthbailey*:
data_without_bots.text: /milestone v1.11