---
# Governing Service for the StatefulSet. Headless, and never used for traffic:
# it exists so pods get a stable DNS name, and so a PVC per pod has a home.
apiVersion: v1
kind: Service
metadata:
  name: fancy-dns
  namespace: dns
  labels:
    app.kubernetes.io/name: fancy-dns
spec:
  clusterIP: None
  selector:
    app.kubernetes.io/name: fancy-dns
  ports:
    - name: dns-udp
      port: 53
      targetPort: dns-udp
      protocol: UDP
    - name: dns-tcp
      port: 53
      targetPort: dns-tcp
      protocol: TCP
    - name: dot
      port: 853
      targetPort: dot
    - name: doh
      port: 443
      targetPort: doh
    - name: admin
      port: 8080
      targetPort: admin
---
# The DNS service. This is the one clients resolve.
#
# Why a LoadBalancer and not hostNetwork: the server does not set SO_REUSEPORT,
# so two host-network pods cannot share the node's :53 and the second one
# would crash-loop on bind. Giving the cloud load balancer the port also keeps
# the node's own resolver untouched, which matters on a node that runs kubelet
# and CoreDNS.
#
# A cloud LB health-checks this Service on port 53 and needs the probe to
# actually answer a query: the default TCP check is not enough for UDP. If your
# provider supports UDP health checks, point them at 53/UDP; otherwise leave
# the load balancer health check on the HTTP admin port (see the comment on the
# web Service) and let the provider's DNS failover be the only response to a
# dead resolver.
apiVersion: v1
kind: Service
metadata:
  name: fancy-dns-dns
  namespace: dns
  labels:
    app.kubernetes.io/name: fancy-dns
  annotations:
    # Cloud-specific knobs go here; uncomment for the matching provider.
    # service.beta.kubernetes.io/aws-load-balancer-type: nlb
    # service.beta.kubernetes.io/aws-load-balancer-nlb-target-type: ip
    # service.beta.kubernetes.io/gcp-load-balancer-type: EXTERNAL
spec:
  type: LoadBalancer
  externalTrafficPolicy: Local
  selector:
    app.kubernetes.io/name: fancy-dns
  ports:
    - name: dns-udp
      port: 53
      targetPort: dns-udp
      protocol: UDP
    - name: dns-tcp
      port: 53
      targetPort: dns-tcp
      protocol: TCP
    - name: dot
      port: 853
      targetPort: dot
---
# A normal ClusterIP Service for everything the Ingress fronts. It has to be a
# separate object because a headless Service has no virtual IP for an ingress
# controller to route to.
#
# It is also the only reliable health-check target for the cloud load balancers
# on fancy-dns-dns: the admin port speaks HTTP and answers /api/healthz
# unauthenticated (a health check cannot carry an API key), so a probe can tell
# "bound and serving" from "process up but not listening".
apiVersion: v1
kind: Service
metadata:
  name: fancy-dns-web
  namespace: dns
  labels:
    app.kubernetes.io/name: fancy-dns
spec:
  type: ClusterIP
  selector:
    app.kubernetes.io/name: fancy-dns
  ports:
    - name: doh
      port: 443
      targetPort: doh
    - name: admin
      port: 8080
      targetPort: admin