Kubernetes CoreDNS Cluster DNS Resolution and Pod Health Sentinel

id: kubernetes-coredns-dns-lookup-latency-sentinel
namespace: company.sre

inputs:
  - id: kube_context
    type: STRING
    required: false
    description: Optional Kubernetes context name.
  - id: max_dns_latency_ms
    type: FLOAT
    defaults: 50.0
    description: Maximum acceptable DNS query resolution latency in milliseconds.

tasks:
  - id: audit_coredns_latency
    type: io.kestra.plugin.scripts.shell.Commands
    containerImage: bitnami/kubectl:latest
    commands:
      - |
        CONTEXT_ARG=""
        if [ -n "{{ inputs.kube_context }}" ]; then
          CONTEXT_ARG="--context={{ inputs.kube_context }}"
        fi

        kubectl $CONTEXT_ARG run dns-latency-probe --image=busybox:latest --rm -i --restart=Never -- nslookup kubernetes.default.svc.cluster.local > /tmp/dns_output.txt 2>/dev/null || true

        DNS_RESOLVED=$(grep -c "Address:" /tmp/dns_output.txt || true)

        kubectl $CONTEXT_ARG get pods -n kube-system -l k8s-app=kube-dns -o json > /tmp/coredns_pods.json
        UNREADY_DNS_PODS=$(jq '[.items[] | select(.status.conditions[]? | select(.type == "Ready" and .status != "True"))] | length' /tmp/coredns_pods.json)

        echo "::set-output name=dns_resolved::$DNS_RESOLVED::"
        echo "::set-output name=unready_dns_pods::$UNREADY_DNS_PODS::"

  - id: evaluate_dns_health
    type: io.kestra.plugin.core.flow.If
    condition: "{{ outputs.audit_coredns_latency.vars.dns_resolved | int == 0 or
      outputs.audit_coredns_latency.vars.unready_dns_pods | int > 0 }}"
    then:
      - id: notify_platform_team
        type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
        url: "{{ secret('SLACK_WEBHOOK') }}"
        payload: |
          {
            "channel": "#infrastructure-alerts",
            "attachments": [
              {
                "color": "danger",
                "title": "🚨 Kubernetes CoreDNS Cluster Resolution Degradation Alert",
                "text": "CoreDNS in kube-system is degraded (unready CoreDNS pods: *{{ outputs.audit_coredns_latency.vars.unready_dns_pods }}*, probe resolved: *{{ outputs.audit_coredns_latency.vars.dns_resolved }}*). Impact: Internal service discovery lookups and external DNS queries are failing or timing out, causing cluster-wide application connection failures.",
                "footer": "Kestra SRE Sentinel • CoreDNS Health"
              }
            ]
          }

errors:
  - id: alert_pipeline_failure
    type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
    url: "{{ secret('SLACK_WEBHOOK') }}"
    payload: |
      {
        "channel": "#infrastructure-alerts",
        "attachments": [
          {
            "color": "danger",
            "title": "⚠️ CoreDNS Sentinel Execution Failed",
            "text": "The CoreDNS audit workflow encountered an execution error. Please verify cluster RBAC permissions and kubeconfig.",
            "footer": "Kestra Workflow Failure Sentinel"
          }
        ]
      }

triggers:
  - id: periodic_schedule
    type: io.kestra.plugin.core.trigger.Schedule
    cron: "*/15 * * * *"
    disabled: true