kubernetes: k3s resolv-conf from fixed nameservers 1.1.1.1 and 9.9.9.9 instead of a copy of the node

kubernetes/defaults/main.yml

@@ -19,10 +19,16 @@ kubernetes:
   token: <shared token for nodes to join>
 
   network:
-    # Copies the current /etc/resolv.conf whilst only keeping "nameserver" lines
+    # Writes /etc/resolv-k3s.conf (k3s resolv-conf, CoreDNS upstreams) from
-    #  can be used to remove filter
+    #  resolv_conf_nameservers
     clean_resolv_conf: false
 
+    # Fixed upstreams, not copied from the node: a copied snapshot goes stale
+    #  when the node's DNS changes and can leave CoreDNS with a single upstream
+    resolv_conf_nameservers:
+      - 1.1.1.1
+      - 9.9.9.9
+
     # One of [none, flannel, calico, cilium]
     plugin: calico
 

kubernetes/tasks/prerequisites.yml

@@ -45,17 +45,15 @@
          else (ansible_default_ipv6.address | default('')) }}
 
 - block:
-    - name: Read resolv.conf
+    - name: Write /etc/resolv-k3s.conf with the fixed nameservers
-      shell: "grep '^nameserver' /etc/resolv.conf"
+      template:
-      register: nameserver_line
+        src: resolv-k3s.conf.jinja2
-      changed_when: false
-      check_mode: false
-
-    - name: Write /etc/resolv-k3s.conf with only nameservers
-      copy:
-        content: "{{ nameserver_line.stdout }}"
         dest: /etc/resolv-k3s.conf
+        owner: root
+        group: root
+        mode: "0644"
   when: kubernetes.network.clean_resolv_conf is true
+  tags: resolv_conf
 
 - name: Run handlers to reload configurations
   meta: flush_handlers

kubernetes/templates/resolv-k3s.conf.jinja2

@@ -0,0 +1,4 @@
+# Managed by Ansible (role kubernetes). Fixed upstreams, not copied from the node.
+{% for nameserver in kubernetes.network.resolv_conf_nameservers %}
+nameserver {{ nameserver }}
+{% endfor %}