feat(helm): support dnsConfig on the forwarder deployment

[DrFaust92]

What

The runner Deployment already supports a configurable dnsPolicy / dnsConfig (runner.dnsConfig.*), but the forwarder (kubewatch) does not — it's stuck on the implicit ClusterFirst policy.

This PR extracts the runner's inline dnsConfig logic into a shared robusta.dnsConfig helper and uses it from both the runner and the forwarder, and adds a matching kubewatch.dnsConfig block to values.yaml.

Why

Users who need custom DNS (e.g. dnsPolicy: None with explicit nameservers/searches, or custom ndots options) can already configure it for the runner but had no way to do the same for the forwarder pod.

Details

• New robusta.dnsConfig helper in _helpers.tpl — centralizes the dnsPolicy, the optional dnsConfig block, the "None requires at least one of nameservers/searches/options" guard, and the ClusterFirst fallback.
• runner.yaml now calls the helper (removes ~26 lines of inline logic).
• forwarder.yaml calls the same helper before containers:.
• values.yaml gains a kubewatch.dnsConfig block mirroring runner.dnsConfig.

Backwards compatibility

Defaults are unchanged (dnsConfig.enabled: false), so both deployments still render dnsPolicy: ClusterFirst. The runner's rendered output is byte-for-byte identical.

Verified with helm template:

• default → dnsPolicy: ClusterFirst on both deployments
• enabled: true + policy: None + nameservers → correct dnsConfig nesting
• policy: None with no config → still hard-fails via the guard

🤖 Generated with Claude Code

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: 81c29302-bc7c-486b-845a-6a6244bf697a

📥 Commits

Reviewing files that changed from the base of the PR and between 3a990f5 and 2973d7d.

📒 Files selected for processing (2)

• helm/robusta/templates/_helpers.tpl
• helm/robusta/values.yaml

Included review availability: Your plan provides up to 8 included reviews per hour; 7 remain after this review.

---

Walkthrough

A reusable Helm helper renders validated DNS settings with a ClusterFirst fallback. The runner and forwarder pod templates use the helper. Kubewatch receives disabled DNS defaults. Two playbooks are disabled when service-account creation is disabled.

Changes

Helm DNS configuration

Layer / File(s)	Summary
DNS helper validation and rendering helm/robusta/templates/_helpers.tpl	Adds robusta.dnsConfig, validates dnsPolicy: None, renders optional DNS fields, and defaults to ClusterFirst.
Deployment wiring and defaults helm/robusta/templates/runner.yaml, helm/robusta/templates/forwarder.yaml, helm/robusta/values.yaml	Replaces runner inline logic, adds forwarder DNS rendering, and defines disabled Kubewatch DNS defaults.

Service-account playbook disabling

Layer / File(s)	Summary
Disabled playbook updates helm/robusta/templates/_helpers.tpl	Adds NodeFSSpaceAlerts and WeeklyKRRScan to the disabled playbook list when service-account creation is disabled.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to 2973d

The chart adds shared DNS configuration support for runner and forwarder deployments while retaining ClusterFirst defaults. No current merge-blocking risk remains.

Suggested reviewers: avi-robusta, moshemorad

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely identifies the primary change: adding dnsConfig support to the Helm forwarder deployment.
Description check	✅ Passed	The description directly explains the shared helper, forwarder support, runner refactor, configuration defaults, validation, and verification steps. It is fully related to the changeset.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@helm/robusta/templates/_helpers.tpl`:
- Around line 21-26: Update the dnsConfig validation around .enabled to tolerate
a null or missing configuration object and use the established default for
.policy when it is absent. For an effective policy of None, require .nameservers
to exist and be non-empty; do not accept only .searches or .options. Render
dnsPolicy using the resolved fallback policy so the template never emits an
empty value or panics.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 835affbb-f52f-4a67-b9f7-6d7b1939b35b

📥 Commits

Reviewing files that changed from the base of the PR and between eb350a4 and dd2c56b.

📒 Files selected for processing (4)

• helm/robusta/templates/_helpers.tpl
• helm/robusta/templates/forwarder.yaml
• helm/robusta/templates/runner.yaml
• helm/robusta/values.yaml

[DrFaust92]

@arikalon1 ping