Helm Chart Repository

DNS mesh for
Kubernetes

eBPF-based DNS proxy with XDP/TC filtering, Kubernetes-native policy controller, and an admission webhook — all packaged as production-ready Helm charts.

Get started View on GitHub

Quickstart

Deploy the full DNS mesh stack in three commands.

Add the Helm repository

helm repo add dashdns \
  https://dashdns.github.io/helm-charts

helm repo update

Install the charts

helm install dns-mesh-controller \
  dashdns/dns-mesh-controller \
  --namespace dns-mesh \
  --create-namespace

helm install dashdns \
  dashdns/dashdns \
  --namespace dashdns \
  --create-namespace

Verify the deployment

# DashDNS DaemonSet
kubectl get daemonset \
  -n dns-mesh

# Controller + Webhook
kubectl get deploy \
  -n dns-mesh

ℹ️

DashDNS requires privileged pods on each node to load eBPF programs (SYS_ADMIN, NET_ADMIN, SYS_RESOURCE). Ensure your cluster security policy permits this before installing.

Available Charts

Deploy each component independently using the charts below.

🛡️ v2.0.2

DashDNS

eBPF-based DNS proxy running as a DaemonSet. Attaches XDP/TC programs to intercept and filter DNS traffic on every node.

helm install my-dashdns dashdns/dashdns

⚙️ v2.0.3

DNS Mesh Controller

Kubernetes policy controller managing DNSPolicy CRDs and an admission webhook that annotates pods at creation time.

helm install my-dns-mesh-controller dashdns/dns-mesh-controller

Key Configuration Values

Pass values with --set or a custom values.yaml. Full reference in each chart's values.yaml.

DashDNS (`dashdns.*`)

Key	Default	Description
`dns.interface`	`eth0`	Network interface for XDP/TC attachment
`dns.upstream`	`1.1.1.1:53`	Upstream DNS resolver
`dns.blocklist`	`""`	Comma-separated global domain blocklist
`dns.ipBlocklistUrl`	`http://…:5959/api/policies`	URL to fetch per-IP policy JSON from the controller
`dns.ipBlocklistInterval`	`5s`	Policy refresh interval
`service.type`	`NodePort`	Kubernetes service type
`service.nodePort`	`30053`	NodePort for DNS (UDP/53)
`prometheus.enabled`	`false`	Enable Prometheus ServiceMonitor

DNS Mesh Controller (`dns-mesh-controller.*`)

Key	Default	Description
`controller.replicaCount`	`1`	Number of controller replicas
`controller.service.apiPort`	`5959`	Policy REST API port
`webhook.replicas`	`1`	Number of admission webhook replicas
`webhook.certChain.ca`	`""`	Base64-encoded CA certificate
`webhook.certChain.cert`	`""`	Base64-encoded TLS certificate
`webhook.certChain.key`	`""`	Base64-encoded TLS private key
`webhook.dns_service.name`	`dnsd-dashdns`	DashDNS service the webhook points to

Custom values file examples

# dashdns-values.yaml
dns:
  interface: eth0
  upstream: "8.8.8.8:53"
prometheus:
  enabled: true

helm install dashdns dashdns/dashdns \
  --namespace dashdns \
  --create-namespace \
  -f dashdns-values.yaml

# controller-values.yaml
controller:
  replicaCount: 2
webhook:
  certChain:
    ca:   "BASE64_CA"
    cert: "BASE64_CERT"
    key:  "BASE64_KEY"

helm install dns-mesh-controller dashdns/dns-mesh-controller \
  --namespace dns-mesh \
  --create-namespace \
  -f controller-values.yaml

Architecture

DashDNS runs on every node and polls the controller's policy API. The admission webhook annotates pods so the daemon knows which policies apply.

 ┌─────────────────────────────────────────────────────────────┐
 │  Kubernetes Node                                            │
 │                                                             │
 │  ┌──────────────┐    DNS query    ┌─────────────────────┐  │
 │  │     Pod      │ ──────────────▶ │      DashDNS        │  │
 │  │  (annotated) │                 │   eBPF DaemonSet    │  │
 │  └──────────────┘                 │                     │  │
 │                                   │  XDP / TC filters   │  │
 │                                   └──────────┬──────────┘  │
 │                                              │ policy poll  │
 └──────────────────────────────────────────────┼─────────────┘
                                                │
                                 ┌──────────────▼─────────────┐
                                 │   dns-mesh-controller       │
                                 │                             │
                                 │  ┌─────────────────────┐   │
                                 │  │  Policy API  :5959  │   │
                                 │  │  /api/policies      │   │
                                 │  └─────────────────────┘   │
                                 │  ┌─────────────────────┐   │
                                 │  │  Admission Webhook   │   │
                                 │  │  (pod annotation)    │   │
                                 │  └─────────────────────┘   │
                                 │  ┌─────────────────────┐   │
                                 │  │  DNSPolicy CRD       │   │
                                 │  └─────────────────────┘   │
                                 └────────────────────────────┘

Upgrade & Uninstall

Upgrade

helm repo update

helm upgrade dashdns dashdns/dashdns \
  --namespace dashdns \
  -f dashdns-values.yaml

helm upgrade dns-mesh-controller dashdns/dns-mesh-controller \
  --namespace dns-mesh \
  -f controller-values.yaml

Uninstall

helm uninstall dashdns --namespace dashdns
helm uninstall dns-mesh-controller --namespace dns-mesh

⚠️

CRDs installed by dns-mesh-controller are not removed on helm uninstall. Delete them manually if needed:
kubectl delete crd dnspolicies.dashdns.io

DNS mesh forKubernetes