opened
nberlee
username_0
<!--  Thanks for sending a pull request!  Here are some tips for you:
1. If this is your first time, read our contributor guidelines https://git.k8s.io/community/contributors/guide#your-first-contribution and developer guide https://git.k8s.io/community/contributors/devel/development.md#development-guide
2. If you want *faster* PR reviews, read how: https://git.k8s.io/community/contributors/guide/pull-requests.md#best-practices-for-faster-reviews
3. Follow the instructions for writing a release note: https://git.k8s.io/community/contributors/guide/release-notes.md
4. If the PR is unfinished, see how to mark it: https://git.k8s.io/community/contributors/guide/pull-requests.md#marking-unfinished-pull-requests
-->

**What this PR does / why we need it**: Make the CoreDNS container more secure by dropping (root) capabilities. Improve the integrity of the of the container by running the whole container in read-only.

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #

**Special notes for your reviewer**:
Same [changes](https://github.com/coredns/deployment/commit/aba0245609821e8bba8b4ecd6a32c1a02a7bf658) as in the CoreDNS deployment repository.
**Release note**:
<!--  Write your release note:
1. Enter your extended release note in the below block. If the PR requires additional action from users switching to the new release, include the string "action required".
2. If no release note is required, just write "NONE".
-->
```release-note
NONE
```
Drop capabilities of CoreDNS container and run in read-only
issue
created
stealthybox
username_1
Thanks for this change @username_0

I'm running a local kubeadm build now to validate the change
comment
created
nberlee
username_0
thx @username_1, I will add a release note
comment
created
stealthybox
username_1
/assign @username_2 @bowei
PTAL
comment
created
nberlee
username_0
/test pull-kubernetes-e2e-kops-aws
/test pull-kubernetes-kubemark-e2e-gce
comment
created
nberlee
username_0
/test pull-kubernetes-e2e-kops-aws
/test pull-kubernetes-kubemark-e2e-gce
comment
created
fabriziopandini
username_2
Thanks @username_0 for your contribution!
Thanks @username_1 for testing this

I'm ok with the change (it mirrors the [sample deployment](https://github.com/coredns/deployment/blob/aba0245609821e8bba8b4ecd6a32c1a02a7bf658/kubernetes/coredns.yaml.sed#L108) in the core dns repo); I let the final approval to the owners of `cluster` folder
/lgmt
/cc @username_3
comment
created
roberthbailey
username_3
/lgtm
comment
created
fabriziopandini
username_2
/lgtm
/approve
comment
created
roberthbailey
username_3
/lgtm
comment
created
roberthbailey
username_3
/milestone v1.11
comment