feat(helm): update chart coredns to 1.48.2

[renovate]

This PR contains the following updates:

Package	Update	Change
coredns (source)	minor	1.47.1 → 1.48.2

---

Release Notes

coredns/helm (coredns)

v1.48.2

Compare Source

CoreDNS is a DNS server that chains plugins and provides Kubernetes DNS Services

What's Changed

• feat: add optional autoscaler replicas and disruption budget by @​m-yosefpor in #​276

New Contributors

• @​m-yosefpor made their first contribution in #​276

Full Changelog: coredns/helm@coredns-1.48.1...coredns-1.48.2

v1.48.1

Compare Source

CoreDNS is a DNS server that chains plugins and provides Kubernetes DNS Services

What's Changed

• Bump to CoreDNS 1.14.7 by @​artizirk in #​278

New Contributors

• @​artizirk made their first contribution in #​278

Full Changelog: coredns/helm@coredns-1.48.0...coredns-1.48.1

v1.48.0

Compare Source

CoreDNS is a DNS server that chains plugins and provides Kubernetes DNS Services

What's Changed

• Run CoreDNS as the image's non-root user by default by @​martin-mat in #​277

New Contributors

• @​martin-mat made their first contribution in #​277

Full Changelog: coredns/helm@coredns-1.47.1...coredns-1.48.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "every weekend"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

spec.chart.spec.version  (helm.toolkit.fluxcd.io/v2/HelmRelease/kube-system/coredns)
  ± value change
    - 1.47.1
    + 1.48.2

[github-actions]

spec.template.spec.containers.coredns.image  (apps/v1/Deployment/kube-system/coredns)
  ± value change
    - coredns/coredns:1.14.6
    + coredns/coredns:1.14.7

spec.template.spec.containers.coredns.securityContext  (apps/v1/Deployment/kube-system/coredns)
  + four map entries added:
    runAsGroup: 65532
    runAsNonRoot: true
    runAsUser: 65532
    seccompProfile:
      type: RuntimeDefault

[claude]

coredns (Helm chart): 1.47.1 → 1.48.2

Verdict: Safe to merge

New features worth adopting:

• runAsNonRoot by default (v1.48.0, chart PR #277) — the chart now sets runAsNonRoot: true, runAsUser: 65532, runAsGroup: 65532, and seccompProfile.type: RuntimeDefault as defaults. This is a meaningful behavior change: CoreDNS pods will run as UID 65532 (the distroless nonroot user) instead of root. This repo's helm-values.yaml has no explicit securityContext overrides, so these new defaults apply directly. Port 53 is unaffected — capabilities.add: [NET_BIND_SERVICE] was already present. The kube-system namespace has no PodSecurityAdmission labels, so no admission issues. This aligns with the restricted Pod Security Standard and is a security improvement.
• CoreDNS application bump: 1.14.6 → 1.14.7 (v1.48.1) — fixes three Go CVEs (CVE-2026-56865, CVE-2026-56864, CVE-2026-33818) and pins the nonroot user to numeric UID/GID 65532 (required for runAsNonRoot: true to pass kubelet verification — name-based users cannot be verified). The chart's security hardening in v1.48.0 and this image bump in v1.48.1 are intentionally coordinated.
• Optional autoscaler replicas and PodDisruptionBudget (v1.48.2) — additive opt-in feature, no action required.

Sources consulted:

• https://github.com/coredns/helm/releases/tag/coredns-1.48.0
• https://github.com/coredns/helm/releases/tag/coredns-1.48.1
• https://github.com/coredns/helm/releases/tag/coredns-1.48.2
• coredns/helm#277
• https://github.com/coredns/coredns/releases/tag/v1.14.7