I attempted to run kube-dns as a non-root user by modifying the example YAML files to:

• have dnsmasq serve on a high port using the --port flag
• fix the service to point at the high port
• add a non-root security context to the pod

This seems like it would be sufficient, but then I found that there are several hard-coded assumptions in the container image that dnsmasq will run as root:

https://github.com/kubernetes/dns/blob/master/images/dnsmasq/Dockerfile.cross
https://github.com/kubernetes/dns/blob/master/images/dnsmasq/dnsmasq.conf

Unless there is a strong reason why dnsmasq needs to run as root, I think it would be a better practice to run it as non-root.