CoreDNS

Exam tasks: 3.6 (use CoreDNS), with 5.5 when names don't resolve

The decision: which name should the client use, which resolver answers it (CoreDNS's kubernetes plugin, a forwarded upstream, or the node's resolver), and where do you change that?

What's runningCopy Anchor Link

Names you can resolveCopy Anchor Link

• A Pod gets the <hostname>.<subdomain>.<ns>.svc.cluster.local name only when it sets spec.hostname and spec.subdomain, and a headless Service with the same name as the subdomain exists in its namespace. StatefulSets do this for you through serviceName.
• cluster.local is the default cluster domain. A task may use a different one, so check clusterDomain.

How short names workCopy Anchor Link

A Pod in namespace sales gets roughly this /etc/resolv.conf:

nameserver 10.96.0.10
search sales.svc.cluster.local svc.cluster.local cluster.local
options ndots:5

• pricing resolves via the first search domain (same namespace). pricing.ops resolves via svc.cluster.local (another namespace).
• With ndots:5, any name with fewer than five dots is tried against the search list first, so external names like api.partner.net cost several failed lookups before the real one. A trailing dot (api.partner.net.) skips the search list.

dnsPolicy and dnsConfigCopy Anchor Link

spec:
  dnsPolicy: None
  dnsConfig:
    nameservers: ["10.96.0.10"]
    searches: ["sales.svc.cluster.local", "svc.cluster.local", "cluster.local"]
    options:
    - name: ndots
      value: "2"

For a few fixed names inside one Pod, spec.hostAliases adds entries to the Pod's /etc/hosts without touching DNS.

The CorefileCopy Anchor Link

The kubeadm default, trimmed to the lines you'll touch (see k -n kube-system get cm coredns -o yaml for the rest):

.:53 {                                   # server block: every zone, port 53
    errors                               # log errors to stdout
    kubernetes cluster.local in-addr.arpa ip6.arpa {
       pods insecure                     # answer a-b-c-d.<ns>.pod names
       fallthrough in-addr.arpa ip6.arpa # pass unknown reverse lookups on
    }
    forward . /etc/resolv.conf           # non-cluster names go to the node's resolvers
    cache 30
    loop
    reload                               # re-read the Corefile when the ConfigMap changes
}

The full default also carries health, ready (probe endpoints), prometheus :9153 (metrics) and loadbalance (shuffles A records).

Forwarding a private zone (stub domain)Copy Anchor Link

Add a server block for the zone. Don't edit the forward . line, which would send all external lookups there.

corp.lan:53 {
    errors
    cache 30
    forward . 10.20.0.53
}

k -n kube-system edit configmap coredns          # add the block next to .:53
k -n kube-system rollout restart deploy coredns  # or wait for reload; restarting is faster and certain
k -n kube-system logs -l k8s-app=kube-dns --tail=20   # syntax errors show here

Debugging a lookupCopy Anchor Link

k run dns --rm -it --restart=Never --image=registry.k8s.io/e2e-test-images/jessie-dnsutils:1.3 -- \
  nslookup pricing.sales
k exec -n sales deploy/web -- cat /etc/resolv.conf      # right nameserver and search list?
k -n kube-system get pods -l k8s-app=kube-dns           # Running and Ready?
k -n kube-system get endpointslices -l kubernetes.io/service-name=kube-dns
k -n kube-system logs -l k8s-app=kube-dns

ScenariosCopy Anchor Link

DrillCopy Anchor Link

kubectl config use-context lab-dns

1. Configure CoreDNS so names in corp.lan are resolved by 10.20.0.53, without changing how other names resolve.
2. In namespace sales, find the IP that pricing.sales.svc.cluster.local resolves to and write it to /opt/answers/pricing-ip.txt.

k -n kube-system get cm coredns -o yaml > /tmp/coredns-backup.yaml
k -n kube-system edit cm coredns

    corp.lan:53 {
        errors
        cache 30
        forward . 10.20.0.53
    }

k -n kube-system rollout restart deploy coredns
k -n kube-system rollout status deploy coredns
k -n kube-system logs -l k8s-app=kube-dns --tail=10      # no plugin errors

k -n sales run dns --rm -i --restart=Never --image=registry.k8s.io/e2e-test-images/jessie-dnsutils:1.3 -- \
  dig +short pricing.sales.svc.cluster.local > /opt/answers/pricing-ip.txt
cat /opt/answers/pricing-ip.txt
k -n sales get svc pricing -o jsonpath='{.spec.clusterIP}{"\n"}'   # should match
k run dns2 --rm -it --restart=Never --image=registry.k8s.io/e2e-test-images/jessie-dnsutils:1.3 -- nslookup host1.corp.lan

Further readingCopy Anchor Link

• DNS for Services and Pods
• Customizing DNS Service
• Debugging DNS resolution
• CoreDNS plugins