Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

kube-dns disregards stubDomains option while resolving externalName service #243

Open
thockin opened this issue Jun 6, 2018 · 7 comments
Labels
kind/bug Categorizes issue or PR as related to a bug. lifecycle/frozen Indicates that an issue or PR should not be auto-closed due to staleness.

Comments

@thockin
Copy link
Member

thockin commented Jun 6, 2018

Was kubernetes/kubernetes#63821 @driusha

/kind bug

What happened:
I have:

  • internal DNS "10.2.2.10" with zone "example.com" on it,
  • stubDomains: {"example.com": ["10.2.2.10"]}
  • externalName service "foo" which points to domain "foo.example.com"

When i try to resolve name "foo", i get NXDOMAIN.
If i try to create externalName (ex. mail -> mail.google.com) without stubDomains, everything works.

Environment:

  • Kubernetes version v1.8.5
  • kube-dns version 1.14.5
@k8s-ci-robot k8s-ci-robot added the kind/bug Categorizes issue or PR as related to a bug. label Jun 6, 2018
@bradleybluebean
Copy link

Also seeing this issue with kube-dns 1.14.10

@bradleybluebean
Copy link

One way to fix this, if you're using Kubernetes 1.9 or above, is to change the dnsPolicy of the kube-dns pod.

https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pods

In the authoritative template, this is set to Default.

https://github.com/kubernetes/kubernetes/blob/master/cluster/addons/dns/kube-dns/kube-dns.yaml.base#L212

This means the pod inherits the nameserver settings from the underlying node that the pod runs on. The kube-dns process then uses this nameserver to try to resolve the externalName host (foo.example.com above). If the inherited nameserver is not also able to resolve the stubdomain (example.com above), the lookup will fail. By changing the dnsPolicy to None and adding a dnsConfig, we can make the kube-dns process query the dnsmasq process (i.e., localhost) instead of an inherited nameserver.

  dnsPolicy: None
  dnsConfig:
    nameservers:
    - 127.0.0.1

Since dnsmasq won't be getting upstream nameservers from the underlying host, the kube-dns ConfigMap should also include an upstreamNameservers setting.

https://kubernetes.io/docs/tasks/administer-cluster/dns-custom-nameservers/#configure-stub-domain-and-upstream-dns-servers

@chrisohaver
Copy link
Contributor

Since dnsmasq won't be getting upstream nameservers from the underlying host, the kube-dns ConfigMap should also include an upstreamNameservers setting.

s/should/must/ .... Without setting an upstreamNameserver, i believe you'd have an infinite lookup loop for external domain names that don't fall in a stub domain.

You can also get into trouble (loop forever) if you try to query a member of a CNAME chain loop (e.g. two external names that point at each other).

Note that moving to CoreDNS is another option. It similarly feeds CNAME targets to itself when looking them up, but does so more internally, and also has CNAME chain loop detection.

@fejta-bot
Copy link

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle stale

@k8s-ci-robot k8s-ci-robot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Nov 5, 2018
@fejta-bot
Copy link

Stale issues rot after 30d of inactivity.
Mark the issue as fresh with /remove-lifecycle rotten.
Rotten issues close after an additional 30d of inactivity.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle rotten

@k8s-ci-robot k8s-ci-robot added lifecycle/rotten Denotes an issue or PR that has aged beyond stale and will be auto-closed. and removed lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. labels Dec 5, 2018
@bowei
Copy link
Member

bowei commented Jan 2, 2019

/lifecycle frozen

@k8s-ci-robot k8s-ci-robot added lifecycle/frozen Indicates that an issue or PR should not be auto-closed due to staleness. and removed lifecycle/rotten Denotes an issue or PR that has aged beyond stale and will be auto-closed. labels Jan 2, 2019
@jhcook-ag
Copy link

/remove-lifecycle stale

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
kind/bug Categorizes issue or PR as related to a bug. lifecycle/frozen Indicates that an issue or PR should not be auto-closed due to staleness.
Projects
None yet
Development

No branches or pull requests

7 participants