Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

ROX-23550: Change DNS from kube-dns to openshift-dns #1781

Merged
merged 2 commits into from
May 3, 2024
Merged

ROX-23550: Change DNS from kube-dns to openshift-dns #1781

Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
9d542ac
Change DNS from kube-dns to openshift-dns
ebensh May 3, 2024
a8103a6
Add back ports 53 and 5353
ebensh May 3, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 4 additions & 10 deletions fleetshard/pkg/central/charts/data/tenant-resources/templates/network-policy-default.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,14 +22,8 @@ spec:
- Egress
ingress: []
egress:
- to:
- namespaceSelector: {}
podSelector:
matchLabels:
k8s-app: kube-dns
ports:
- port: 53
protocol: UDP
- port: 53
protocol: TCP
- to:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: openshift-dns
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No need for ports?

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not necessary, though we can apply it. I was having trouble figuring out whether openshift DNS is running on port 53 or 5353 - the service runs on 53, but I see connections in debug also accessing 5353, and it's unclear to me when the NetworkPolicy applies. We could also just do both (like I had in my first commit).

I'll add back both - please take another look.

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

e.g. oc -n openshift-dns describe pod/dns-default-8pbsf

Containers:
dns:
Container ID: cri-o://87736ba19b94b7273825bfcb17d0f2c333d5daec8c0d9287c8bd19051b1f288f
Image: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:b51ade173e06e83d256f5f4467855f2763140f39fe0ef1bc93540436cc540e81
Image ID: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:b51ade173e06e83d256f5f4467855f2763140f39fe0ef1bc93540436cc540e81
Ports: 5353/UDP, 5353/TCP

So the application's listening on 5353, but the service itself is on 53:

oc get services -n openshift-dns
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
dns-default ClusterIP 172.30.0.10 53/UDP,53/TCP,9154/TCP 283d

I think it will use the pod's listening port, not the service's port

{{ end }}
Loading