DocsICP FilingConsole
官方文档
首页

Configure pod DNS policies and domain name resolution

更新时间：
复制 MD 格式
产品详情
我的收藏

Set dnsPolicy to control pod DNS behavior, and use hostAliases to map domains to fixed IPs.

Prerequisites

How CoreDNS works in ACK

ACK deploys CoreDNS in every cluster. A Service named kube-dns exposes it for pod DNS queries. By default, two coredns pods serve as the backend.

Inspect the DNS components in your cluster:

# Check the kube-dns Service
kubectl get svc kube-dns -n kube-system

# Check the coredns Deployment
kubectl get deployment coredns -n kube-system

See DNS overview.

Set a DNS policy for a pod

dnsPolicy controls how a pod resolves domain names. ACK supports four policies:

Policy Behavior
ClusterFirst The pod uses CoreDNS. /etc/resolv.conf points to the kube-dns Service. Default policy.
None The pod ignores cluster DNS settings. Use dnsConfig for custom settings; without it, no names resolve.
Default The pod inherits DNS settings from its node. In ACK, nodes are ECS instances, so the pod uses the node's /etc/resolv.conf, which points to Alibaba Cloud DNS. CoreDNS is bypassed.
ClusterFirstWithHostNet For hostNetwork pods. Without this policy, a hostNetwork pod defaults to Default and cannot reach cluster Services.
Default is not the default policy. If you omit dnsPolicy, the pod uses ClusterFirst.

Use CoreDNS to resolve domain names

Use ClusterFirst (the default) when pods need to reach other cluster Services.

Set dnsPolicy: ClusterFirst in the pod spec:

apiVersion: v1
kind: Pod
metadata:
  name: alpine
  namespace: default
spec:
  containers:
  - image: alpine
    command:
      - sleep
      - "10000"
    imagePullPolicy: Always
    name: alpine
  dnsPolicy: ClusterFirst

Apply the manifest and verify DNS resolution:

kubectl apply -f pod.yaml

# Verify that the pod resolves cluster Services correctly
kubectl exec alpine -- nslookup kubernetes.default

Customize DNS settings for a pod

Use dnsPolicy: None for full control over a pod's DNS server and search domains.

apiVersion: v1
kind: Pod
metadata:
  name: alpine
  namespace: default
spec:
  containers:
  - image: alpine
    command:
      - sleep
      - "10000"
    imagePullPolicy: Always
    name: alpine
  dnsPolicy: None
  dnsConfig:
    nameservers: ["169.254.xx.xx"]
    searches:
    - default.svc.cluster.local
    - svc.cluster.local
    - cluster.local
    options:
    - name: ndots
      value: "2"

dnsConfig accepts these properties:

  • nameservers: DNS server IPs for the pod. Up to three. Required when dnsPolicy is None; optional otherwise. Merged with policy-generated nameservers; duplicates removed.

  • searches: DNS search domains for hostname lookup. Optional. Up to six. Merged with policy-generated search domains; duplicates removed. Only the first domain is tried if the DNS server is unreachable.

  • options: Objects with a required name and an optional value. Merged with policy-generated options; duplicates removed. See DNS resolution and caching policies.

Apply the manifest and verify:

kubectl apply -f pod.yaml

# Check the DNS configuration inside the pod
kubectl exec alpine -- cat /etc/resolv.conf

See DNS for Services and Pods.

Use the node's DNS settings

Use dnsPolicy: Default when pods do not need cluster Services and should resolve through Alibaba Cloud DNS instead of CoreDNS.

apiVersion: v1
kind: Pod
metadata:
  name: alpine
  namespace: default
spec:
  containers:
  - image: alpine
    command:
      - sleep
      - "10000"
    imagePullPolicy: Always
    name: alpine
  dnsPolicy: Default

Apply the manifest and verify:

kubectl apply -f pod.yaml

# Confirm the pod inherits the node's resolv.conf
kubectl exec alpine -- cat /etc/resolv.conf

Enable hostNetwork pods to reach cluster Services

Pods with hostNetwork: true default to the Default DNS policy and cannot reach cluster Services by name. Set dnsPolicy: ClusterFirstWithHostNet to restore cluster DNS resolution.

apiVersion: v1
kind: Pod
metadata:
  name: alpine
  namespace: default
spec:
  hostNetwork: true
  dnsPolicy: ClusterFirstWithHostNet
  containers:
  - image: alpine
    command:
      - sleep
      - "10000"
    imagePullPolicy: Always
    name: alpine

Apply the manifest and verify:

kubectl apply -f pod.yaml

# Verify that the pod resolves cluster Services correctly
kubectl exec alpine -- nslookup kubernetes.default

Map domain names to specific IP addresses

Two methods are available:

  • All pods (global): Enable the CoreDNS hosts plugin to apply the mapping cluster-wide. See Configure extended features based on CoreDNS.

  • Individual pod: Use the hostAliases field to add entries to that pod's /etc/hosts.

Add host aliases to a pod

hostAliases adds entries to a pod's /etc/hosts after Kubernetes initializes the file.

Warning

Do not edit /etc/hosts directly. The kubelet manages this file and overwrites manual changes on pod start or restart.

apiVersion: v1
kind: Pod
metadata:
  name: hostaliases-pod
spec:
  hostAliases:
  - ip: "127.0.**.**"
    hostnames:
    - "foo.local"
    - "bar.local"
  - ip: "10.1.**.**"
    hostnames:
    - "foo.remote"
  containers:
  - name: cat-hosts
    image: busybox:1.28
    command:
    - cat
    args:
    - "/etc/hosts"

After initialization, /etc/hosts contains the Kubernetes-managed entries followed by your aliases:

# Kubernetes-managed hosts file.
127.0.**.**	localhost
::1	localhost ip6-localhost ip6-loopback
fe00::0	ip6-localnet
fe00::0	ip6-mcastprefix
fe00::1	ip6-allnodes
fe00::2	ip6-allrouters
10.200.**.**	hostaliases-pod

# Entries added by HostAliases.
127.0.**.**	foo.local	bar.local
10.1.**.**	foo.remote

Apply the manifest and verify that the aliases resolve correctly:

kubectl apply -f hostaliases-pod.yaml

# Check that the aliases appear in /etc/hosts
kubectl exec hostaliases-pod -- cat /etc/hosts

# Verify resolution
kubectl exec hostaliases-pod -- nslookup foo.local

Next steps

Previous：DNS-based service discoveryNext：DNS resolution and caching policies