Configure DNS resolution for Pods-Container Compute Service(ACS)-阿里云帮助中心

This topic describes how to use the dnsPolicy field to configure the DNS policy for Pods in a Container Compute Service (ACS) cluster in various scenarios.

Background

For more information about domain name resolution in Kubernetes clusters, see DNS for Services and Pods.

The cluster sends DNS requests to the cluster DNS server for resolution based on a Pod's configuration. In an ACK cluster, CoreDNS is deployed on the managed side and is exposed through a Service named kube-dns. To view details about the kube-dns Service, run the following command:

kubectl get svc kube-dns -n kube-system

Configure DNS policies for Pods

ACK lets you configure a unique DNS policy for each Pod using the dnsPolicy field. ACK clusters support the following four policies:

ClusterFirst: This is the default DNS policy. Pods first send DNS queries to the in-cluster CoreDNS. The Pod's /etc/resolv.conf file is automatically configured to point to the kube-dns Service address.
None: This policy instructs Kubernetes to ignore the cluster's DNS settings. You must provide a dnsConfig field to specify the DNS configuration. Without it, the Pod cannot resolve any domain names.
Default: The Pod uses Alibaba Cloud DNS for domain name resolution.
ClusterFirstWithHostNet: ACK does not support hostNetwork. When dnsPolicy is set to ClusterFirstWithHostNet, it functions as ClusterFirst. For more information, see Pod overview.

The following sections describe how to configure dnsPolicy for three common scenarios.

Scenario 1: Use in-cluster CoreDNS

To use the cluster's CoreDNS for domain name resolution, set dnsPolicy: ClusterFirst. The following is a sample configuration:

apiVersion: v1
kind: Pod
metadata:
  name: alpine
  namespace: default
spec:
  containers:
  - image: alpine # This image is for demonstration only. Replace it with your own image for verification.
    command:
      - sleep
      - "10000"
    imagePullPolicy: Always
    name: alpine
  dnsPolicy: ClusterFirst

Scenario 2: Customize Pod DNS configuration

To use a custom DNS configuration, set dnsPolicy: None and specify a dnsConfig field. The following is a sample configuration:

apiVersion: v1
kind: Pod
metadata:
  name: alpine
  namespace: default
spec:
  containers:
  - image: alpine # This image is for demonstration only. Replace it with your own image for verification.
    command:
      - sleep
      - "10000"
    imagePullPolicy: Always
    name: alpine
  dnsPolicy: None
  dnsConfig:
    nameservers: ["169.254.xxx.xxx"]
    searches:
    - default.svc.cluster.local
    - svc.cluster.local
    - cluster.local
    options:
    - name: ndots
      value: "2"

The following table describes the fields in dnsConfig.

Parameter	Description
nameservers	A list of DNS server IP addresses for the Pod. You can specify up to three IP addresses. This field is required when the Pod's `dnsPolicy` is `None`. For all other policies, this field is optional. Kubernetes merges the specified IP addresses into the `nameserver` field of the resolv.conf file that is generated based on the DNS policy and removes duplicate addresses.
searches	A list of DNS search domains for hostname lookups in the Pod. This field is optional. When specified, Kubernetes merges the provided list into the base search domains generated from the selected DNS policy and removes any duplicate domain names. Kubernetes allows a maximum of six search domains.
options	An optional list of objects. Each object can have a `name` property (required) and a `value` property (optional). Kubernetes merges the content in this field into the options that are generated from the specified DNS policy and removes any duplicate entries.

For more information, see DNS for Services and Pods.

Scenario 3: Use Alibaba Cloud DNS

To use Alibaba Cloud DNS directly for resolution and bypass in-cluster service discovery, set dnsPolicy: Default. This bypasses the in-cluster CoreDNS. The following is a sample configuration:

apiVersion: v1
kind: Pod
metadata:
  name: alpine
  namespace: default
spec:
  containers:
  - image: alpine # This image is for demonstration only. Replace it with your own image for verification.
    command:
      - sleep
      - "10000"
    imagePullPolicy: Always
    name: alpine
  dnsPolicy: Default

References

For more information on DNS resolution and caching policies, see DNS resolution and caching policies.