Configure unmanaged CoreDNS

Scenarios

The following example uses a pod with dnsPolicy: ClusterFirst in its DNS policy configuration:

apiVersion: v1
kind: Pod
metadata:
  name: alinux3
  namespace: default
spec:
  containers:
  - image: alibaba-cloud-linux-3-registry.cn-hangzhou.cr.aliyuncs.com/alinux3/alinux3
    command:
      - sleep
      - "10000"
    imagePullPolicy: Always
    name: alinux3
  dnsPolicy: ClusterFirst

To configure the dnsPolicy parameter for different scenarios, see Configure DNS resolution.

Default configurations of CoreDNS

The CoreDNS ConfigMap in the kube-system namespace defines which plug-ins are enabled. ConfigMaps vary slightly between CoreDNS versions. Before making changes, review the CoreDNS official documentation. The following example shows the default CoreDNS 1.6.2 configuration:

  Corefile: |
    .:53 {
        errors
        log
        health {
           lameduck 15s
        }
        ready
        kubernetes {{.ClusterDomain}} in-addr.arpa ip6.arpa {
          pods verified
          fallthrough in-addr.arpa ip6.arpa
        }
        prometheus :9153
        forward . /etc/resolv.conf {
              prefer_udp
        }
        cache 30
        loop
        reload
        loadbalance
    }

Configure extended features based on CoreDNS

The following scenarios demonstrate common CoreDNS customizations:

• Scenario 1: Enable Simple Log Service

  To log all DNS resolution records, add the log parameter to the Corefile. Example:

    Corefile: |
      .:53 {
          errors
          log
          health {
             lameduck 15s
          }
          ready
          kubernetes cluster.local in-addr.arpa ip6.arpa {
            pods insecure
            fallthrough in-addr.arpa ip6.arpa
            ttl 30
          }
          prometheus :9153
          forward . /etc/resolv.conf {
                prefer_udp
          }
          cache 30
          loop
          reload
          loadbalance
      }

• Scenario 2: Customize DNS servers for specified domain names

  To resolve domain names with a specific suffix (such as example.com) through a custom DNS server (such as 10.10.0.10), add a custom resolution block. Example:

  example.com:53 {
    errors
    cache 30
    forward . 10.10.0.10 {
    prefer_udp
    }
  }

  Configuration:

    Corefile: |
      .:53 {
          errors
          health {
             lameduck 15s
          }
          ready
          kubernetes cluster.local in-addr.arpa ip6.arpa {
            pods insecure
            fallthrough in-addr.arpa ip6.arpa
            ttl 30
          }
          prometheus :9153
          forward . /etc/resolv.conf {
            prefer_udp
          }
          cache 30
          loop
          reload
          loadbalance
      }
      example.com:53 {
          errors
          cache 30
          forward . 10.10.0.10 {
          prefer_udp
          }
      }

• Scenario 3: Customize DNS servers for external domain names

  When domain names that require custom DNS resolution do not share a common suffix, forward all external queries to your custom DNS servers.

  For example, to forward queries to DNS servers 10.10.0.10 and 10.10.0.20, modify the forward parameter. Example:

    Corefile: |
      .:53 {
          errors
          health {
             lameduck 15s
          }
          ready
          kubernetes cluster.local in-addr.arpa ip6.arpa {
            pods insecure
            fallthrough in-addr.arpa ip6.arpa
            ttl 30
          }
          prometheus :9153
          forward . 10.10.0.10 10.10.0.20 {
            prefer_udp
          }
          cache 30
          loop
          reload
          loadbalance
      }

• Scenario 4: Customize hosts for specified domain names

  Use the hosts plug-in to map domain names to static IP addresses, similar to the /etc/hosts file. For example, to point www.example.com to 127.0.0.1:

    Corefile: |
      .:53 {
          errors
          health {
             lameduck 15s
          }
          ready
          
          hosts {
            127.0.0.1 www.example.com
            fallthrough
          }
        
          kubernetes cluster.local in-addr.arpa ip6.arpa {
            pods insecure
            fallthrough in-addr.arpa ip6.arpa
            ttl 30
          }
          prometheus :9153
          forward . /etc/resolv.conf {
            prefer_udp
          }
          cache 30
          loop
          reload
          loadbalance
      }

  Important

  You must specify the fallthrough parameter in hosts. Otherwise, domain names not listed may fail to resolve.

• Scenario 5: Enable external access to services in an ACK cluster

  To allow a process on an ECS instance in an ACK cluster to access services in the cluster, set the nameserver in the /etc/resolv.conf file on the ECS instance to the cluster IP address of kube-dns. Do not modify other settings in the /etc/resolv.conf file.

  For internal network access, use an internal-facing Classic Load Balancer (CLB) instance to expose services in the ACS cluster. Then, log on to the Alibaba Cloud DNS PrivateZone console and add an A record that points to the private IP address of the CLB instance. For specific steps, see Add a PrivateZone DNS record.

• Scenario 6: Use a domain name to allow access to your service in an ACK cluster or enable CNAME resolution for an ACK cluster

  Use foo.example.com to expose your service in an ACK cluster to the Internet, internal networks, and intra-cluster access. To enable this:

  • Your service foo.default.svc.cluster.local is exposed to external access using an Internet-facing CLB instance. The domain name foo.example.com is resolved to the IP address of the Internet-facing CLB instance.

  • Your service foo.default.svc.cluster.local is exposed to internal access using an internal-facing CLB instance. Log on to the Alibaba Cloud DNS PrivateZone console to point foo.example.com to the IP address of the internal-facing CLB instance in the virtual private cloud (VPC) where the ACK cluster is deployed. See Configure unmanaged CoreDNS.

  • Use the rewrite plug-in within the ACK cluster to add a CNAME record to point foo.example.com to foo.default.svc.cluster.local. Example:

      Corefile: |
        .:53 {
            errors
            health {
               lameduck 15s
            }
            ready
            
            rewrite stop {
              name exact foo.example.com foo.default.svc.cluster.local
              answer name foo.default.svc.cluster.local foo.example.com 
            }
    
            kubernetes cluster.local in-addr.arpa ip6.arpa {
              pods insecure
              fallthrough in-addr.arpa ip6.arpa
              ttl 30
            }
            prometheus :9153
            forward . /etc/resolv.conf {
              prefer_udp
            }
            cache 30
            loop
            reload
            loadbalance
        }

• Scenario 7: Configure CoreDNS not to return IPv6 addresses that are resolved based on AAAA records

  If your pods do not need IPv6 (AAAA record) resolution, configure CoreDNS to intercept these queries and return NODATA to reduce unnecessary data transfer. Example:

    Corefile: |
      .:53 {
          errors
          health {
             lameduck 15s
          }
          # Add the following line to enable the template plug-in. Do not modify other settings. 
          template IN AAAA .
      }