DNS Principle Overview

In a K8S Cluster CCE, the CoreDNS component provides DNS domain name resolution services for workloads within the cluster.

CoreDNS, a CNCF-hosted project with a rich plugin set, provides domain name resolution for workloads within the cluster, including intra-cluster and extra-cluster public network domain name, private domain name, etc.

DNS principle description

The CoreDNS workload in K8S Cluster CCE has 3 CoreDNS pods by default and exposes DNS service via the service name "kube-dns". Illustrated as follows:

1# kubectl -n kube-system get svc kube-dns
2NAME       TYPE        CLUSTER-IP    EXTERNAL-IP   PORT(S)                  AGE
3kube-dns   ClusterIP   172.16.0.10   <none>        53/UDP,53/TCP,9153/TCP   13d
4# kubectl -n kube-system get pod | grep coredns
5coredns-5bcb94c99b-2g5fq                     1/1     Running   0             12d
6coredns-5bcb94c99b-x4xxk                     1/1     Running   0             12d
7coredns-5bcb94c99b-x5kjg                     1/1     Running   0             12d

The content of the DNS domain name resolution configuration file /etc/resolv.conf within pods in the cluster is as follows:

1search default.svc.cluster.local svc.cluster.local cluster.local
2nameserver 172.16.0.10
3options ndots:5

Parameter description:

• search: Domain name search suffix rules
• nameserver: The IP address of the DNS server, here referring to the ClusterIP of kube-dns
• options: Defines domain name resolution configuration file options; if the count of dot characters in a domain name is greater than or equal to the ndots value, it is considered a complete domain name and will be resolved directly; if less than ndots value, the designated suffixes in search will be appended sequentially for querying

Pods will send requests to the CoreDNS pod via the kube-dns ClusterIP (e.g., 172.16.0.10), retrieve the ClusterIP of the target service, and then initiate requests to the target service.

The DNS operating principle in a K8S Cluster CCE is illustrated below:

Customize DNS policies via dnsPolicy

In a K8S Cluster CCE, DNS policies can be applied to each pod. The following DNS policies are currently supported for specific pods. These policies can be defined in the dnsPolicy field within the Pod Spec:

• "Default": The pod inherits the name resolution configuration from the node it runs on, i.e. using the cloud-based DNS server for domain name resolution services
• "ClusterFirst": Uses CoreDNS for domain name resolution service. In pod, the nameserver in /etc/resolv.conf points to the ClusterIP of the kube-dns service
• "ClusterFirstWithHostNet": For pods running in hostNetwork mode, the DNS policy should be explicitly set to "ClusterFirstWithHostNet". Otherwise, pods running in hostNetwork mode and "ClusterFirst" policy will roll back to the "Default" policy
• "None": This setting allows pods to ignore DNS setting in the Kubernetes environment, and pod will use the DNS settings provided by their dnsConfig field

Note: "Default" is not the default DNS policy. If dnsPolicy is not explicitly specified, "ClusterFirst" is used by default.