coredns (System Resource Add-on, Mandatory)

Introduction

CoreDNS is a DNS server that provides domain name resolution services for Kubernetes clusters. CoreDNS chains plug-ins to provide additional features.

CoreDNS is an open-source software and has been a part of CNCF. It provides a means for cloud services to discover each other in cloud-native deployments. Each of the plug-ins chained by CoreDNS provides a particular DNS function. You can integrate CoreDNS with only the plug-ins you need to make it fast, efficient, and flexible. When used in a Kubernetes cluster, CoreDNS can automatically discover services in the cluster and provide domain name resolution for these services. By working with DNS server, CoreDNS can resolve external domain names for workloads in a cluster.

This add-on is installed by default during cluster creation.

Kubernetes backs CoreDNS as the official default DNS for all clusters going forward.

CoreDNS official website: https://coredns.io/

Open source community: https://github.com/coredns/coredns

Note

For details, see DNS.

Constraints

When CoreDNS is running properly or being upgraded, ensure that the number of available nodes is greater than or equal to the number of the add-on pods and all the add-on pods are running. Otherwise, the upgrade will fail.

Installing the Add-on

This add-on has been installed by default. If it is uninstalled due to some reasons, you can reinstall it by performing the following steps:

  1. Log in to the CCE console and click the cluster name to access the cluster console. Choose Add-ons in the navigation pane, locate coredns on the right, and click Install.

  2. On the Install Add-on page, configure the specifications.

    Table 1 Add-on configuration

    Parameter

    Description

    Add-on Specifications

    Concurrent domain name resolution ability. Select add-on specifications that best fit your needs.

    If you select Custom qps, the domain name resolution QPS provided by CoreDNS is positively correlated with the CPU consumption. Adjust the number of pods and container CPU/memory quotas as required.

    Pods

    Number of pods that will be created to match the selected add-on specifications.

    If you select Custom qps, you can adjust the number of pods as required.

    Multi-AZ

    • Preferred: Deployment pods of the add-on will be preferentially scheduled to nodes in different AZs. If all the nodes in the cluster are deployed in the same AZ, the pods will be scheduled to that AZ.

    • Required: Deployment pods of the add-on will be forcibly scheduled to nodes in different AZs. If there are fewer AZs than pods, the extra pods will fail to run.

    Containers

    CPU and memory quotas of the container allowed for the selected add-on specifications.

    If you select Custom qps, you can adjust the container specifications as required.

  3. Configure the add-on parameters.

    Table 2 Add-on parameters

    Parameter

    Description

    Stub domain settings

    A domain name server for a custom domain name. The format is a key-value pair. The key is a domain name suffix, and the value is one or more DNS IP addresses, for example, acme.local -- 1.2.3.4,6.7.8.9.

    For details, see Configuring the Stub Domain for CoreDNS.

    Advanced settings

    • parameterSyncStrategy: indicates whether to configure consistency check when an add-on is upgraded.

      • ensureConsistent: indicates that the configuration consistency check is enabled. If the configuration recorded in the cluster is inconsistent with the actual configuration, the add-on cannot be upgraded.

      • force: indicates that the configuration consistency check is ignored during an upgrade. Ensure that the current effective configuration is the same as the original configuration. After the add-on is upgraded, restore the value of parameterSyncStrategy to ensureConsistent and enable the configuration consistency check again.

      • inherit: indicates that differentiated configurations are automatically inherited during an upgrade. After the add-on is upgraded, restore the value of parameterSyncStrategy to ensureConsistent and enable the configuration consistency check again.

    • stub_domains: A domain name server for a user-defined domain name. The format is a key-value pair. The key is a suffix of DNS domain name, and the value is one or more DNS IP addresses.

    • upstream_nameservers: IP address of the upstream DNS server.

    • servers: nameservers, which are available in CoreDNS v1.23.1 and later versions. You can customize nameservers. For details, see dns-custom-nameservers.

      plugins indicates the configuration of each component in CoreDNS. Retain the default settings typically to prevent CoreDNS from being unavailable due to configuration errors. Each plugin component contains name, parameters (optional), and configBlock (optional). The format of the generated Corefile is as follows:

      $name  $parameters {
$configBlock
}

      Table 3 describes common plugins. For details, see Plugins.

      Example:

      {
     "servers": [
           {
            "plugins": [
                {
                    "name": "bind",
                    "parameters": "{$POD_IP}"
                },
                {
                    "name": "cache",
                    "parameters": 30
                },
                {
                    "name": "errors"
                },
                {
                    "name": "health",
                    "parameters": "{$POD_IP}:8080"
                },
                                {
                    "name": "ready",
                    "{$POD_IP}:8081"
                },
                {
                    "configBlock": "pods insecure\nfallthrough in-addr.arpa ip6.arpa",
                    "name": "kubernetes",
                    "parameters": "cluster.local in-addr.arpa ip6.arpa"
                },
                {
                    "name": "loadbalance",
                    "parameters": "round_robin"
                },
                {
                    "name": "prometheus",
                    "parameters": "{$POD_IP}:9153"
                },
                {
                    "configBlock": "policy random",
                    "name": "forward",
                    "parameters": ". /etc/resolv.conf"
                },
                {
                    "name": "reload"
                }
            ],
            "port": 5353,
            "zones": [
                {
                    "zone": "."
                }
            ]
        }
    ],
    "stub_domains": {
        "acme.local": [
            "1.2.3.4",
            "6.7.8.9"
        ]
    },
    "upstream_nameservers": ["8.8.8.8", "8.8.4.4"]
}
    Table 3 Default plugin configuration of the active zone of CoreDNS

    plugin Name

    Description

    bind

    Host IP address listened by CoreDNS. You are advised to retain the default value {$POD_IP}. For details, see bind.

    cache

    DNS cache is enabled. For details, see cache.

    errors

    Errors are logged to stdout. For details, see errors.

    health

    Health check configuration. The current listening IP address is {$POD_IP}:8080. Retain the default setting. Otherwise, the CoreDNS health check fails and CoreDNS restarts repeatedly. For details, see health.

    ready

    Whether the backend server is ready to receive traffic. The current listening port is {$POD_IP}:8081. If the backend server is not ready, CoreDNS suspends DNS resolution until the backend server is ready. For details, see ready.

    kubernetes

    CoreDNS Kubernetes plug-in, which provides the service parsing capability in a cluster. For details, see kubernetes.

    loadbalance

    Round-robin DNS load balancer that randomizes the order of A, AAAA, and MX records in the answer. For details, see loadbalance.

    prometheus

    Port for obtaining CoreDNS metrics. The default zone listening IP address is {$POD_IP}:9153. Retain the default setting. Otherwise, prometheus cannot collect CoreDNS metrics. For details about, see prometheus.

    forward

    Any queries that are not within the cluster domain of Kubernetes will be forwarded to predefined resolvers (/etc/resolv.conf). For details, see forward.

    reload

    The changed Corefile can be automatically reloaded. After editing the ConfigMap, wait for 2 minutes for the modification to take effect. For details, see reload.

  4. Click Install.

Components

Table 4 CoreDNS components

Container Component

Description

Resource Type

CoreDNS

DNS server for clusters

Deployment

How Does Domain Name Resolution Work in Kubernetes?

DNS policies can be set on a per-pod basis. Currently, Kubernetes supports four types of DNS policies: Default, ClusterFirst, ClusterFirstWithHostNet, and None. For details, see https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/. These policies are specified in the dnsPolicy field in the pod-specific.

  • Default: Pods inherit the name resolution configuration from the node that the pods run on. The custom upstream DNS server and the stub domain cannot be used together with this policy.

  • ClusterFirst: Any DNS query that does not match the configured cluster domain suffix, such as www.kubernetes.io, is forwarded to the upstream name server inherited from the node. Cluster administrators may have extra stub domains and upstream DNS servers configured.

  • ClusterFirstWithHostNet: For pods running with hostNetwork, set its DNS policy ClusterFirstWithHostNet.

  • None: It allows a pod to ignore DNS settings from the Kubernetes environment. All DNS settings are supposed to be provided using the dnsPolicy field in the pod-specific.

Note

  • Clusters of Kubernetes v1.10 and later support Default, ClusterFirst, ClusterFirstWithHostNet, and None. Clusters earlier than Kubernetes v1.10 support only Default, ClusterFirst, and ClusterFirstWithHostNet.

  • Default is not the default DNS policy. If dnsPolicy is not explicitly specified, ClusterFirst is used.

Routing

Without stub domain configurations: Any query that does not match the configured cluster domain suffix, such as www.kubernetes.io, is forwarded to the upstream DNS server inherited from the node.

With stub domain configurations: If stub domains and upstream DNS servers are configured, DNS queries are routed according to the following flow:

  1. The query is first sent to the DNS caching layer in CoreDNS.

  2. From the caching layer, the suffix of the request is examined and then the request is forwarded to the corresponding DNS:

    • Names with the cluster suffix, for example, .cluster.local: The request is sent to CoreDNS.

    • Names with the stub domain suffix, for example, .acme.local: The request is sent to the configured custom DNS resolver that listens, for example, on 1.2.3.4.

    • Names that do not match the suffix (for example, widget.com): The request is forwarded to the upstream DNS.

**Figure 1** Routing

Figure 1 Routing

last updated: 2024-03-27 00:22