DNS Operator in OKD

The DNS Operator deploys and manages CoreDNS to provide a name resolution service to pods, enabling DNS-based Kubernetes Service discovery in OpenShift.

DNS Operator

The DNS Operator implements the dns API from the operator.openshift.io API group. The Operator deploys CoreDNS using a daemon set, creates a service for the daemon set, and configures the kubelet to instruct pods to use the CoreDNS service IP address for name resolution.

Procedure

The DNS Operator is deployed during installation with a Deployment object.

  1. Use the oc get command to view the deployment status:

    1. $ oc get -n openshift-dns-operator deployment/dns-operator

    Example output

    1. NAME           READY     UP-TO-DATE   AVAILABLE   AGE
    2. dns-operator   1/1       1            1           23h

  2. Use the oc get command to view the state of the DNS Operator:

    1. $ oc get clusteroperator/dns

    Example output

    1. NAME      VERSION     AVAILABLE   PROGRESSING   DEGRADED   SINCE
    2. dns       4.1.0-0.11  True        False         False      92m

    AVAILABLE, PROGRESSING and DEGRADED provide information about the status of the Operator. AVAILABLE is True when at least 1 pod from the CoreDNS daemon set reports an Available status condition.

View the default DNS

Every new OKD installation has a dns.operator named default.

Procedure

  1. Use the oc describe command to view the default dns:

    1. $ oc describe dns.operator/default

    Example output

    1. Name:         default
    2. Namespace:
    3. Labels:       <none>
    4. Annotations:  <none>
    5. API Version:  operator.openshift.io/v1
    6. Kind:         DNS
    7. ...
    8. Status:
    9.   Cluster Domain:  cluster.local (1)
    10.   Cluster IP:      172.30.0.10 (2)
    11. ...
    1The Cluster Domain field is the base DNS domain used to construct fully qualified pod and service domain names.
    2The Cluster IP is the address pods query for name resolution. The IP is defined as the 10th address in the service CIDR range.

  2. To find the service CIDR of your cluster, use the oc get command:

    1. $ oc get networks.config/cluster -o jsonpath='{$.status.serviceNetwork}'

Example output

  1. [172.30.0.0/16]

Using DNS forwarding

You can use DNS forwarding to override the forwarding configuration identified in /etc/resolv.conf on a per-zone basis by specifying which name server should be used for a given zone. If the forwarded zone is the Ingress domain managed by OKD, then the upstream name server must be authorized for the domain.

Procedure

  1. Modify the DNS Operator object named default:

    1. $ oc edit dns.operator/default

    This allows the Operator to create and update the ConfigMap named dns-default with additional server configuration blocks based on Server. If none of the servers has a zone that matches the query, then name resolution falls back to the name servers that are specified in /etc/resolv.conf.

    Sample DNS

    1. apiVersion: operator.openshift.io/v1
    2. kind: DNS
    3. metadata:
    4.   name: default
    5. spec:
    6.   servers:
    7.   - name: foo-server (1)
    8.     zones: (2)
    9.       - foo.com
    10.     forwardPlugin:
    11.       upstreams: (3)
    12.         - 1.1.1.1
    13.         - 2.2.2.2:5353
    14.   - name: bar-server
    15.     zones:
    16.       - bar.com
    17.       - example.com
    18.     forwardPlugin:
    19.       upstreams:
    20.         - 3.3.3.3
    21.         - 4.4.4.4:5454
    1name must comply with the rfc6335 service name syntax.
    2zones must conform to the definition of a subdomain in rfc1123. The cluster domain, cluster.local, is an invalid subdomain for zones.
    3A maximum of 15 upstreams is allowed per forwardPlugin.

    If servers is undefined or invalid, the ConfigMap only contains the default server.

  2. View the ConfigMap:

    1. $ oc get configmap/dns-default -n openshift-dns -o yaml

    Sample DNS ConfigMap based on previous sample DNS

    1. apiVersion: v1
    2. data:
    3.   Corefile: |
    4.     foo.com:5353 {
    5.         forward . 1.1.1.1 2.2.2.2:5353
    6.     }
    7.     bar.com:5353 example.com:5353 {
    8.         forward . 3.3.3.3 4.4.4.4:5454 (1)
    9.     }
    10.     .:5353 {
    11.         errors
    12.         health
    13.         kubernetes cluster.local in-addr.arpa ip6.arpa {
    14.             pods insecure
    15.             upstream
    16.             fallthrough in-addr.arpa ip6.arpa
    17.         }
    18.         prometheus :9153
    19.         forward . /etc/resolv.conf {
    20.             policy sequential
    21.         }
    22.         cache 30
    23.         reload
    24.     }
    25. kind: ConfigMap
    26. metadata:
    27.   labels:
    28.     dns.operator.openshift.io/owning-dns: default
    29.   name: dns-default
    30.   namespace: openshift-dns
    1Changes to the forwardPlugin triggers a rolling update of the CoreDNS daemon set.

Additional resources

DNS Operator status

You can inspect the status and view the details of the DNS Operator using the oc describe command.

Procedure

View the status of the DNS Operator:

  1. $ oc describe clusteroperators/dns

DNS Operator logs

You can view DNS Operator logs by using the oc logs command.

Procedure

View the logs of the DNS Operator:

  1. $ oc logs -n openshift-dns-operator deployment/dns-operator -c dns-operator