Cloud Native Computing Foundation KubeCon + CloudNativeCon Europe 2019 (Barcelona), 22 May 2019

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Intro: CoreDNS - Daniel Garcia, Infoblox & Michael Grosser, Okkur Labs

Description

Join us for Kubernetes Forums Seoul, Sydney, Bengaluru and Delhi - learn more at kubecon.io

Don't miss KubeCon + CloudNativeCon 2020 events in Amsterdam March 30 - April 2, Shanghai July 28-30 and Boston November 17-20! Learn more at kubecon.io. The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects

Intro: CoreDNS - Daniel Garcia, Infoblox & Michael Grosser, Okkur Labs

CoreDNS is a flexible and extensible DNS server with a focus on service discovery. Best known for its ability to serve as the cluster DNS of Kubernetes, CoreDNS is now the default DNS and part of the Kubernetes release since 1.13. The flexibility and extensibility of CoreDNS comes from its unique plugin-based architecture and its easy to use Corefile configurations. In this Intro session, we will update the current state and the road map of CoreDNS for the near future. We will share feedbacks from the community about CoreDNS intergration in Kubernetes 1.13. The progress of DNS resolver support will be discussed heavily as well, since there are lots of interests from the community. At the end of the session we will show several Corefile examples that is commonly configured and used in different scenarios to help getting started with CoreDNS.

https://sched.co/MPhU

A

Hey everybody welcome to the core Dena's intro and we're going to get you to know a bit about cárdenas its plugins and what its are about, basically and how that relates to cuban Eddie's. So, let's jump into who we are.

B

My name is Daniel Garcia I'm, an engineer, Infoblox we're a DNS technology company and early adopter of core DNS, and we use it for some internal use. Cases also for our product that we offer called active trust. End point.

A

Hey I'm Mike aggressor, maintainer on Cardenas and contributing kubernetes I'm running an open source research lab called aqua labs with a project with a few projects. One which is related to DNS is Tex direct, which mlct do text tag, DNS text record paste, redirects and also Benny yells for go imports, docker images and stuff like that and on the commercial side, we're supporting companies will record solutions on kubernetes, Google Cloud and basically also ran global services shed as NS, which is a good base, DNS provider with anycast Network all around the world.

A

If you want to follow me on twitter, it's SVG IP for updates.

B

So we'll go through many we'll go through many things today today, we'll cover the state of affairs of core DNS things on the roadmap. You'll also get to hear about all the most commonly used plugins and the details about where to find more information about them. We'll cover the guiness config file format, the core file you'll, see examples of how to use those plugins and how they correspond to configurations in the core file and finally, you'll learn how to participate in our community and get details on how to contribute. Ok,.

A

So, let's jump into the intro of the intro. Basically, but don't worry, we won't go into full recursion here. We will just go into a bit of the overview. So core dienes is a flexible DNS server written in go it's based on caddy, so caddy is a web server written in go and recently turned one to be precise. It turned version. One said it's built on a stable framework and has a lot of flexibility that flexibility basically comes from an extensible plug-in based system. So we chain different plugins together to answer queries.

A

So how is that related? Or what's the history behind it who started cárdenas and why so cárdenas was started by meek and the legend is that he wanted to add awesome metrics to his DNS server at that time bind, but that turned out to be kind of difficult. So he it seems like the better choice or the easier choice was just to write and use DNS server from scratch, because you know that's all what were you gonna do all day right.

A

So, let's see what basically is supported so normal udp-based and tcv based DNS queries are supported, but also more advanced protocols, or our sees one, for example, would be Dinah's over TLS and a few more, such as a DNS of https, might be in the future. So, let's see what else we have in the general overview, so something that is probably interesting to you is the Kuban etics part. So Cortinas is used as the central dns point inside of a Cuban, a nice cluster.

A

Specifically, it's used as a service discovery mechanism in communities, that's done by the Cuban edge plugin.

A

Additionally, Cardenas can read data different data sources or antiquaries for different data sources. In that regard, it could be a DNS zone file, conforming to our c 1035, which is usually called the bind file format.

A

It can also do data sources such as AWS route, 53 and other data sources that either we already have or that you could write plugin for so, let's see what it can do yet, so it sort of can be a recursive DNS server by basically doing all the basically by forwarding all the requests to an actual recursive for recursive servers such as Google Open DNS, that might change so there's an implied, pull request that adds that functionality, the resolver functionality as a plugin, which is called the resolver plugin.

A

So we see how that goes, and maybe you can contribute to that. If you feel that's a feature you want or need. So what's the state of affairs, the state of affairs is it's version, 1.1 dot, 5.0 that was recently released and also it's quite stable. Cn CF has different stages for projects. The first is sandboxing. We sort of jumped over that because it didn't have that at the time.

A

So we started with inception and then incubation in 2018 and graduated at the third project overall in CN CF to ever graduate that was 2019 at the beginning. So, let's see what the community is about, so the community we have about 150 maintainers, hopefully that's growing and hopefully growing with you and also it's maturing with different use cases and more Yusuke use in cuba, Nettie's itself. So to to add to that we have around 4,000 stars and 30 public adopters.

A

So if you use Q&A cárdenas either inside kubernetes or with your own use case, please add yourself: please tell us your use cases, and maybe you issues so the general state of affairs in relation to humanities, it's generally available since 11.1 dot 11. So it's already there and most likely already runs inside UQ, a nice cluster. That's because the recommendation and the recommended default from DNS perspective and for the service discovery move from being cube, Tina's to being coordinates by default, such as tools like cube, a DM.

A

They usually even upgraded to 1.5 to 0 and that's in Cuban Aires since 1.13. So what is coming in terms of new plugins we have to that might be interesting. One is any which is basically blocking the any queries which might usually be abused for DNS, specific attacks, and things like that. So if you run Cardenas in an authoritative or like generally public on the Internet, you might be interested in that that's coming and also rate limiting, which might be interesting either for internal applications or also, if you run it on the open Internet.

A

So how does that relate to the rest of the community? So everybody most of you most likely know that Google is doing a google Summer of Code, so we also participate that there through CN CF, so CN CF always lets us give a lot of ideas.

A

So if you have or if you want to contribute something and don't have an idea yet just look on the G sock page and find, if there's an idea that isn't already taken up in terms of google Summer of Code, there was one project accepted and it's mostly allowing and blocking based on the source IP on the request.

A

So let's jump in to a feature that is not there yet. So the feature is a book. I mean everybody needs. A book as a feature right, so a book is coming jumperer, merrick and cricket aliyou arriving it currently and it wouldn't be fun if he couldn't use DNS to link to it right. So, if you want to take a peek at what's already out there, you can read the first few chapters it's booked at cárdenas that open source software, the drugs because of you know, that's true right.

A

So, let's jump into the roadmap. Let's first basically finish up what the current state is, what the future state is and then jump into the nitty-gritty of how to configure it, how that looks and how you might use it.

A

So there are few things plans and lets them split them up into the core part and the plug-in part. The core part is mostly getting it more stable in performance improvements and general iteration on the code splitting up different package packages and things like that. On the plug-in side, one interesting idea is to iterate on the protocol, so DNS is known to another service already and software, so that won't go away.

A

But with the recent protocol iterations such as DNS over HTTP or over TLS, there might be a reason to also go in the direction of G RPC and with that there might be an interesting Avenue to actually have watch based DNS protocol. So that might be an interesting iteration and then also, as I said before, HT DNS over HTTP is not yet supported, but that, hopefully it comes as a plug in sooner than later. So, as mentioned before, the resolver plugin is something that might be coming and in generally, a lot more.

B

Great, so, let's go over the different plugins that we have in Cordia NASA. First we'll talk about the data plugins core dns needs data to serve up requests right, so we'll cover some basic plugins here. The first we'll cover is the the file plugin file. Plugin, basically lets you take the bind data format. What's called a define data format or RFC 1035, it lets you take those files and serve them up as authoritative data inside of core DNS. The next one is auto, which is very similar to to file, except that lets.

B

You specify entire directories of files of zone data to pull into core DNS. It's very configurable and allows you to specify regular expressions for domains which it's authoritative for another common one and you'll see it later on today. Is that the forward plugin for word lets you proxy requests to another server. It may be proxying to another core DNS instance may proxy out to the internet or to an internal corporate server that you'll have host file plug-in basically lets you.

B

Do the Etsy host file format for answering requests if you're used to DNS mask and how it loads stuff out of XE host? This is very similar and then there's the one that we should mention is the proxy plugin which is deprecated but you'll, see it a lot in blog posts and documentation. But you should know it's deprecated and you should just use the forward. Plugin.

B

So, besides the data there's helper plugins to help Kourtney and s, and you kind of get things done right. So the first one I want to mention is the reload plugin and lets you reload the core file or the configuration file automatically there's configurations for it so allow it to watch the file reloaded all without note, without any downtime to your service. The errors plugin lets you output errors that are happening in your request chain. It's very configurable. You can set things like a specific type of request or error that you want to log.

B

You can coalesce errors so that you don't get a whole lot of noise inside your error file. For instance, you can say that I only want one instance of this thing over the last 30 seconds, so you don't get bombarded with the same type of errors over and over again the log plugin does exactly. We expect it logs request. It's also very configurable. You can specify. Besides the format, you can specify the types of queries that you want log. Maybe you only want to log, see names or text or SRV requests.

B

There is a Prometheus plugin for me, this plug-in lets. You expose the Prometheus endpoint for Prometheus to scrape view from within the cluster or or from externally, but if you're interested in how your server is performing, what types of queries it's doing, it's used for analytics and scaling and debugging it's a very useful plugin to enable next one is the cache plugin and that will let you cash DNS, queries right. It's very configurable! Also. It lets you cache both positive and negative queries and set TTLs for them and also lets you perform prefetches.

B

If something enters the catch, you can perform a prefetch on it before it expires the very useful option. If you want to keep high performance for certain domains,.

B

So probably most of you are interested in kubernetes related plugins that are integrated in it. We do have support the the main plug-in is called kubernetes and it loads the kokuboro Navy's secret and lets you talk to the kubernetes api by just deploying it within kubernetes, but it can it that, basically, it answers pod, IP information zone data from within kubernetes. We also have a etsy d plugin that you can have authoritative data in that CD.

B

There's also other types of databases available, s3 Amazon s3 is was mentioned but or Rob 53, as was mentioned earlier.

B

There's a health plugin basically implements the health endpoint in a pod to know if your pot, your core Deanna's pot, is healthy and similarly there's a readi plugin that implements the readiness check to know if your core DNS pod is ready to receive traffic and and handle requests.

B

So these aren't all the plugins that are that we have there's over 35 built-in plugins, there's a whole bunch of external plugins, and please go on to these links find out if there's a use case that supported for what you need and if there's not open a request and see if the other people are interested in your particular use case, and it's extremely easy to write your own plugin. So you can always make a pull request and other like-minded people will start looking at your code and maybe they'll start using it as well.

B

So, first, let's cover the the file format. So at the very top of the file format here, you'll see you have to implement the zone that your authoritative for and the port that you want to run on. So usually this deep pulse to default, support, 53 and then you can put whatever zone a dot is basically the root zone. So if you want to be authoritative for every request, you just put a dot and if you want to omit the port, you can just omit the port and it'll default to port 53.

B

After the initial stanza you'll have the configuration for all your plugins right and each plug-in is, is declared on a separate line, and if you want to declare, maybe the arguments get too long for a particular plugin. You can open another stanza and specify the arguments on a per line basis for that particular plugin. The comments are defined using the hashtag or pound and they basically comment to the end of the line. It's pretty simple, then, let's jump into one of the example configs. Yes,.

A

As we seen, you can basically do a lot of things and one of the interesting things if you don't just run in cuban Eddie's, but actually have you internal access, only accessible DNS server is running it as an authoritative, DNS server. So the configuration as we've seen here is basically, we have coordinated I/o, which is the zone its authority.

A

For so it will only answer, queries for that specific zone and anything else will be ignored or depending on how you configure it fallback to an upstream server, but in this case it's authoritative for that specific domain and it will load a data source from a data source. In that case, it's the file plug-in.

A

So it's using a database file or a file in bine format, which is loaded in so in this case, as we've said a scene before we basically mention the plug-in and then coordinates that IO is the actual file that is being loaded in and then we jump into the Stan, sir. So that's additional additional configuration for the plugin. In this case it's transferred to you with two arguments. One is a wild-card. It basically enables zone transfers and basically making it available, Authority apology for secondary servers, or maybe it's even in primary hidden set up.

A

So you don't expose it, but you only expose it to like a secondary set or your DNS provider, which then moves all around the world and the second one is another interesting one, so the second IP basically to transfer to will get notifications. So every time it reloads the file, it notices file, changes by default and you can tweak the reload time but generally if the change is accepted and also basically public. You get notifications to that specific server.

A

So you can do it in a push type way to make your general DNS propagation a lot faster, and then we have like two small plugins that are, as we say, seen, sort of help applicants, because we want to have insight in what are the errors. So we have the error plug-in and then also the logging plugin. So that's just giving you insight in all the different queries that are coming in, including what are the? What are the requests and what are the specific answers?

A

Quite granular, depending on how you configure it.

B

Right and as we mentioned before, a core DNS is not a recursive DNS server, but you can effectively get that behavior by using the forward plugin that we talked about earlier. So in this configuration here, we're forwarding request to the Google DNS service right, and that is a recursive resolver. So using this configuration basically, you can have core DNS proxy those requests to that external server and have that recursive behavior. You can also use this for maybe forwarding to your internal corporate DNS. If you had such a solution like that.

A

Okay, so what else do we have, especially in your queue, bananas, cluster or with a few different application times? One is, for example, no Jess. No jazz is really higher or rear horrible in terms of using DNS. It won't catch, usually so on every request, you're doing an actual DNS lookup and that might overwhelm your centralized, coordinates and inside the humanities. Crusher and might also add a lot of other problems.

A

Either you overload it or you might have packet drops or you run into issues like your contract table, runs out of space to basically put things, and then you also fall back to basically dropping packets. So what basically means what that basically means for your application? Is it won't work as reliably because just can't resolve DNS? So in that case there are two options available to you in Cuban IDs one is basically a cluster plug-in or cluster add-on, which is called the node local class ahead on.

A

It will basically run cárdenas demon, set right on each node and use that as like a cache and a span out option. So all the queries come in like say you know: J application is a node a instead of request, sending requests to the central DNS server inside your class sure it will send all the DNS requests to the local one, which is able to cache it to also answer over UDP.

A

So your application doesn't need to know anything, but if it needs to forward because it's not in the cache yet it can by default, go a different protocol route. It basically enforces TCP, which then works around any UDP issues in your network and additionally, which might help with rate limiting issues for your upstream server. It will also use each specific node to you for external DNS lookups. So if you forward something that is not cluster internal, that node local cache will push the DNS queries right to your upstream server instead of year.

A

Central one and the second one which we're looking at here is basically a sidecar container. So you have a lot more control over what your application and dns does. In this specific case, it's the simple case so you're, basically adding a sidecar which is responding to all queries. So all zone data will get answered and it's just adding a cache with a 30 second TTL and for avoiding all queries to correct, which is Google, DNS server and then enforcing TCP to work around any UDP issues.

A

And then we have the two helpers again and if you want to know more about the node local one, we have the link here and the slides are online. So you can always check what we did. Just a small shout-out to Pavitra at Google, she's, pushing the node, local cluster add-on and that's awesome and hopefully even want to test it. Do that.

B

Another common use case that people have is exposing services websites on their kubernetes cluster, and sometimes you have these sites that are have SSL certificates on them right and if you access those endpoints from within your cluster, you have traffic, goes from within your cluster out to the load, balancer and then back into your fabric, and it would be nice if those things resolved internally. So that's something you can do with the rewrite plugin, and here we have a configuration for the rewrite plugin.

B

That's basically saying we're: gonna rewrite this external domain, WWV example.com and we're gonna, rewrite it to a name, an endpoint within the cluster right. So with this configuration, your your application will make a call out to this applet. This Web endpoint and it'll get an internal address, so the request never leaves the fabric, never leaves your cluster and you're stable, still able to use the same certificate that used for your external endpoint, which is nice thing to do.

B

So. How is all this working? It's useful to build a mental model. This isn't exactly the architecture for core DNS, but it's a good mental model about how things are. Processing write, requests come in the front, they have a stands of configuration. You know what am I a thora Teta for what ports am I listening on and then there's configuration for your plugins right. So it's it's important to know that all the plugins are compiled into core DNS right, based on the configuration in your core file.

B

These plugins get enabled with certain parameters who are not enabled and really what happens, is there's a chain of a chain of calls that happens and either you've configured a plug-in or not configured a plug-in which in case it skips over it. So you can imagine how this turns into a core file based on you know, which ones that are enabled and what their parameters are.

A

So, let's jump into the community, so we really want to engage everybody and have you seen before there are few or a few avenues where you might reach out to have either on issues, ideas or generally get involved. The most active ones are github, so please start by starting get up. If that's something you want to do we're also available on select select of CNC F dot, IO and the channel is basically Cortinas, and then we have a few more. So we have our web, which also has our deployment.

A

A shin with is cárdenas today, oh, and we have us blocked with updates on also updates on what changed in versions what might be deprecated and things like that on block dodd cárdenas that I am, we also have the mailing list, which is really non noisy and a few focus updates on twitter at accordion, as I have so as I said before, you see, there's there's a real need for contributors for every open, such project, especially around what you're, using it for the main use case, as we've seen in this context, is probably Cuba Nettie's, but they're a lot more and we want to know about it and if that code, you're, actually using on top, is open source even better.

A

So if you have your company and not not added yet to adapters, do that and if you are interested in helping out either join the discussion in issues open bug, reports or start with a Doc's or general code PR. There are a lot of things that you can do so great.

B

And these are the only this: isn't the only talk for core DNS today, there's another you can meet one of the maintainer later on today at the CN CF answer barge on Bela mark will be there and he's out the co-author of the book that we mentioned earlier and tomorrow, there'll be a deep dive with Jung, tang and John Bell mark I, think in the same room, and that session should probably be of interest to you. If you want to learn more about how core DNS works in some advanced use, cases also.

A

There's another session which we don't have on the slide, but we mentioned node local before and there's a talk from Petra from Google and she will talk about more in depth. What what fixes? Basically, why it fixed and in what way. Just look that up on the schedule.

A

Thank you and we're open for questions.

A

Also, as we said before, all the slides, including the links to the different plugins and links to the project tears and in general documentation and things like that, is all in the slide deck and that's uploaded to the schedule. Any questions.

A

Not really so note local does a few more things. So note local one of the main thing that it does is circumvent the contract table and that isn't done with a sidecar. It sort of can be done and it also does in a way, but the the recommended approach is just use, node, local and if that works perfect, because it also is a better end point for your cache. Basically, it's per node instead of per pod. So if you run ten pods on one node, you're not going to have a lot of cache hits basically.

A

So the recommended approach is no local, because it's easier to set up, that's better maintained than probably what you can do, but if it's something that you want to customize more use the sidecar approach, yeah, there's any other questions.

B

Sure so all all the plugins you have to explicitly enable them. There's a default configuration that you can look at inside of kubernetes and you'll, see which ones are enabled. But when you use rewrite you have to configure it and there are capturing groups, reg X's, that you can use to make patterns. So that could, if you find a pattern that you've reuse, that's certainly something you can do but yeah in general, you have to configure the different rewrites.

A

Any other questions all right years, so on that note, and they rewrite, for example, so how its configured internally is that there's a config map for the actual code file. So you can access that and rewrite that, but that's not the recommended approach, because that might break updates and things like that. So if you want to have a rewrite feature, basically most likely, you can use a sidecar, so you can inject it there.

A

So your patient doesn't need to know about it, but you still have a lot of control about where that rewrite feature basically lies, which is the sidecar configuration and the other thing is, you might have your own internal DNS, any other questions.

A

If not, then I think we can finish up and thank you for being here.