►
Description
Join us for Kubernetes Forums Seoul, Sydney, Bengaluru and Delhi - learn more at kubecon.io
Don't miss KubeCon + CloudNativeCon 2020 events in Amsterdam March 30 - April 2, Shanghai July 28-30 and Boston November 17-20! Learn more at kubecon.io. The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects
Deep Dive: CoreDNS - Yong Tang, MobileIron & John Belamaric, Google
CoreDNS is a flexible and extensible DNS server with a focus on service discovery. It is written in Go and has a unique plugin-based architecture. This means CoreDNS could be easily extended with customized plugins for new functionalities. If some functionality is not provided out of the box, you can add it if you know how to write in Go. In this deep dive session, we take a detailed look at the service discovery and plugin system of CoreDNS. We will demo a simplified version of a plugin that achieves source IP based service discovery. By walking through the complete code base of this demo plugin, we will showcase the ease of convenience to implement a custom plugin for serving new functionalities.
https://sched.co/MPjH
A
Let's
get
let's
get
study
yeah
thanks
for
everyone.
Coming
to
this
session
talk.
My
name
is
yang
Tong
I'm,
a
mental
coordinates
project.
It
says
this
is
Jang.
Panoramic
he's
also
a
coordinates.
Project
maintenance
bill
by
the
way
is
to
briefly
introduce
Jung.
He
is
also
out
of
a
couple
books
and
one
of
the
book
is
about
the
introduction,
learning
Cortinas
and
this
book
is
currently
in
preview.
So,
if
you
have
any
interest
you
can
process
through
the
book
online.
B
A
A
Kusum
for
today's
agenda.
We
are
going
to
go
through
several
things.
First,
we're
going
to
give
a
brief
introduction
on
Kadena's
I.
Think
a
lot
of
people
may
already
familiar,
but
just
for
completeness
will
least
several
point.
Four
coordinates:
we're
also
going
to
provide
a
brief
study,
what's
updated
for
various
plugins
viacom
to
discuss
about
google
Summer
of
Code
and
finally,
we'll
go
into
the
technical
tip
type,
which
Chang
will
spend
a
lot
of
time.
A
Just
just
briefly
introduce
coding
s
coding,
s
is
a
flex
audience
ever
written
ago.
It
has
a
focus
on
service
discovery,
according
as
plug-in
based,
which
means
is
very
flexible
and
it
could
easily
be
extended
for
external
and
additional
functionality
is
at
the
moment.
Cody
has
is
a
diva
TS
server
I
think
we
get
in
we
get
into
communities
in
1,000,
and
we
reach
status
of
default
in
1014
as
a
self
supported,
Tina's,
yes,
or
what
us
at
the
eyes
of
a
gr
PC
the
Dean
has
a
watch.
A
A
Coding
has
also
have
wrought
professor
Tina's
sync
up,
which
allows
you
to
sync
up
for
your
kubernetes
cluster
ways:
AWS
rafacz
history
service,
the
finally
coding
as
I,
started
and
lead
by
MacGibbon.
He
is
a
very
energetic
and
he
spent
most
of
time
on
github,
so
I'm
sure
everyone
can
see
him
now.
If
you
want
to
find
him
I'm
going
to
discuss
about
some
of
the
community
updates
for
the
past
year.
So,
first
of
all,
we
have
for
148
contributor
as
moment
so
big
thanks
to
anyone
that
contribute
to
coordinates.
We
have
16
maintenance.
A
We
have
29
public
adopters,
the
top
the
list
is,
it's
actually
a
public
at
a
police,
which
means
we
only
least
those
cuss
users
that
willing
to
allow
us
to
use
a
name
so
I'm
sure
there
are
a
lot
more
users
in
especially
in
kinetic
community.
And
finally,
we
have
a
lot
more
github
stars
compared
with
last
year,
actually
like
a
couple
less
than
four
thousand
Stan.
That's
a
big
achievement
by
the
way,
if
anyone
has
not
started
coding
as
yet
you're,
probably
can't
just
approach
button
now,
four
quadrants
community.
A
If
you
want
to
find
help,
you
can
always
find
help
from
github.
That's
the
most
active
one.
Sectional
is
another
one.
That's
very
active,
ching
chong
is
instruction
almost
all
time.
We
have
other
resources
website.
We
have
a
blog.
We
have
twitter.
The
cuckoo
group
is
not
very
actually
maintained,
so
that's
that's
not
some
place.
If
you
want
to
search
for
help.
A
One
thing
I
wanna
mention
is
that
sank
from
Google.
We
actually
participate
in
google
Summer
of
Code
three
years
in
a
row
in
2007
volume.
The
accountability
as
tab
in
2018
judgment
encounter
to
integration
of
putting
us
way,
CT
CD,
and
this
year
we
also
have
a
proposal
accepted.
So
that's
a
big
achievement.
A
B
Well,
thanks
everybody
for
being
here.
I'm
I
was
a
little
surprised,
so
many
people
show
up
to
talk
about
DNS,
but
glad
you're,
all
here
so
I'd
like
to
leave
a
lot
of
time
for
questions
at
the
end.
In
the
past.
With
these
deep
dives,
we've
had
a
lot
of
questions.
Hopefully
it'll
be
the
same
today,
but
talk
a
little
bit
about
changes
really
in
core
DNS
that
have
happened
since
it
became
the
default
in
kubernetes.
So
today
are
in
1.13.
B
B
B
So
we
want
to
give
enough
time
and
we
want
to
come
up
with
a
tool
that
will
will
help
people
migrate,
very
minor
changes,
but
just
things
that
have
to
be
tweaked.
In
any
case,
in
the
last
cube
comm,
we
talked
a
lot
about
QWERTY
and
ass
in
kubernetes
and
went
into
a
lot
of
detail.
We
didn't
have
a
talk
on
that
this
time,
but
I
at
least
wanted
to
take
some
time
to
talk
about
some
of
the
new
things.
B
One
of
the
thing
things
that's
available,
if
you,
if
you
do
update
to
the
newer
version
of
Cordy
and
ass,
is
this
new
plugin
called
the
Kate's
external?
So
we
had
a
you
know
the
the
the
kubernetes
DNS
service
discovery
specification,
which
is
what
the
kubernetes
plugin
implements
is,
is
really
just
for
internal
cluster
DNS.
But
of
course,
if
you're,
exposing
your
services
with
load
balancers
with
a
load
balancer
or
with
external
IPs
it'd,
be
nice
to
be
able
to
have
a
way
to
publish
those
externally
as
well.
There's
a
project
called
external
DNS.
B
That's
that
can
do
this
pretty
flexibly,
but
for
really
simple
use
cases.
Instead
of
having
to
run
a
whole
other
controller,
and
do
all
of
that,
we
added
this
que
its
external,
you
enable
this
plug-in
and
it
will
allow
you
to
basically
create
another
zone
that
contains
the
any
load,
balance
or
services
or
external
services
with
external
IPS
it'll.
Allow
you
to
publish
those
under
that
under
that
domain,
so
it
still
follows
a
very
specific
schema.
B
If
you
do
do
this,
though,
it's
probably
a
best
practice
to
run
a
separate
instance
of
Cordy
and
asked
to
do
this,
just
so
that
you
don't
let
anybody
from
the
outside
wedge
your
your
DNS
cluster
DNS,
just
for
safety.
Other
interesting
changes,
the
core
file
you'd,
have
in
an
existing
kubernetes
cluster
will
use
something
called
a
proxy
plug-in.
We
deprecated
that
and
moved
it
and
replaced
it
with
something
called
forward.
B
B
Knowing
that
the
API
server
is
synced
fully
to
Cordy
and
s
before
we
start
serving
traffic
for
it,
the
probably
the
only
other
incompatible
change
is
we
pulled
out
the
upstream
option.
This
is
kind
of
like
a
small
detail,
but
that's
one
of
the
things
you
would
have
to
change
in
your
core
file.
If
you
were
to
upgrade,
you
have
to
just
take
that
option
out.
The
default
behavior
now
is
to
do
what
it
did
the
way
it
was
configured
before.
Oh.
B
I
forgot
I
had
a
slide
actually
specifically
on
the
back
reading
to
pedal
changes.
So
these
are
the
kind
of
changes
and,
of
course,
these
slides
are
available.
It's
probably
easier
than
going
through
em
one
by
one.
So
since
we
didn't
have
the
talk
on
courteous
in
general,
I
did
at
least
want
to
help.
People
understand
how
queer
DNS
resolves
a
query.
So
when
you
go
and
look
at
the
core
file,
so
a
core
file
is
our
configuration
file.
It
consists
of
a
number
of
stanzas
and
each
stanza
starts
with.
B
Can
you
see
the
cursor
on
there?
Yeah
starts
with
a
domain
and
a
port
and
typically
it'll
all
be
the
same
court,
because
you
only
serve
things
on
one
port.
All
these
get
gathered
up,
but
queries
get
routed
through
these
plug-in
chains.
Each
each
stanza
defines
a
set
of
plugins
or
operations
that
you
want
to
do
on
the
request,
and
so
you
can
have
a
different
set
of
operations
based
upon
the
zone
of
the
query.
B
So
in
this
particular
example,
what
we're
showing
is
that
we
have
organization
comm,
runs
through
the
errors
and
cache
plug-in
without
a
high
TTL
of
3600
and
the
on-prem
that
organization
comm
runs
through
those
same
plugins,
but
it
reduces
the
the
maximum
time.
We
keep
something
in
the
cache
to
300
seconds
and
it
also
forwards
to
a
different,
a
different
upstream
server,
whereas
any
other
domain
so
dot.
B
Any
other
domain
will
go
through
this
other
set
of
plugins
in
particular
to
communities
to
the
out
to
the
internet
or
whatever
it
may
be
so
I
guess
now.
If
it
looks
like
we
do
have
time,
we
have
plenty
of
time.
We
can
talk
a
little
bit
about
how
to
be
able
to
plug
in
so
what
we'll
talk
about
here
is
how
to
build
a.
This
is
just
a
simple
demo
plug-in
it's
available
on
our
github
as
well.
It's
a
stupid
plugin!
B
B
So
it's
really
simple:
to
make
a
plug-in.
It's
really
just
three
functions.
Typically,
you
put
them
in
two
files.
We
have
a
setup
file.
The
setup
file
just
has
a
significant
that
an
it
function,
registers
the
plug-in
with
caddy.
So
one
of
the
kind
of
strange
things
about
core
DNS
is
that
we
use
this
web
server
framework
called
caddy.
So
it's
a
it's
a
go
based
web
server
that
was
Bill
by
a
Matt,
Holt
I,
don't
know
years
ago,
and
and
when
we
initially
did
Cordy
and
aspirin.
B
When
meek
did
it,
he
he
liked
that
plug-in
or
middleware
type
of
model,
and
so
he
said
well,
I'll
just
fork
that
and
start
building
it,
and
so
we
built-
or
he
built
this
core
DNS
server
on
that
forked
caddy
and
then
we
said:
well,
that's
sucky
to
fork
it.
So
we
actually
back
that
out
and
pulled
it
in
as
a
library
and
work
with
Matt
to
make
it
into
actually
more
of
a
general
server
framework.
B
So
all
of
the
basic
server
lifecycle
management,
the
parsing
of
the
configuration
file,
the
creation
of
the
server,
the
response
to
signals
to
reload
your
configuration
file,
graceful
reloads.
All
of
that
stuff.
We
got
for
free
of
candy
and
we
just
had
to
implement.
You
know
more
or
less
the
specific
DNS
logic,
but.
B
Which
is
surprising,
they're
pretty
different
protocols,
so,
but
what
that
means
is
that
you'll
see
if
you're
writing
plugins,
you
see
you're
interfacing
with
some
of
the
Cadi
libraries
and
in
particular
around
parsing
of
the
configuration
file.
So
that's
why
we
say
we
register
it
with
caddy
we're
registering
that
function.
B
We
can
actually
look
like
like
Jung
said.
This
is
very
few
lines
of
code.
To
do
this
kind
of
thing
you
can
see
the
anit
plugin
is
essentially
one
function,
call
or
the
unit
the
unit
call
and
demo
just
consumes.
The
the
tokens
out
of
a
configuration
file
and
regimen
adds
the
plug-in
to
the
what's
called
the
plug-in
chain
so
like
we
saw
in
the
way
that
the
queries
are
resolved.
You
have
these
different
paths
that
the
query
can
go
through.
B
Each
of
those
paths
corresponds
to
a
series
of
plugins
that
call
one
another
and
I
said
say
they
passed
the
request
down.
They
say
if
I
didn't
handle
this
request.
I
need
to
pass
the
request
down
to
the
next
plug-in
to
handle
it,
and
so
that's
essentially
registering
with
that
that
that
chain,
the
serve
DNS
method
itself
receives
a
context.
B
B
We
do
in
order
to
let
plugins
do
more
sophisticated
things
where,
for
example,
the
we
have
something
called
a
non
writer
response
writer
so
that,
if
any
downstream
plug-in
one
plugin
can
wrap
that
response
writer
when
they
call
the
next
one
and
then
any
of
those
downstream
ones.
When
they
write
the
packet
it
just
gets
stored
in
memory,
the
one
that
that
wrapped,
it
then
can
unwrap
it
and
play
with
it
and
do
what
it
wants
and
and
send
it
back
to
the
client.
B
C
B
Packet
in
order
to
get
that
to
work,
you
need
to
rebuild,
of
course,
and
well.
Well,
of
course.
Actually
let
me
go
back
on
that.
Go
until
recently
was
pretty
much
completely
static
compiled,
so
you
didn't
have
any
way
to
do
dynamically.
Loaded
modules
you
can
now
and
go,
but
a
downside
to
using
caddy
is
that
it
handles
all
of
that
for
us
and
they
have
not
moved
to
the
newer
go
plug-in
method,
so
we
but
I'm
going
and
doing
that
for
caddy.
B
B
In
any
case,
though,
once
you
do,
then
this
core
file
would
work.
It
would
read
the
demo
and
it
wouldn't
puke
on
it
and
and
you'd
go
ahead
and
I.
Don't
know
if
you
have
this
actually
working
somewhere
and
you
want
to
run
it
but
building
it
this.
This
shows
you
how
to
build
it
with
with
doctor.
We
we
have
a
doctor,
you
know
we
it's
much
simpler
to
just
use
the
bill.
Lang
docker
image,
if
you
don't
have
a
go,
much
set
up
already.
B
B
The
plugin
that
CFG
so
essentially
the
way
that
accordion
s
decides
what
plugins
to
compile
in
is
this
plug-in
dot,
CFG
and
then
there's
a
go
generate
call
that
will
actually
build
a
go
file
that
pulls
in
all
those
plugins,
and
so
you
can
disable
plugins
as
needed
and
rebuild
to
make
it
smaller
like
with
later
today.
There's
this
node
local
DNS
cache
for
kubernetes
talk.
You
may
want
to
go
to
4:45.
D
B
A
B
So
recently
we
moved
couriers
to
using
go
modules
so
that
what
that
means
for
those
go
developers
in
the
crowd
is
that
you
no
longer
need
to
put
it
under
your.
You
know,
go
path,
you
just
build
it
in
any
directory
and
it
it's
much
nicer
than
I
used
to
be
that's.
What
we're
seeing
is
it's
pulling
down
all
those
other
things
that
are
in
the
go:
module.
B
E
B
E
B
Yeah,
that's
what
you'll
do
in
that
setup
function,
so
the
setup
function
will
if
your
configuration
violates
the
Cadi
syntax,
you
might
have
some
trouble,
but
if
you're
making
it
up-
and
you
can
do
whatever
you
want-
keep
it
within
the
Cadi
syntax
which
which
is
pretty
flexible
and
then
you'll.
Just
in
your
setup
function
you
just
it
token
is
tokenize.
Is
it
for
you
and
you
just
put
in
whatever
configure
on
and
you.
So
if
you
look
at
some
of
the
examples,
this
one
only
has
one
thing.
E
B
B
D
E
D
B
B
We
call
them
so
plugins
are
the
ones
that
are
built-in
by
default,
so
they're
in
that
default,
plug-in
CFG
and
then
other
people,
who've
written
plugins
that
do
other
stuff
or
even
members
of
our
community,
who
are
like
even
me,
Crowe
has
written
some
external
plugins
that
you
know
use
Redis
for
a
cache,
for
example,
that
may
not
be
as
useful
for
everybody,
so
we
don't
build
them
in
by
default.
Just
keep
the
binary
from
not
getting
too
big,
but
the
question
was:
how
do
we?
How
do
we
know
what
we
can
upstream?
B
How
do
we
know
what
what
should
stay
external,
the
the
first
part
or
the
further
the
first
part?
What
do
we
know
what
to
upstream?
It's
really
just
comes
down
to
do.
We
think
it's
pretty
widely
useful,
and-
and
is
it
not
too
complicated?
Is
it
does
it
not
bring
in
a
tons
and
tons
of
dependencies
like
kubernetes
brings
in
a
ridiculous
amount
of
dependencies,
but
it's
really
really
useful
for
one
of
our
main
use
cases.
So
it's
there,
many
other
things.
Wouldn't
we
wouldn't
bring
in
if
they
brought
in
too
many
dependencies.
B
B
So
I
guess
the
short
answer
is
put
it
in
github
and
you
can
get
it
on
our
main
website.
If
you
want
to
built-in
make
sure
it's
really
useful
to
everybody
and
you
have
good
documentation.
Yes,
thank
you.
Mike
Michael,
grocer,
here's
another
one
of
our
contributors
and
maintainer,
so
he's
helping
out.
G
Is
there
any
plan
that
there's
some
mechanism
that
you
don't
have
to
be
live
inside
as
I
mean
it?
It's
really
looking
a
lot
like
terraform
providers
that
for
for
a
long
time
they
were
part
of
tariffs
or
until
that
was
completely
unmanageable.
So
it's
better
to
to
maintain
the
life
cycle
of
a
plug-in.
If
you
see
if
it's
different
binary,
yeah.
B
I
mean
that
would
be
ideal
if
we
had
something
like
you,
go
the
go
plug-in
it's
dynamically
loaded
but,
like
I
said
that
unless
we
were
to
break
from
caddy
which
in
enormous
undertaking
or
we
implemented
for
caddy
like
right
now,
they're
not
using
go
plugins.
So
what
they
do,
which
is
interesting
and
we
could
consider
doing-
is
on
their
website.
You
can
actually
go
in
and
if
there's
50
different
plugins,
you
can
check
a
box
and
push
a
button
and
it'll
go
build
it
for
you
and
give
you
the
binary
I.
B
B
H
On
the
on
the
a
note
before
so
because
we
moved
to
go
modules,
it's
much
much
easier.
It's
basically
you
pull
in
the
core,
Dinah's
library
or
sort
of
as
a
library,
so
basically
have
your
setup
function
and
then
that
one
pulls
in
cárdenas.
So
you
can
build
it
from
your
own
repository
by
just
doing
go,
build
or
using
your
CI.
So
it's
really
simple.
Since
we
used
or
we
jumped,
you
go
modules
and
also
Kelly
is
looking
into
like
using
the
go
plugin
system,
because
just
that's
a
pain
for
them
as
well.
So.
G
F
B
F
B
I'm
not,
but
in
general
the
answer
is
no.
You
shouldn't
really
ever
have
to
any
downtime,
so
you're,
it's
completely
stateless.
When
it's
running
in
kubernetes,
it's
just
it's
caching,
everything
from
the
API
server.
If
you
kill
one
of
those
pods,
the
other
ones
will
be
fine
and
and
and
still
serve
traffic.
I
mean,
of
course,
there's
some
delays
based
on
the
queue
proxy
service.
B
F
B
F
B
And
if
you
want
to
add
it,
if
you
update
the
core
file,
if
you
change,
if
you
do
a
new
build
and
you
have
a
new
image
new
binary,
then
you're
gonna
create
you're
gonna
create
new
pods.
But
if
all
you
do
is
change
the
core
file,
it
will
just
reload
it
and
as
long
as
you
don't
screw
it
up,
you'll
be
ok.
If
you
screw
it
up,
so
you
should
never
do
it.
B
Like
I
live
on
a
production
system,
it
will
actually
reject
the
the
the
reload
and
it
will
continue
running
just
fine,
but
that
that
persistent
volume
or
the
config
volume
that's
got
that
config
map
on
it
now
has
a
bad
core
file.
If
you
kill
that
pod
and
a
new
pod
starts
up,
it's
never
going
to
start
so
yeah.
Don't
do
that.
C
A
Okay,
yeah!
There
are
several
different
things.
First
of
all
know.
If
you
look
at
Deena's
and
people
talking
about
the
L,
say:
okay
DNC,
so
this
table,
but
it's
actually
UDP
base
an
OTP,
not
necessarily
going
to
guarantee
your
reliability,
and
if
we
encounter
some
errors
or
in
the
middle
of
the
data
transport,
you
could
encounter
error
that
can
be
very
hard
to
track.
But
for
rapid
rate,
the
question
is
related
to
its
API.
Is
that
it
obvious
API?
How
is
our
a
TPS
so
you're
actually
guaranteed?
A
At
least,
if
you
see
arrow,
you
can
see
the
arrow
like
in
TCP
mode.
That's
why
advantage
another
advantage
is
a
security
security
I
mean?
Certainly
if
you
use
D,
as
of
course
you
can,
you
can
use
like
us
over
to
us
to
protect
your
data
but
which
a
TPS
it's
hard
to
begin.
Another
advantage
is
that
you
actually
avoid
and
Vernon
as
very
hard
to
config
situation
when
you
are
in
a
VPN.
A
You
only
need
to
access
the
API
point
of
AWS,
which
is
actually
what
was
available
and
you
can
get
the
data
now.
If
you
want
to
sync
a
data,
you
know
certain
VPN
or
anything.
Your
data
is
already
there
whether
or
not
the
data
is
expose
about
to
to
your
to
your
to
a
node
in
your
cluster.
That's
another
question,
but
at
least
it
has
wide
annealed
to
set
up
direct
communication
between
your
set
up
direct
communication
between
Adi,
quoting
a
server
and
the
DNS
server
on
AWS.