►
Description
Don’t miss out! Join us at our upcoming events: EnvoyCon Virtual on October 15 and KubeCon + CloudNativeCon North America 2020 Virtual from November 17-20. Learn more at https://kubecon.io. The conferences feature presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects.
CoreDNS for Hybrid and Multi-cloud - Yong Tang, MobileIron
This session will cover CoreDNS configurations in hybrid and multi-cloud environments, including serving DNS record provided by cloud vendors such as AWS (Route53) and GCP (Cloud DNS), supporting DNS over TLS and DNS over gRPC for securing DNS data communications, managing zone data with records shuffling and reordering for service workload rebalancing, and finally deploying CoreDNS in multiple Kubernetes clusters across multi-cloud for service discovery. This session is intended for people familiar with basic CoreDNS configurations but wishing to extend CoreDNS’s functionality in complicated scenarios. It is important to mention that the flexibility and ease of use allow CoreDNS to solve many real-world problems with brevity.
https://sched.co/Zeib
A
A
A
A
A
A
A
Obviously,
that's
because
coordinates
at
the
time
was
a
fork
of
caddy
http
web
server
over
the
years
coordinates
and
academy
has
decoupled.
Gradually,
although
there
are
some
common
infrastructure
remains,
for
example,
and
most
importantly,
the
plug-in
basic
actual
architecture
still
comes
from
caddy
web.
A
A
A
That's
very
much
tied
to
the
cloud
native
ecosystem,
for
example,
coordinates,
has
extended
dns
protocols
such
as
the
dns
over
tos
and
dns
over
grpc,
as
you
might
notice,
grpc
protocol
is
rpc
protocol.
That's
used
very
widely
in
many
clouds,
cncf
project
things
like
kubernetes
itself,
heavily
utilize,
the
grpc
by
utilizing
grpc
core
dns.
It
essentially
behaves
the
same
in
cloud
native
ecosystem.
A
Another
big
point
of
coordinates
is
that
coordinates
is
a
defaulting
server
in
kubernetes,
as
some
of
you
probably
probably
know
coding
assets
being
used
in
kubernetes
inc,
as
some
of
you
might
already
know,
coordinates
has
been
shipped
as
part
of
the
sorry.
Okay,
as
some
of
you
might
already
know,
coordinates
has
been
shipped
as
a
part
of
kubernetes
distribution
since
several
versions
ago,
and
if
you
use
quantities
you
are
going
to
use,
coordinates
for
your
service
discovery
in
coordinates
that
in
coordinates
and
kubernetes.
A
The
default
mode
for
deployment
is
the
so-called
in-cluster
mode
in
class
mode.
You
have
a
coordinates
deployed
as
as
a
kubernetes
service
by
itself,
and
all
other
services
will
depend
on.
Kubernetes
will
depend
on
coordinates
service
for
service
discovery,
but
some
people
may
not
know
that
coordinates
can
actually
be
deployed
out
of
the
cluster
as
well.
A
Another
interesting
point
about
coordinates
is
the
cloud
integration
coordinates.
Has
many
cloud
integrations
from
for
several
vendors?
We
have
aws
raw
533
support.
We
have
a
google
cloud
dns
and
the
driving
as
support
as
well.
The
reason
we
have
a
fairly
good
cloud
integration
is
that
the
this
allows
coordinates
to
behave
as
a
friend
for
many
back
and
backhand
dns
record.
A
A
A
The
second
plugin,
that's
rotavis3,
which
allows
you
to
sync
up
your
route53ds
record
on
aws.
The
third
plugin
we
use
here
is
the
host
plugin
host
plugin
allows
you
to
add
additional
inline
record.
We
are
going
to
discuss
that
fairly
shortly.
You
also
have
health
plug-in
free
health
check
and
permissive
plugin
for
monitoring.
A
A
This
means
all
the
other
dns
query
by
default
will
be
forwarded
to
google
public
dns
and
and
then
we
have
the
host
plugin,
which
here
we
only
add
one
line.
That
is,
we
add,
inline
dns
record
of
www.example.org
to
point
to
192.0.0.100.,
and
that's
it
that's
all.
You
need
to
do
to
make
some
interesting
application,
interesting
data
certifications.
A
When
you
run
coding
us,
which
is
a
call
file,
you
can
check
the
check
that
they
check
the
dns
query
with
a
dig
and
you
could
see
from
the
from
the
bottom
of
the
screen.
If
you
type
like
type
www.example.org,
the
return
will
be
the
record
you
you
pass
through
in
your
profile,
so
this
one
example
might
be
might
be
too
simple,
but
it
gives
you
a
lot
of
possibilities.
A
Just
imagine
you
are
I.t
admin
and
you
have
a
fairly
big
organization
with
let's
say
you
have
a
50
dns
record,
you
need
to
add,
but
you're
not
very
familiar
with
dns
protocol
and
you
you're
not
even
even
sure
how
to
handle
the
different
format
in
dns
zone
file.
So
what
you
could
do
is
you
just
add
a
full
back
plan
of
pointing
your
your
dns
server
to
forward
the
queries
to
google
public
dns
and
for
any
internal
dns
record.
A
A
A
He
actually
asked
a
question
and
the
question
was
that
he
used
the
host
plugin
to
host,
like
tens
of
thousands
of
ds
record
and
he's
still
able
to
do
that
by
this.
Tens
of
thousands
of
dns
record
in
in-house
plug-in
you'll
probably
get
a
sense
of
how
big
the
dns,
how
how
scalable
coordinates
could
be
and
how
useful
and
easy
how
useful
and
the
how
easy
coding
is.
A
The
reason
you
want
to
add
additional
security
is
that
dns
by
itself
by
default,
udp
protocol
and
the
udp
as
as
we
all
know,
are
not
very
secure.
So
what?
If
someone
hijacks
the
fake
some
package
and
fix
some
dns
replies
and
poison,
your
dns
server,
you
want
to
establish
some
secret
connection
to
make
sure
the
traffic
are
coming
from.
You
are
according
a
server
and
connect
to
the
google
public
dns
in
the
in
the
most
secure
way.
A
Of
course,
you
can
achieve
that
with
dns
over
tos,
which
is
a
functionality
supported
by
coding
as
other
box
with
with
dinner
with
dinner
somewhat
us,
all
you
need
to
do
is
add
the
prefix.tos
and
that's
it
from
the
the
the
core
file
on
the
bob.
You
could
see
you
add
the
tls
column,
slash
for
slash
and
all
the
traffic
will
be
connected.
All
the
traffic.
All
the
dns
query
will
be
forwarded
to
google
public
dns
in
a
secure
way,
and
you
have
nothing
to
worry
about.
A
A
A
A
Well,
coordinators,
the
big
advantage
for
coordinates
is
that
coordinates
is
able
to
consolidate
data
from
different
sources.
It
can
come
from.
It
can
sync
up
data
to
aw
router
industry.
It
can
sync
up
data
for
microsoft,
withdrawal.
It
can
sync
up
the
data
for
google
cloud,
but
some
people
may
ask
a
question
say
in
this
day
and
age,
where
sdn
is
so
easy
and
sda
is
easily
available
in
many
places,
do
we
really
have
a
need
for
dns?
A
A
So,
first
of
all
thing
is
it's
a
nice
introduction,
even
though
we
say
steam,
you
might
be
able
to
assign
a
server
or
service
in
with
a
fixed
ip
address.
You
never
know
what's
going
to
happen
next,
so
maybe,
for
example
like
in
in
year
one
you
all
yourself
is
deployed
on
aws
and
you
have
a
ikea
address
now.
Next
year
you
may
decide
for
some
reason.
You
want
to
move
everything
to
a
private
data
center
or
you
want
to
move
everything
to
google
cloud.
A
It
may
not
be
so
easy
if,
if
our
infrastructure
is
ip
based,
but
with
dns,
it's
super
easy
to
to
just
change
the
dns
record
to
so
that
the
same
dns
name
will
be
mapped
to
a
dia
mapped
to
a
different
ip
address.
This
actually
gives
you
much
flexibility.
You
need
to
to
counter
anything
surprising
in
the
future.
A
Another
reason
for
for
dns
to
be
used
in
service
discovery
is
that
dns
is
easy
and
simple,
as
we
have
shown
in
the
in
the
past,
slide
coding
itself
is
a
system
that
has
been
designed
and
designed
with
the
philosophy
of
simplicity
in
mind.
You
can
easily
add
a
record,
you
can
think
of
different
sources
and
it
can
can
be
easily
deployed
in
many
formats.
A
A
And,
finally,
another
reason
for
dns
to
be
used
in
service
discovery
is
that
dns
by
itself
is
very
pervasive
in
it.
Infrastructure
dns
has
been
there
in
many
years
and
over
the
years,
a
lot
of
things
change,
although
dns
pretty
much
remain
the
same.
So
in
any
it
infrastructure,
you
could
see
dns
out
of
the
place
and
your
system
can
be
easily
integrated
into
into
existing
item
infrastructure,
no
matter
how
legacy
that
could
be.
A
So,
let's
recapture
the
profile
we
showed
just
a
moment
ago
to
to
revisit
why
coordinates
could
be
a
good
choice
in
this
profile.
We
invoke
many
plugins,
but
I
want
to
point
out
one
more
thing.
Those
plugins
actually
consist
of
at
least
four
different
data
sources.
The
first
is
a
cognitive
plug-in.
That
means
you
can
you
can
think
of
the
data
saved
in
x4d,
exposing
kubernetes
api
server
for
your
for
your
services
deployed
in
kubernetes,
the
second
plugin
route
53.
A
This
plugin
allows
you
to
easily
connect
your
service
in
connect,
the
service
managed
by
aws
on
aws
cloud
and
the
host
plugin
could
be
something
in
your
item
organization,
where
you
have
some
random
servers
or
big
box
servers
sitting
there
standalone
serving
some
special
need,
and
finally,
you
have
full
you
have
before
the
plug-in,
which
means
all
the
other
ds
queries
will
be
processed
by
another
dns
server.
We
use
cloudflare
cloudflares
1.1.1.1
as
a
example,
but
this
one
can
be
can
be
replaced
by
anything
a
server
of
your
choice.
A
We
discussed
about
the
coordinates
and
we
want
to
get
into
the
interesting
part
of
multi-class
deployment
for
coding
us,
I'm
sure
many
of
you
already
know
how
to
deploy
coordinates
in
a
standalone,
coordinated
cluster.
But
what,
if
you
have
module
clustered?
What,
if
you
have?
What?
If
you
have
a
cluster,
that's
located
in
different
places
like
some
cluster
might
be
in
your
private
data
center?
Some
cluster
might
be
on
aws
and
some
cluster
might
be
on
google
cloud.
A
In
order
to
achieve
that,
there
are
some
requirements
to
to
make
this
happen
as
a
networking
level.
So,
first
of
all,
all
your
clusters
has
need
to
have
a
non-overlapping
cluster
side
block.
This
is
understandable
because
if
kata
ip
address
space
has
has
to
be
unique
in
order
to
allow
one
class
to
talk
to
another
cluster
and
secondly,
any
ip
allocated
within
any
cluster
should
be
drawable
from
any
other
cluster.
A
This
may
not
be
so
straightforward,
because
many
many
kubernetes
deployment
assume
the
the
internal
ips
are
not
visible,
but
you
can
still
make
this
happen
like
in
you
know
in
you.
You
can
certainly
add
additional
route
to
your
to
your
raw
table
to
allow
traffic
to
to
be
accessible
from
one
cluster
to
another
sometime
by
changing
raw
tables
in
vpc
or
sometimes
add
additional
route
or
switches
as
needed
and
finally
multi-cluster
deployment.
A
A
If
you
truly
make
a
model
cluster
to
be
managed
by
one
could
be
products
by
one
could
be
proxy
system,
then
essentially
that
became
one
cluster,
so
it
loses
all
the
benefit.
You
try
to
all
the
all
the
benefits
you
try
to
bring
in,
so
we
are
only
going
to
discuss
about
the
heavily
service,
but
even
without
this
service,
it
still
gives
you
plenty
of
enhancement.
A
Essentially,
all
you
need
to
do
is
to
move
coordinates
outside
of
kubernetes
worker
node
and
make
sure
coordinates
can
reach
the
api
server
in
the
core
file
itself.
As
you
can
see,
you
should
add
an
entry
called
endpoint
and
specify
the
address
of
the
api
server,
and
that
should
be
all
you
need
to
to
allow
coding
to
sync
up
api
server
and
get
out
the
service
record.
A
You
also
need
to
specify
cluster
dns
cluster
dns
of
your
kubernetes
cluster
to
point
to
coding
site
address
so
that
they
could
locate
the
they
could
send
the
dns
query
to
coordinates,
and
that's
it.
That's
other
out
of
class
deploy
why
out
of
class
deploy
is
important,
because
this
is
that
this
is
exactly
what
you
need
in
order
to
make
a
multi-cluster
deployment.
A
In
multi-class
deployment
you
may
have
model
clusters,
and
you
want
to
have
your
you
want
your
coordinates
to
to
grab
the
service
record
from
both
api
servers
on
two
classes.
How
how
to
achieve
that?
The
default
kubernetes
cluster
may
now
be
able
to
reach
lego,
but
there
is
an
external
plug-in
called
kubernetes
plug-in.
A
You
can
utilize
this
plug-in
to
to
to
make
the
multi-cluster
deployment
available.
Kubernetes
plug-in
behave
exactly
same
as
the
kubernetes
plug-in.
The
only
difference
is
the
kubernetes
plug-in
for
kubernetes
plug-in.
You
can
specify
as
many
kubernetes
cluster
as
possible
and
you
use
endpoint
to
point
to
the
api
service
of
each
cluster.
A
A
172.13.20.10
you
specify
kubernetes
plug-in
twice
the
first
cluster
you
assign
a
domain
name
of
class1.local,
the
second
cluster.
Your
assigned
domain
name
are
cluster2.local
with
that
simple
profile.
You
achieve
the
goal
of
your
service
to
talk
to
each
to
talk
to
each
other,
but
the
only
glitch
is
that
your
service
is
still
separated.
A
A
With
this
configuration,
as
you
could
see,
if
a
service,
if
a
service
is
reachable
in
the
is
ritual
within
the
same
cluster,
it
will
be
reached
if
it's
not
reachable.
The
according
us
will
actually
fall
back
to
the
second
cluster
and
the
bachelor
service
for
you.
So
that
means,
if
you
deploy
two
services
of
the
same
name
into
clusters
and
and
that
could
serve
as
fault
tolerance,
because
you
have
two
you
actually
can.
A
Okay,
we
are
a
little
bit
running
out
of
time,
so
I
I
want
to
speed
up
a
little
bit
and
discuss
for
the
hybrid
cloud
and
the
multicloud.
So
what
is
hybrid
cloud
hybrid
cloud
essentially
give
you
essentially
means
you
deploy
kubernetes,
both
on-prem
and
and
down
the
clock.
This
is
an
interesting
situation
where
there
are
some
in
suc
situation
you
do
want
to.
You.
Don't
want
some
some
of
the
survey
to
be
deployed
differently,
but
by
itself.
A
A
We
do
want
to
to
showcase
couples
to
show
to
explain
how
coding
has
handled
cloud
integration,
because
that
caused
a
lot
of
confusion
in
coordinates.
People
asked
how
the
coding
has
talked
to
awa
rottweiser,
it's
actually
not
through
the
udp
traffic,
as
many
of
many
people
believed
it's
actually
through
the
aws
roughly
api
api
endpoint.
A
In
this
way,
the
traffic
is
done
through
hps,
which
is
much
more
secure,
which
also
means
you.
You
can
carry
the
same
authentication
and
authorizations
right
and
policy
and
under
I
am
and
policies
and
the
rules,
because
it's
https
it's
also
much
more
reliable,
because
tcp
is
much
better
in
it's
much
better
in
error
handling
and
also
its
tcp
is
connection
oriented.
A
A
The
first
is
roughly
three
which
you
can
create,
which
actually
you
can
create
a
dns
zone,
aws
and
copy
the
the
the
id
here.
This
way,
the
the
domain
name
of
coding
and
start
quotient.example.org
will
be
handled
by
graphics,
3..
The
second
plugin
is
club
dns,
which
you
are
going
to
do.
A
similar
thing,
except
the
zone
is
created
on
google
cloud,
which
means
coding,
as
which
means,
if
any
any
domain
name
that
has
now
been
handled
by
roughly
3,
will
be
followed
through
and
handled
by
cloud
dns.
A
The
false
rule
is
times
through
the
optional
first
line
in
both
in
in
in
roughly
3
configuration.
Of
course,
you
can
also
add
a
fold
through
configuration
in
cloud.
Dns
field,
in
this
case
coordinates,
will
find
the
next
plugin
to
figure
out
how
to
do
if
they
still
cannot
find
a
match
in
indian's
record.
A
A
B
By
I
look
through
the
questions
to
raise
in
the
qra
bar,
so
I
think
the
first
question
is:
is
the
power
so
to
configure
coordinates
to
consolidate
the
two
different
external
dns
servers
providing
result
for
the
same
domain?
The
question
the
answer
is:
yes,
it's
definitely
possible.
If
you
look
into
some
of
the
configurations
presented
the
configuration
samples
presented
in
this
in
this
cloud,
you
probably
notice
a
lot
of
the
plugins.
Allow
you
to
specify
an
option
of
so-called
possible.
B
The
phone
through
essentially
means,
if
you
have
one
plugin,
that's
actually
trying
to
do
something,
and
this
plugin
cannot
find
the
find
the
record
from
one
back
end.
Of
course,
it's
going
to
move
to
the
next
next
plugin
allow
the
next
plugin
to
continue
searching.
So
that
should
be
possible.
I
think,
okay,
let
me
see
the
second
question
which
config
option
for
which
config
option
for
some
amendment
exists.
B
Essentially,
the
the
the
the
coordinates
according
to
the
server
itself
is
more
like
a
frontend
and
serving
the
data
record
on
the
backend.
The
management
of
the
data
record
are
mostly
handled
in
the
backend
by
different
different
plugins,
for
example.
If
you
are,
if
your
data
is
stored
in
a
zone
file
coding,
as
will
mainly
just
presenting
the
zone
file
as
a
bi
server,
and
then,
if
you
want
to
make
any
modification,
you
have
to
modify
the
zone
file
and
restart
the
coding
and
server.
B
If,
if,
on
the
hand,
your
your
backend
is
from
a
dynamically
manageable
source,
for
example,
if
you're
back
in
the
aws
has
aws
drop
registry
in
that
situation,
coordinates
should
be
able
to
just
constantly
fetch
the
direct
backend
and
for
any
update.
It
will
update
the
front
end
to
present
you,
the
dns
record,
presenting
the
updated
ds
record.
B
Okay,
the
third
question,
where
I
can
find
this
slide.
The
slide
should
be
available
on
the
on
the
schedule
on
the
schedule
of
the
cubicon
link.
If
you
still
have
trouble
finding
a
slide,
you
can
send
me
an
email.
My
email
is
available.
You
can
find
my
email
from
underneath
my
github
handle.
My
github
handle
is
my
first
name
and
the
last
name.
You
should
be
easily
find
my
email
under
send
me
email.
I
I
will
follow
the
link
that
so
that
you
can
find
the
slide.
B
A
B
I
think
some
progress
has
been
made
by
some
maintenance
and
the
contributor.
I
cannot
remember
if
it's
complete
or
not
at
the
moment,
but
I
pro
I
can
double
check
and
yeah.
That's
philip
yeah.
So
if
you
still
have
a
question
you
can
drop
me,
an
email
read
the
question
in
recording
as
a
github
repo,
and
we
should
be
able
to
answer
that
in
more
details.
B
I
understand
that
you
deploy
the
coordinates
outside
the
coordinates
as
external
service.
In
this
case,
how
do
you
deploy
that,
as
I
mentioned
in
the
presentation,
coordinates
one
coordinators
try
to
reach
out
to
kubernetes
cluster
and
get
all
the
information
our
coordinates
need?
Is
the
api
server
address
if
the
accordions
is
located
on
the
same
same
server
as
a
kubernetes
database?
Server
accordions
will
connect
to
api
server,
get
all
the
information
needed
and
the
coordinates,
of
course
will
expose
a
port
533
as
a
usb
port.
B
You
can
just
set
up
your
cluster
dns
to
point
to
the
ip
of
the
core
dsid,
and
that
should
complete
your
deployment
in
case
you
want
to
have
multiple
coordinates,
model
d
and
servers
selling
your
needs.
You
can
certainly
just
locate
different
machines
outside
of
cluster
and
as
long
as
the
coordinates
can
reach
and
reach
to
the
api
server,
you,
your
congratulations
server.
B
The
coordinates
id
can
be
feeding
to
the
cluster
configuration
as
a
bs
as
the
dns
server
id
so
like
I
said,
even
though
in
in
class
that
requirement
mode
coordinates
can
be
considered
as
part
of
the
cluster
and
as
part
of
the
service.
But
if
you
really
jump
outside
of
this
concept,
just
consider
coding
as
as
another
static
server,
you
should
notice
that,
according
as
kind
of
factory
only
need
api
server
with
kubernetes
and
you
can
reach
codings
and
your
service
will
be
ready
to
be
served.
B
A
B
The
assigned
a
zone
to
a
bpc
and
your
zone
is
not
accessible
from
anyone,
but
the
record
is
still
there
and
you
can
see
the
record
in
that
case.
If
you
deploy
coordinates,
you
could
deploy
coordinates
and
the
coordinates
is
able
to
access
the
google
cloud
api.
Actually,
you
can
just
serve
your
server,
your
dns
record,
which
should
be
accessible
inside
google
and
you
can
just
serve
it
to
outside,
maybe
your
private
utc
or
maybe
a
local
machine.
So
this
in
this
situation.
B
B
B
Okay,
I
think
I
answered
the
question
yes,
if,
for,
if
anyone
still
has
any
questions,
you
can
reach
out
to
me
or
reach
out
to
any
coding
as
antennas
in
coding
as
github
handle,
and
you
can
also
drop
out
email
to
me,
you
should
be
able
to
find
my
email
underneath
my
github
handle
again
thanks
for
joining
this.
This
talk
and
appreciate
the
help
and
appreciate
the
the
questions
raised
in
the
talk
that
certainly
is
going
to
improve.