►
From YouTube: Understanding CoreDNS in Kubernetes - John Belamaric, Google & Cricket Liu, Francois Tur, Infoblox
Description
Join us for Kubernetes Forums Seoul, Sydney, Bengaluru and Delhi - learn more at kubecon.io
Don't miss KubeCon + CloudNativeCon 2020 events in Amsterdam March 30 - April 2, Shanghai July 28-30 and Boston November 17-20! Learn more at kubecon.io. The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects
Understanding CoreDNS in Kubernetes - John Belamaric, Google & Cricket Liu, Francois Tur, Infoblox
In Kubernetes 1.11, CoreDNS is Generally Available (GA) as a DNS-based service discover option. In this presentation, we will go over the default CoreDNS configuration - "Corefile" - used when deploying CoreDNS via kubeadm. This will include a line-by-line discussion of the Corefile and what each option means, and how you can modify or customize the configuration using other features of CoreDNS. You will learn about some of the unique, Kubernetes-specific features in CoreDNS, as well as broader DNS-related features, and how to utilize those in your clusters.
To learn more: https://sched.co/GrWi
A
All
right,
I
think
we're
ready
to
get
started
first,
given
how
large
the
the
audience's
I
have
to
ask.
Are
you
all
aware
this
is
a
talk
about
DNS,
yeah,
okay,
first,
all
I'll,
just
briefly
introduce
the
three
of
us
will
be
speaking.
My
name
is
cricket.
Lou
I
am
the
chief
DNS
architect
and
an
EVP
of
engineering
for
a
company
called
Infoblox.
I
also
was
one
of
the
co-authors
of
book
called
DNS
and
bind,
which
is
a
blue
and
white
book,
with
a
grasshopper
on
the
cover
and
until
recently
I
thought.
A
I
was
the
co-author
of
all
of
O'reilly
books
on
DNS,
but
apparently
they
slipped
a
new
one
in
there.
That
I
had
nothing
to
do
with
so
I'm
not-
and
this
is
Prince
elector,
who
is
one
of
our
senior
software
managers
at
Infoblox
and
one
of
the
maintainer
zuv
core
DNS,
and
we
also
have
up
front
here.
John
bela,
mark
and
john
is
a
senior
staff
engineer
for
google.
He
did
work
at
Infoblox
up
until
recently
and
he's
also
a
core
DNS
maintainer.
A
So
here's
our
agenda
today
I'll
give
you
guys
a
really
brief
introduction.
Five
more
so
I
had
something
like
that
and
then
John
will
come
up
and
he'll
talk
about
the
cluster
default.
Configuration
for
core
DNS
will
look
a
little
bit
at
some
non
default
configurations
as
well
and
will
give
you
pointers
to
more
resources
and
with
any
luck
at
the
end,
we'll
have
a
little
bit
of
time
for
Q&A
as
well,
and
we
have
I
think
mics
and
the
aisles
so
that
we
can
actually
hear
you.
So,
let's
talk
very
broadly
about
core
DNS.
A
First
of
all,
is
a
flexible,
DNS
server,
it's
written
in
go
so
you
get
some
of
the
advantages
of
go
right
off
the
bat
you
get
a
memory
safe
executable,
which
is
a
big
deal
in
the
world
of
DNS,
because
if
you're
running
a
name
server
that's
directly
exposed
to
the
Internet,
you
want
to
make
sure
it's
not
vulnerable
to
things
like
buffer
overruns.
If
any
of
you
have
run
bind,
for
example,
over
many
years
on
an
internet
attached
host,
you
know
that
there
were
a
lot.
A
It
uses
a
plug-in
based
architecture
which
is
easily
extended.
John
actually
has
a
talk
later
on,
where
he'll
actually
go
into
some
of
that.
You'll
you'll
learn
a
little
bit
about
writing
plug-ins
for
core
DNS.
Even
if
you're,
not
somebody
who
would
be
interested
in
or
capable
of,
writing
a
plug-in
have
no
fear.
There
are
lots
and
lots
of
plugins
available
to
perform
all
kinds
of
interesting
functionality
and
there
are
more
being
written
all
the
time.
A
One
affirmation
actually
of
the
plug-in
architecture
is
that
bind
is
actually
moving
to
a
plug-in
architecture.
So
the
great
granddaddy
of
DNS
servers
is
actually
going
to
implement
a
plug-in
architecture
as
of
by
9.15
core
DNS
supports
DNS.
Of
course
it's
a
DNS
server.
It
also
supports
DNS
over
TLS,
which
we
call
dot
for
short
and
dodd,
is
kind
of
a
hot
new
technology
in
the
DNS
community.
A
So
if
you
want
to
play
with
the
cool
kids
and
set
up
your
own
recursive
server,
that
can
do
dot
and
use
your
android
p
device
in
order
to
send
encrypted
queries
to
it,
then
you
can
do
that.
Right
also
supports
dns
over
g
RPC
and
the
project
was
initiated
by
me.
Jibon
who's,
a
dutch
guy
who
lives
in
london,
works
for
goldman
sachs
and
he
also
wrote
sky,
DNS
and
sky
DNS
to
so.
He
has
experience.
Writing
thanks.
Francois
writing.
Dns
servers.
A
He
also
wrote
what
is
probably
the
most
popular
dns
library
written
in
go
and
he
looked
at
the
Cadi
web
server
and
I
think
he
admired
its
architecture
and
decided
gee.
You
know,
I
have
a
go.
Dns
library
I
could
easily
use
this
framework
in
order
to
develop
a
DNS
server,
and
that's
really
what
core
DNS
is.
A
It
boasts
all
kinds
of
integration
with
Etsy
and
other
cloud
vendors,
for
example.
If
you
have,
if
user
out
53
with
an
AWS
as
an
authoritative,
DNS
server,
you
want
to
pull
authoritative
data
into
core
DNS
and
republish
it
or
simply
use
it
in
order
to
resolve.
You
can
do
that
and
it
does
so
via
the
route
53
API.
So
you
don't
even
need
a
you
know,
direct
UDP
path
to
the
name,
server
that
you're
resolving
to
it
has
support
for
Prometheus
for
metrics.
A
It
also
is
capable
of
forwarding
to
a
recursive
DNS
server,
and
this
is
important
because
it
doesn't
actually
have
the
capability
to
act
as
a
full
service.
Dns
recurse
ur
itself,
so
it
has
to
rely
on
another
name
server
to
do
that
or
you
can
use
some
optional
plugins
some
out
of
tree
plugins.
We
have
one
called
unbound,
for
example
right,
so
you
may
be
asking
yourself
why
core
DNS
versus
the
old
cubed
DNS-
and
there
are
a
number
of
reasons.
One
is
that
plug-in
architecture
that
allows
you
to
extend
it
very
very
easily.
A
A
It
was
Q
DNS
itself,
it
was
DNS
mask
as
well
as
a
sidecar
application,
and
some
of
those
were
written
in
C
naught
and
go
right,
and
there
are
a
couple
of
other
things
that
are
maybe
in
the
category
of
esoterica,
but
still
worth
mentioning
customizable
DNS
entries,
for
example.
If
you
want
to
add
static,
DNS
data
within
the
cluster
domain,
that's
completely
unrelated
to
the
service
discovery
stuff.
You
can
do
that,
which
is
a
pretty
powerful
thing
to
be
able
to
do.
A
There's
an
experimental,
server-side
search
path,
feature
that
will
actually
speed
up
resolution,
because
what
you'll
find
is
that,
within
a
containerized
environment,
your
containers
have
these
really
long
search
lists
that
they're
going
to
go
through
to
find
a
particular
domain
name
and
cord
eNOS
can
actually
anticipate
that
it's
gonna
walk
through
all
of
the
elements
of
that
search
list
and
match
the
first
one
rather
than
waiting
to
till
the
10th.
For
example,
here's
the
project
status
we're
at
version,
1.2
dot.
A
A
B
You
thank
you
Thank
You
cricket,
so
I
will
try
to
present
now
how
it
looks
like
in
Cuban.
It
is
the
core
DNS
configuration
for
Cabana
tees.
We
do
that
in
to
set
10
minutes
about
really
the
big
picture
of
community
is
how
to
how
the
query
are
resolving
in
coordinates
and
how
then
we
can
tweak
the
configuration
for
some
easy
from
easy
change
or
easy
tweaks,
and
then
John
will
come
after
for
more
complicated
option
or
take
advantage
of
of
Co
DNS
more
deeply.
B
They
just
will
resolve
any
query
that
aims
to
have
an
IP
from
from
the
cluster
and
will
forward
upstream
every
queries
that
are
out
of
the
crystal
okay.
So
the
pods
are
the
one
that
query
and
say:
oh,
where
is
this
service,
where
this
service
always
is
domain,
so
the
domain
can
be
inside
the
cluster
or
outside
the
cluster.
B
This
button,
so
first,
let's,
let's
look
at
a
when
you
deploy
I
mean
when
Cody
and
s
is
the
punch
abilities.
What
do
you
have
so
you
have
a
service
account
a
cluster
role,
a
cluster
wall
biding
that's
very
simple,
and
then
you
have
maybe
the
more
interesting
part.
The
config
map
named
Cody
NS.
It's
where
reside
the
what
we
call
the
cockfight,
so
you
have
a
CO
file
key
with
exactly
the
the
configuration
for
coordinates.
So
this
each
time
you
will
change
the
config
map.
B
Second,
you
have
this
the
deployment
so
I
I
lighted
here
in
the
deployment.
What
is
a
little
specific,
you
have
always
at
least
two
replicas
of
core
DNS.
The
labels
I
will
go
the
labeled
later.
First,
the
image
of
coordinates
you
have
by
default
is
located
in
cuba,
Nettie's
repository,
which
means
it's
not
the
regular
regular,
the
usual
docker
hub
core
dns
repository
each
time
we
qualify
the
image
Eastham,
you
have
a
release
for
chip
entities,
we
qualify
the
image
and
push
the
image
on
the
cube,
and
it
is
repository.
B
That
is,
that
is
what
was
for
cube
DNS,
it's
what
you
what
you
need,
but
you
have
to
know
that
either
cube
your
network
or
DNS.
We
have
to
watch
all
the
service
and
the
larger
your
cluster
is
the
larger
the
more
we
will
need
memory.
So
when
you
eat
one
thousand,
not
too
thousand
odd
question,
then
you
may
have
to
tune
your
memory,
sighs,
okay,
so
it
can
go.
The
limit
is
170,
so
we
check
that
a
we
fit
into
170.
B
If
you
go
to
a
5,000
node
cluster,
but
depending
your
option,
you
may
have
to
need
more
or
less
memory
live
nice
pub.
There
is
a
pub
that
check
that
coordinates
is
running
and
if,
if
not,
then
the
scheduler
will
automatically
restart
the
pod
okay,
so
that
means
the
configuration
of
coordinates,
has
to
take
care
of
that
and
the
DNS
policy,
because
it's
its
problem,
we
see
on
on
the
supporters,
usually
each
pod
of
of
cluster
as
a
DNS
policy
called
first.
That
means
it
will
call
the
name
cervical.
B
It
will
call
Korean
s
as
the
regular
name
server
except
Corian
s,
because
you
don't
want
colonists,
try
to
call
itself
to
resolve
all
right,
so
that
is
for
the
deployment,
and
the
last
part
is
a
service
service
is
the
same
as
before
is
even
the
same
name.
It's
take
cube
dearness.
It
is
a
DNS
of
kubernetes
anyway,
there's
no
change
from
from
before,
and
that
was
expected
like
that.
It
is
the
DNS
service
anyway,
so
you
don't
want.
B
Okay,
what
is
a
default
configuration
so
in
the
config
map?
You
will
have
this
information,
which
we
call
the
core
file
and
I
would
like
to
go
so
quickly
over
each
of
the
ETM.
So
each
item
is
called
a
directive
and
the
directive
of
a
plug-in
code
analysis
based
on
plug-in
and
you
just
pile
up
all
your
plugins,
so
the
most
important
is
the
Cheban.
It
is
one
the
one
that
will
resolve
a
cuban.
It
is
request
the
that
will
resolve
the
zone
of
communities,
the
cluster
of
that
local.
B
In
fact,
that
is
a
sample
we'll
be
replaced
by
this.
The
zone
you
associate
with
your
question
that
means
Q
manatees
will
resolve
everything
that
is
in
the
cluster
load
balance
at
the
bottom
just
say:
if
I
have
several
reply
for
your
request,
I
will
try
to
simulate
your
load
balancing
by
shuffle
the
order
of
the
return
records
all
right
so
that
you
that
make
an
importance
only
for
the
Atlas
service.
Where
you
can
have
all
end
point.
Will
we
will
be
replied?
B
It's
okay.
If,
if
your
question
about
local,
then
you
will
resolve
your
query
with
kubernetes.
If
not,
that
means
out
of
cluster
domain,
so
it
will
be
resolved
outside
by
your
poxy
to
an
upstream
name.
Server,
alright
and
the
list
of
names
ever
is
by
default
in
ATC
resolve
outcome.
For
us
it
is
on
every
every
border
or
every
machine.
We
have
a
cache
40-second,
so
that
works
mostly
for
the
upstream
dns
query,
because
kubernetes
will
will
have
a
TTL
of
five.
Second,
in
fact,
next
one
is
a
loop.
B
Loop
is
just
a
very
small
plugin
that
detect
that
you
have
no
loop
in
your
resolution
of
queries
that
happen
sometime
on
some
system.
So
it's
something
that
just
stop
coordinates
if
we
detect
a
loop
in
the
resolution,
you
go
upstream
that
go
back
that
go
back
and
come
back,
so
we
just
send
a
query,
and
if
it
comes
back,
we
say:
there's
rope.
B
B
Arrow
is
just
enabling
the
logging
of
our
internal
errors
permit
use
is
to
provide
the
matrix
of
primitives
on
the
poor,
91
53,
and
this
one
is
an
important
one.
Hollowed
it
allows
it
allows
core
DNS
to
watch
its
own
core
file
and
reload
the
service.
If
you
change
the
core
file,
which
means,
if
you
change
the
configured,
then
that
will
push
the
call
file
and
call
DNS
is
watching
its
own
core
file
and
we
will
all
take
care.
B
Ok
next
thing:
before
we
tune
the
configuration,
we
need
to
work
to
see
how
how
Co
DNS
behave
and
how
it
resolves
a
query.
So
I
am
on
the
left
side.
I
have
a
sample
of
a
core
file
and
on
the
right,
I
have
its
meaning
inside
of
in
terms
of
organization
of
the
of
the
processing
of
queries.
So,
as
you
can
see
on
the
left,
you
have
three
big
parts
which
we
call
the
block
server
or
stanza.
B
One
is
organization
comm,
so
you
it
will
match
the
left
branch
of
history
of
resolution,
the
middle
one,
unclaimed
organization,
the
right
branch
and
and
the
last
one,
the
middle
branch
with
a
dot
okay.
So
each
time
on
the
on
the
blog
server,
you
have
a
domain
name
and
the
port.
You
may
I
mean
nobody
wants
in
code
in
Cuban.
B
It
is
to
change
the
port,
because
DNS
has
to
listen
to
port
53,
as
it
won't
work
all
the
other
products
just
to
send
the
query
somewhere
else,
but
by
default
you
will
be
on
port
53.
So
how
does
it
work
is
on
the
tree
when
a
queries
come
in.
So
let's
say
we
have
a
query:
it
will
go.
It
will
get
into
the
the
tree
decision
by
the
top
and
then
depan.
We
will
go
into
the
branch
depending
the
domain
queried.
It
will
try
to
match
the
most
specific
domain.
B
You
are
querying
so
here
organization
come
the
most
specific
would
be
on
plan,
but
that
does
not
match.
So
you
will
go
on
the
left
branch
and
we
reserve
your
query
going
by
a
verse,
cache
and
proxy,
so
it
will
be.
It
will
be
resolved
by
your
proxy
120
3.3.4
dot
for
that
one
for
this
one,
if
I
take
the
next
one,
my
DB
on-prem
same
thing:
I,
let's
say:
I
push
the
query
by
the
top.
B
There
is
a
decision
on
the
tree
and
it
will
go
by
the
right
branch
because
it
match
the
unclaimed
organization.
It
much
also
the
organization
that
come,
but
on-prem
is
more
specific.
So
it
will
take
the
right
branch.
I
try
to
try
another
one.
My
company
that
come
so
at
the
top
level
does
not
match
organization
the
nose
match
on
crime
organization,
but
it
matched.
The
point
point
means
everything.
So
that
will
go
by
the
middle
branch,
go
down,
Chiba
netic
rest
of
the
clock
or
it
does
not
match
the
crystal
clock.
B
All
will
go
to
the
next
resolver
proxy,
my
company-
oh
yes,
it's
match,
so
it
will
be
resolved
by
this
proxy
okay.
As
soon
as
you
Ito
resolve,
wear
an
orange
orange
plug
in
is
a
resolver.
It
will
take
care
if
the
the
resolver
say
on
advertising
on
on
the
top
a
what
domain
I
am
resolving
and
as
soon
as
you
match
this
one,
the
resolver
will
handle
it.
So
they
will
not
go
down
to
any
other
resolver.
B
Okay,
last
one
or
I'll
make
up
a
can
go
back
this
one
service,
crostata
local,
so
as
you
can
see,
--gel
will
go
some
hole
and
will
be
resolved
by
the
cube
unit
is
plug
in
next
one
google.com.
How
does
it
work
here
so
other
job?
It
will
go
by
the
middle
bunch
because
of
the
does
not
match
anything
else
and
in
fact
does
not
match
anything.
So
it
will
go
by
the
last
proxy
dot
because
dot
match
anything
okay.
So
it
work.
B
Okay,
so
next
slide,
so
the
first
configuration-
maybe
you
want
you
want
to
tune,
is
I.
Have
some
stub
domain
that
are
not
public
I
mean
they
will
never
be
resolved
by
your
public,
dns,
resolver
or
I
know
that
it
will
be
resolved,
but
it
will
take
a
long
time.
So
I
would
like
to
make
a
shortcut
and
and
just
push
to
the
right
IP
of
the
name
cell
of
the
authorized
or
authoritative
name
server
for
this
domain.
So
you
just
want
to
create
this
block
server.
B
Okay,
so
the
way
to
write
it
is
okay,
you
add
a
blog
server
with
your
domain
and
add
a
proxy
plug-in
point
means
I
match
everything
that
will
go
into
this
branch
and
I
forward
to
the
IP
I
provide
after
you
can
provide
several
IPS
in
that
you
can
provide
several
IPS.
In
that
case,
there
will
be
an
automatic
round-robin
between
all
the
IPS.
B
Okay,
next
thing
you
may
want
to
do
is
okay
for
specific
domain.
I
want
a
specific
IP,
but
maybe
I
will
also
tune
some
of
the
other
configuration
the
first
one
is
a
cache,
for
example,
by
default.
It
is
40
second,
for
your
corporate.
You
know
it
is
it
it
does
not
change
too
much,
so
you
prefer
to
have
a
cache
of
for
one
hour.
B
For
example,
you
may
want
also
to
log
some
special
queries
just
to
to
monitor
your
your
queries,
so
that
that,
in
fact,
that
fix
I
don't
know
80%
of
of
the
problem
of
people
that
want
to
tune
in
in
Cubana
T's
after
the
20%
I
will
let
John
explain
what
else
you
can
do
anyway.
I
went
quickly
into
this
proxy.
Each
one
has
a
lot
of
configuration.
Please
go
to
the
a
website
of
core
DNS.
Are
your
plugins
to
have
a
description
and
the
list
of
option
of
a
proxy
of
log
of
arrow
of
cache?
C
So
looking
at
the
these
are
the
most
commonly
potentially
changed
options
within
the
kubernetes
plug-in,
the
the
first
one
here,
controls
of
whether
or
not
we
reply
to
the
pod
namespace,
so
normally
the
subdomain
for
services
is
SVC,
dot,
cluster
dot,
local
there's,
also
one
pod
dot
cluster
at
local.
That's
in
cube,
DNS,
basically,
just
anything
any
name
you
give
it
that
looks
like
an
IP
address.
It
will
reply
with
that
IP,
which
is
not
ideal.
So
we
have
a
few
different
modes.
C
You
can
completely
disable
it
or
you
can
have
it
actually
only
reply
with
the
IP
address
of
the
pod,
if
that's
actually
a
pod
in
that
actual
namespace
endpoint
pod
names
will
allow
you
to
instead
of
using
some
random
numbers
as
the
endpoint
name
and
a
headless
service,
it
will
use
the
pod
name
by
default
and
of
course
you
can
change.
Ttl
follow
through
is
interesting
and
we'll
talk
a
little
bit
more
about
that.
That's
a
sort
of
internal
way
to
allow
more
than
one
plug-in
to
be
authoritative
on
a
given
zone.
C
There
are
a
bunch
of
other
options
too
that
are
not
going
to
be
as
commonly
used,
so
these
top
ones
here
are
really
about
how
to
connect
to
the
API
server
when
you
deploy
it
as
cluster
DNS,
which
is
really
what
this
talk
is
about.
That's
not
an
issue
because
it's
all
done
through
the
service
account
and
and
all
of
that,
but
if
you
want
to
deploy
core
DNS
external
to
the
cluster
for
some
reason,
then
you
would
make
use
of
these
these
options.
C
There's
another
set
of
options
around
filtering
or
what
we
what
we
actually
expose.
So
a
question
came
up,
I
believe
in
the
intro
about.
Can
we
limit
the
what
we
show
to
a
namespace?
Actually,
we
can
when
you're
running
as
cluster
DNS.
That's
probably
not
what
you
want
to
do
in
general,
but
there
are
some
use
cases
around
only
exposing
a
narrow
set
of
names,
so
you
can
do
with
a
label
selector.
You
can
do
it
with
namespace
or
both
there's
also
some
little
tweaks.
C
C
It's
also
very
useful
for
debugging.
If
you're
trying
to
figure
out
what
what
records
are
there
in
Inc
or
DNS,
you
can
do
a
zone
transfer
just
on
the
command
line
and
see
all
the
options.
So
here
are
a
few
of
the
plugins
the.
As
far
as
well
said,
we
sort
of
categorized
these
into
a
few
different
categories.
C
One
thing
to
note
this
second
bullet
here
is
that
all
of
these
plugins
are
company.
The
default
image
compiles
in
a
bunch
of
plugins
they're,
not
plugins,
that
you
can
load.
They
are
compiled
in
plugins,
so
and
not
only
that,
but
the
ordering
is
specific
to
compile
time.
So,
if
you
want
to
do
something
really
different
than
most
people,
you
may
have
to
roll
your
own
image.
C
Okay,
let's
look
at
the
other
plugins
that
are
a
check
time
check
here.
Let's
look
at
the
other
plugins
related
this
one
of
the
most
interesting
is
is
what
we
call
auto
path
and
there's
I
think
for
a
swallow.
Cricut
alluded
to
this
a
little
earlier
that
I
think
Cricut.
There
there's
a
lot
of
different
long
search
paths
in
kubernetes.
So
when
you
go
to
make
a
query,
you
can
use
a
name
just
like
foo
and
it'll
check.
If
that's
the
name
of
a
service
in
the
name
space
of
the
pod,
that's
making
the
query.
C
If
not
it'll,
you
know
check
the
check.
You
know:
it'll
walk
this
whole
path
from
name
space,
that
service,
that
cluster
to
service,
dot,
cluster,
that
local
cluster,
that
local
and
then
all
of
the
nodes
search
paths.
So
if
you're
in
a
cloud
environment,
sometimes
that'll
have
regional
names,
there
can
be
a
whole
bunch.
C
So
what
you
end
up
with-
and
this
is
one
of
the
sources
of
a
lot
of
issues-
DNS
issues
in
kubernetes-
is
you
can
end
up
with
making
one
query,
one
lookup
you're
trying
to
find
google.com
and
it
tries
all
of
these
different
different
thanks
now
these
are
tried
from
the
client,
so
the
actual
client
makes
a
request
to
the
server
gets
a
response
we,
which
is
in
the
next
domain.
No
such
domain,
it
makes
another
request,
makes
another
request.
C
Every
single
one
of
those
is
UDP
could
timeout
could
be
lost,
could
have
a
five
second
timeout
waiting
for
it,
so
it
can
run
into
a
lot
of
problems,
plus
it
kind
of
pollutes
the
contract
entries
in
the
in
the
node.
So
we
we
looked
at
this
and
we
said
well
since
we're
already
watching
the
kubernetes
api.
C
So
this
is
what
this
looks
like.
This
is
one
of
our
our
users
actually
Oh
a
year
ago
sent
me
this
graph
saying:
hey
I
enabled
it
and
all
these
you
know
the
latency
dropped
dramatically
on
all
these
requests
to
this
that's
three
bucket
or
something
well,
so
why?
Wouldn't
we
enable
this
by
default
and
there's
a
good
reason?
The
the
pods
verified
adds
load
your
API
server
and
adds
memory
to
the
actual
core
DNS
instance.
C
C
There's
also
a
very
strange
edge
case
when
you
have
caching
enabled
that
you
can
sometimes
get
the
wrong
name
wrong
answer.
If
you
have
services
and
endpoints
and
name
spaces
that
have
kind
of
colliding
names
all
right
this
next
one's
really
interesting.
This
is
something
we're
working
on.
It's
not
done,
but
I
think
it's
something
people
will
be
will
be
happy
to
see.
We
expect
this
to
be
in
1.3.
C
The
idea
here
is
that
normally
for
in
cluster
DNS,
the
records
that
we
are
creating
and
returning
are
for
those
those
in
cluster
service
names,
cluster
dot,
local.
But
of
course,
if
we
want
to
actually
create
a
service,
that's
usable
by
by
people
outside
of
the
cluster,
then
those
are
useless
names.
We
have
all
the
we
have
a
lot
of
metadata
anyway,
that
we
may
be
able
to
expose
the
load,
balancer
IP
addresses
or
the
external
IPS
on
the
service
directly
to
the
outside
world
with
another
name.
So
that's
what
this
plug-in
does
it?
C
It
piggy
backs
on
the
kubernetes
connection
and
allows
you
to
specify
a
zone
that
for
which
we
should
present
all
of
these
load,
balancers?
Actually,
external
IPs:
you
could
run
this
internally
with
the
same
cluster
DNS
and
expose
that
cluster
DNS
or
you
could
run
a
separate
core
DNS
instance,
which
would
be
really
the
best
practice
to
separate
those
out
since
you've
got
external
traffic.
You
can't
really
control
and
another
comment
on
that.
C
This
is
an
unfortunate
thing
if
you're,
using
AWS
or
or
Google
Cloud,
I,
don't
know
about
azure,
but
the
load
balancers
only
support
either
TCP
or
UDP
and
at
least
from
kubernetes
configuration
which
is
basically
kills
using
them
for
DNS
without
some
manual
intervention.
So
if
you
do
want
to
use
this,
you
might
have
to
do
some
extra
rules
in
your
load
balancers,
not
through
the
to
expose
this
particular
service,
not
not
to
expose
the
other
services
but
to
expose
the
DNS
service.
C
Cou
Burnette
I,
so
this
is
an
external
plugin
that
you'd
have
to
build.
I
would
have
it's
out
of
tree.
You'd
have
to
do
a
custom,
build
for
it,
but
this
is
something
we
built
actually
originally
for
Sto
I,
don't
I
think
been
using
it.
The
idea
is
that
we
should
be
able
to
have
the
same
name:
server
talk
to
multiple
API
servers
using
say
a
different
cluster
zone
and
provide
service
for
all
of
those.
So
if
you
this,
can
this
can
do
a
sort
of
poor-man's
Federation?
Where
you
can
essentially
look
up?
C
You
can
be
sitting
in
your
cluster
and
by
using
this
plug-in
along
with
fall
through,
which
said
you
could
have
the
same
same
name
be
responded
to.
If
the
it
would
ask
for
the
local
cluster.
If
there's
nothing
in
the
local
cluster,
it
would
go
out
to
the
next
cluster
and
try
and
resolve
that
name
that
works
for
headless
services.
When
you
have
routable
potties
cluster
I
peas
are
not
routable.
That's
what
why
this
isn't
default
or
built-in
it's
kind
of
special
purpose,
because
cluster
I
peas
generally
aren't
routable.
C
Okay,
two
other
ways
to
go
about
and
make
changes.
I
believe
it
was
mentioned
earlier
that
we
could
add,
add
some
static
data
to
the
zone
and
then
there's
a
query
rewrite
which
has
some
interesting
use
cases
the
adding
set
of
Gators,
because
cárdenas
is
just
a
DNS
server
and
kubernetes
happens
to
be
one
of
the
things
that
does.
It
also
serves
zone
files
and
it
serves.
C
Can
you
conserve
inline
records
right
out
of
the
core
file
using
the
hosts
plugin,
so
this
enables
us
to
essentially
override
individual
names
if
we
want
with
the
host
plug-in
or
actually
populate
subdomains,
that
that
aren't
that
are
subdomains
of
the
cluster
dot
local,
but
not
normally
part
of
kubernetes?
This
is
an
example
of
how
to
do
that
with
the
auto
plug-in,
which
automatically
loads
own
files
out
of
a
directory.
C
Another
option
that
we
think
people
may
be
interested
in
is
query
rewriting,
so
we
saw
this
the
particularly
use
case.
This
really
helps
with
is,
if
you
have
you
have
an
existing
certificate,
that's
got
say
a
public
name
on
it,
but
you
want
your
in
cluster
services
to
be
able
to
access
that
in
cluster
without
going
all
the
way
out
outside.
You
can
actually
rewrite
that
name.
So,
your
your
pod,
your
client
in
the
cluster,
uses
the
public
name.
C
The
DNS
looks
at
that
public
name
and
says:
oh
that
actually
corresponds
to
this
service
over
here.
This
internal
name
resolves
that
service
to
an
IP
address
and
then
returns
that
IP
address
to
the
to
the
client.
So
things
running
inside
the
cluster
using
food
out
example.com
will
get
an
in
cluster
IP
and
things
outside
the
cluster,
using
food
out
example
that
we'll
get
say
a
load
balancer
IP
that
talks
into
the
into
the
service,
so
the
same
certificate
can
be
used.