►
Description
Join us for Kubernetes Forums Seoul, Sydney, Bengaluru and Delhi - learn more at kubecon.io
Don't miss KubeCon + CloudNativeCon 2020 events in Amsterdam March 30 - April 2, Shanghai July 28-30 and Boston November 17-20! Learn more at kubecon.io. The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects
CoreDNS: Beyond the Basics - Cricket Liu, Infoblox & John Belamaric, Google
This session will cover aspects of CoreDNS's configuration beyond the basics, including signing DNS data with DNSSEC, supporting DNS over TLS (DoT), manipulating queries and responses, managing zone data with Git, running a full recursive DNS server with the unbound plugin, configuring CoreDNS to perform multi-cluster service discovery, and writing a new CoreDNS plugin. The session is intended for people with a solid understanding of basic CoreDNS configuration who wish to support more advanced use cases or to extend CoreDNS's functionality.
https://sched.co/UaXI
A
A
He
thought
well,
okay,
I've
got
a
go
library
for
DNS
functions
and
I've
got
a
server
architecture
and
caddy,
and
if
I
put
the
two
together,
then
I
could
come
up
with
something
like
a
DNS
server
written
entirely
and
go
that
uses.
Plugins
I,
don't
know
if
you
remember
this
commercial,
it's
the
two
twenty
year
olds
who
walk
into
each
other
around
the
corner
and
one
of
them
gets
peanut
butter
and
the
other
ones
chocolate.
The
other
one
gets
chocolate.
A
The
other
ones
peanut
butter,
and
apparently
this
is
how
Reese's
peanut
butter
cups
came
to
be.
It
made
me
wonder,
looking
back
on
it,
why
anyone
would
walk
around
with
a
jar
of
peanut
butter.
Apparently
that's
something
we
did
in
the
eighties,
but
accordion
s
actually
has
had
a
pretty
rapid
evolution
of.
We
brought
it
to
the
CN
CF
back
in
2017
and
by
December
of
last
year.
So
only
you
know.
A
11
months
ago
it
became
the
default
DNS
server
that
shipped
with
kubernetes
and
then
just
a
month
later,
in
January
of
this
year,
it
reached
graduated
status
within
the
CNC
F,
so
we're
very
pleased
with
its
with
its
success.
Now
some
of
you
may
be
thinking
to
yourselves.
Why
do
I
need
a
new
DNS
server?
Why
why
cordilla
Nass
versus
the
old
cubed
DNS
or
any
of
the
alternatives
out
there?
A
One
reason
is
the
core:
DNS
is
written
entirely
and
go
so
it
is
memory
safe
there.
It
has
built-in,
very
straightforward,
kubernetes
integration,
so
very
easy
to
use
with
kubernetes
and
somewhere
out
here
is
sandeep,
who
had
a
lot
to
do
with?
Actually
writing
that
kubernetes
integration
and,
as
did
john
and
it
has
this
plugin
architecture
and
there's
this
very
rich
ecosystem
of
plugins
that
do
all
kinds
of
interesting
things.
Some
of
them
not
entirely
obvious
to
you
and,
and
that's
really
what
this
session
is
about.
More
of
them
are
being
written
all
the
time.
A
I
think
we
just
checked
one
in
the
policy.
The
policy
plug
yeah,
which
is
a
major
enhancement,
allows
you
to
call
out
to
OPA,
for
example,
to
make
policy
decisions
within
your
DNS
server,
based
on
things
that
dopa
may
tell
you
and
it's
easy
for
some
value
of
easy
to
write
your
own
plugins,
which
is
to
say
that
I
couldn't
do
it,
but
John
could
do
it.
A
So
I'm
gonna
spend
a
little
bit
of
time
talking
about
DNS
SEC
support
in
accordion
s
a
lot
of
this
stuff.
It
was
added
because
I
think
meek
is
really
a
proponent
of
DNS
SEC
for
those
of
you
who
have
been
paying
attention
to
DNS
for
the
last
20
years,
or
so.
We've
been
working
on
DNS
SEC
right,
the
DNS
security
extensions.
A
You
thought
it
did,
for
example,
that
the
ipv4
address
for
WWE
google.com
is
the
one
that
Google
signed
initially
and
also
it
proves
that
it
hasn't
been
modified
since
it
was
signed
and
that's
important
because
you
might
be
getting
it
out
of
the
cache
of
a
DNS
server
and
the
intermediate
DNS
server.
But
you
don't
necessarily
have
any
trust
relationship
with,
and
this
should
be
important
to
those
of
you
who
are
advertising
DNS
data
to
access
services
that
you
might
have
running
within
your
kubernetes
cluster,
because
you
don't
want
that
stuff
modified
right.
A
You
want
people
to
be
able
to
trust
the
fact
that
they're
really
getting
to
the
endpoints
that
you
think
they
should
be
getting
to.
We
call
signing
the
process
of
actually
adding
the
digital
signatures
to
a
DNS
zone.
Their
particular
resource
records
called
are
our
sig
records
and
there
are
different
ways
to
do
signing
we'll
talk
about
a
couple
of
them
that
Cordina
supports
at
this
point.
Most
of
the
top-level
zones
out
on
the
internet
event
sign.
So
the
root
zone
has
been
signed.
Comnet
most
of
the
country
code
top-level
domains
have
been
signed.
A
You
know
almost
any
place
in
the
hierarchy
and
most
operators
of
big
cloud-based
recursive
DNS
services
like
Google
Public,
DNS
CloudFlare,
which
runs
one
dot,
one
dot
one
dot,
one
quad
nine,
these
guys
all
support
cryptographic,
validation
using
DNS
X.
So
these
are
all
good
good
reasons
to
deploy
it
in
a
sec.
Unfortunately,
DNS
Act
for
a
long
time
was
a
pain
in
the
ass
to
implement
core
DNS
really
tries
to
make
it
very
easy
to
do.
A
Dns
ACK,
there
are
two
different
types
of
DNS
SEC
that
are
supported,
one
of
them
signing
on
the
fly
which
you
can
use
with
just
about
anything
anything
that
will,
for
example,
dynamically
generate
or
synthesize
resource
records
within
core
DNS
can
also
then
sign
those
records
and
then
there's
the
more
traditional
method
of
signing
DNS
data
supported
by
DNS
SEC
or
a
bike
or
DNS,
which
is
actually
adding.
Those
are
our
sig
records,
those
cryptographic
signatures
to
zone
Dadaism
and
we'll
talk
about
both
of
those.
A
So
this
is
the
way
that
you
would
sign
on
the
fly
with
the
DNS
sack
plugin.
The
first
thing
you
do
is
you
create
either
a
common
signing
key,
which
is
a
single
asymmetric,
key
pair
that
you're
going
to
use
with
a
zone
for
signing,
or
you
can
use
a
split
key
arrangement
called
a
key
signing
key
and
a
zone
signing
key.
That's
done
for
for
practical
reasons.
Basically,
the
reason
you
do.
A
That
is
because,
if
you
use
the
same
key
over
and
over
and
over
again
to
generate
these
signatures,
then
you
send
you
tend
to
sort
of
use
up
the
key.
Those
of
you
who
know
cryptic
cryptography
better
than
I
do
understand
this,
and
then
you
have
to
rotate
keep
periodically.
If
you
do
that,
you
only
have
a
single
key,
then
you
also
need
to
communicate
the
fact
that
you
rolled
it
rolled
the
key
over
to
your
parent
and
that's
a
real
pain.
A
If
you
split
those
functions
into
a
key
signing
key
in
a
zone
signing
key,
then
you
can
keep
signing
and
then
only
when
you,
when
you
roll
over
the
zone
signing
key,
then
you
just
resigned
with
your
key
signing
key
it's
only
when
the
key
signing
key
changes
that
you
have
to
communicate
that
to
your
parent,
so
here's
a
command
that
you'd
use
with
a
program
called
DNS
SEC
key
gen.
This
generates
a
key
pair
for
you
in
particular.
A
Here
we're
using
ECDSA,
which
is
going
to
looked
at
curve
asymmetric
algorithm,
is
what
all
the
cool
kids
use
now,
because
it
produces
nice,
small
signatures
or
relatively
small
signatures.
So
you
should
probably
do
that
too,
and
this
will
generate
two
files:
it'll
print
in
the
output.
What's
called
the
base
name,
the
two
files
are
the
base
name
plus
key,
which
contains
the
public
key
and
the
base
name,
dot
private,
which
is
the
private
key,
which
of
course,
you
should
keep
it
private
and
then
you
add
the
DNS
I
plug
into
your
server
block.
A
We
have
the
new
DNS
SEC
plug-in
below
that,
and
we
just
refer
to
the
base
name,
so
we
just
say
key
file
and
then
whatever
the
base
name
is
so
the
name
of
the
key
file
or
the
dot
private
file
without
the
suffix,
and
that's
really
it
right
now,
when
you
send
queries
to
your
accordion,
as
instance,
and
you
indicate
the
plus
DNS
SEC
flag,
you
can
see
that
you
get
a
whole
bunch
of
additional
data.
You
can
see.
A
For
example,
in
the
answer
section,
when
we
looked
up
the
SOA
record
for
food
out
example,
we
also
get
an
R.
Our
cig
record
for
food
out
example,
which
is
the
digital
signature
that
covers
that
SOA
record.
It
allows
someone
to
validate
that
SOA
record.
Similarly,
in
the
authority
section,
we
have
the
two
NS
records
for
the
zone.
We
also
have
a
corresponding
are
our
cig
record,
which
will
allow
you
to
cryptograph
cryptographically,
validate
those
NS
records,
cool
right,
super
easy,
and
it's
important
to
note
again.
A
This
works,
even
if
you're
not
dealing
with
a
file,
even
if
you're
dealing
with
something
like
the
kubernetes
plugin,
where
you're
actually
synthesizing
data
that
you're
pulling
out
of
Kerber
Nettie's
via
an
API.
You
can
still
cryptographically
sign
that
data.
The
sign
plug-in
is
a
more
traditional
way
of
doing
DNS
SEC
right.
This
is
manually
adding
those
are
our
sick
records
to
a
zone
data
file,
but
it
does
it
I
said
manually,
but
it
does
it
all
by
itself.
The
one
limitation
here
is
that
you
have
to
use
a
common
signing
key.
A
It
doesn't
support
the
zone,
signing
key
key
signing
key
split.
So
again,
here's
how
you
do
that
you
generate
your
common
signing.
Key
I
didn't
do
this,
but
it's
easy
enough
to
do
just
like
you
did
before
with
DNS
SEC
key
gen.
You
add
the
sign
plug
in
to
the
server
block
that
handles
queries
for
a
particular
zone.
Here
you
see
Bart
out
example
and
reloading
it
from
a
file
that
we're
gonna
call
DB
bar.example.com.
A
Forward
and
again
after
we
reload
our
core
DNS
instance,
we
get
nice
signatures
within
our
zone
data
file.
Now
this
might
be
the
preferable
way
to
do
it.
If,
for
example,
you
were
then
transferring
this
zone
to
other
non
core,
DNS
name
servers,
and
then
the
other
thing
I
wanted
to
talk
about.
Just
briefly
is
DNS
over
TLS.
How
many
of
you
have
heard
of
DNS
over
TLS
or
dot?
Great
ok,
so
that's
been
supported
by
core
DNS
for
some
time
it
can
handle
queries
that
are
received
over
TLS.
It's
very
easy
to
do.
A
All
you
have
to
do
is
within
your
server
block,
rather
than
just
having
a
domain
name.
You
use
something
that
looks
like
a
URI,
TLS
colon,
slash,
slash
and
then
whatever
the
scope
is.
So,
if
it's
every
query
that
you
want
to
handle
over
TLS,
it
would
look
like
TLS
colon,
slash
last
dot
and
then
in
this
top
example,
we're
just
gonna
forward
all
queries
over
to
Google
Public
DNS
at
888,
888
4.4
and
we're
gonna
cache
responses.
A
If
you
just
wanted
to
limit
the
scope
and
say
hey
I
just
want
to
handle
TLS
queries
within
food
out
example,
it
looked
like
the
example
down
at
the
bottom
and
there's
also
some
tuning
and
tweaking
that
you
can
do.
Of
course,
in
order
to
handle
those
queries
that
are
received
over
DNS
over
TLS,
you
have
to
have
some
sort
of
a
certificate.
A
This
is
just
what
you
guys
will
recognize
as
an
open
SSL
command
to
generate
a
TLS,
sir,
that
you
can
then
install
and
then
below
that
there's,
a
TLS
TLS
plug-in
there,
where
it
actually
names
both
the
cert
in
the
key
file,
and
in
fact,
if
you
want
to
help
sorry,
this
is.
This
is
just
verifying
that
you
are
in
fact
talking
over
TLS.
So
I
used
open
SSL
to
actually
connect
to
the
running
core
dns
instance
and
make
sure
that
it
was
talking
over
Tiana's.
A
A
We're
not
going
to
go
there
today.
All
right,
you
can
also
do
some
configuration
on
the
client
side.
So,
for
example,
if
you
wanted
core
dns
to
use
TLS
to
communicate
with
something
else,
you
can
do
that.
So,
for
example,
here
we're
forwarding
all
of
our
queries
up
to
Google
Public
DNS,
which
supports
DNS
over
TLS,
and
we're
pointed
forward
those
over
dot,
rather
than
just
over
DNS
over
port
53.
A
So
we
just
add
that
TLS
colon
slash,
slash
8.8.8.8
right
and
in
fact
you
can
specify
client
authentication
if
you
want
to
the
CA
that
you're
going
to
assert
the
TLS
server
name
and
stuff,
like
that,
using
the
format
that
you
see
down
at
the
bottom,
with
services
like,
for
example,
Google
public,
it's
not
generally
necessary
to
do
that.
Google
doesn't
care
about
your
client,
auth
stuff
right,
they're,
not
gonna
demand
that.
A
And
then
the
last
thing
that
I
wanted
to
talk
about
was
just
managing
his
own
data
with
give.
This
is
something
that
we
cover
in
in
learning
DNS
as
well.
Most
of
you
guys,
probably
use
get
on
a
day
to
day
basis
right,
and
maybe
you
think
it
would
be
fun
to
manage
your
zone
data
with
git
as
well,
because
it
gives
you
the
ability
to
have
distributed
management
of
zone
data.
A
You
can
roll
back,
you've
got
version,
control,
you've
got
all
kinds
of
cool
stuff,
and
so
this
is
an
example
of
using
git
and
a
special
plug-in
called
the
auto
plug-in.
In
order
to
do
that,
so
the
auto
plug-in
basically
allows
Cortinas
to
scan
an
entire
directory
to
say:
I'm
gonna
scan
this
entire
directory
and
I'm
gonna.
Look
for
files
that
match
a
certain
pattern
if
they
match
that
pattern,
I'm
going
to
assume
that
they
are
zone
data
files
and
I'm
also
going
to
extract
the
domain
name
of
the
zone
from
the
fun
here's.
A
How
we
do
that
this
auto
direct
our
auto
plug-in,
says,
look
at
the
directory
at
C,
core
DNS
and
look
for
any
files.
That
start
with
DB
dot,
something
or
other
and
that
dot
something-or-other
everything
after
that,
first
dot.
That's
the
domain
name
of
the
zone
and
reload
every
1
minute
so
scan
this
directory
every
1
minute
anything
that
I
put
in
here
boom
load.
It
assume
that
that's
a
zone
data
file
and
you
ought
to
be
authoritative
for
that
zone.
A
So
the
other
half
of
this
is
that
we
obviously
have
to
have
some
sort
of
a
program
in
order
to
pull
information
out
of
git
and
then
plunk
it
in
that
directory.
So
here's
an
example
of
a
little
program
called
get
sync
which
you
can
get
from
the
kubernetes
distribution,
and
you
can
use
it
to
periodically
synchronize
this
zone
data
using,
for
example,
a
command
line
like
this,
and
so
that
I
think
is
the
end
of
what
I
have
I
think
I
get
to
turn
this
over
to
you
sure,
absolutely
so,
John
Boehner
all
right!
B
B
Each
of
those
plugins
has
an
opportunity
to
make
a
decision
about
what
to
do
with
the
requests
or
the
response
going
back
and
so
built
in.
There
are
several
plugins
that
will
do
things.
Things
like
that.
Some
of
them
are
very
simple.
We
have
one
called
this
load
balance
plug-in
where,
if
you
query
for
say
a
records
with
a
given
name
and
you
get
back
three
or
four
records
it'll,
just
shuffle
the
order,
and
that
way
you
can
use
it
kind
of
as
a
dns-based
load
balancer.
B
Sometimes
we
read
data
from
a
file,
but
we
also
can
pull
data
or
just
generate
data
or
pull
data
from
another
source.
So
the
kubernetes
plugin
pulls
data
from
the
communities
API
the
file
from
a
file
there's
actually
ones
for
pulling
things
from
from
format
CD
or
from
post
press,
but
the
template
one
actually
will
just
manufacture
them
out
of
whole
cloth.
So
this
this
little
core
file
here
describes
how
to
create
a
template
that
that
that
will
essentially
create
generic
generic
entries
for
a
certain
pattern
of
domain
name.
B
So
in
this
case
IP
a
dashed
quad
dot
example.
Comm
will
return
that
that
dot
that,
as
a
dotted
quad
for
a
record
requests,
it
will
return
nothing
for
any
other
record
requests
because,
according
to
spec,
you
shouldn't
return
on
an
X
domain.
If
there's
some
value
for
some
record
at
that
name,
even
if
it's
not
the
one
people
are
asking
for
and
then,
if
you
ask
for
anything
that
doesn't
match
that
pattern,
it
will
it
will,
it
will
respond
with
an
X
domain.
No
such
no
such
domain.
B
So
a
couple
of
interesting
things
to
note
here,
so
the
the
template.
The
way
it
works
is
you
can
list
it
multiple
times
and
the
as
a
request
is
processed.
Each
template
stands
on
each
time
each
instance
of
the
stanza
here
the
template
plugin
will
check
if
the
query
matches
this,
in
this
case
hideous,
regular
expression
and-
and
if
it
does,
then
it
will
answer-
and
the
answer
here
is
is
basically
you
can
use,
go
templating,
but
it's
essentially
a
look
should
look
like
just
what
you
put
in
its
own
file.
B
So
it's
just
an
RFC
compliant
statement
of
a
record
here.
In
this
case,
we're
gonna
do
the
name
there's
in
the
documentation.
You'd
find
the
specific
values
that
you
can
use
in
this
template
name
and
we're
gonna
capture
from
these
groups
group
a
b
c
and
d,
which
is
what
these
this
regular
expression
up
here,
shows
you
the
it
creates
these
named
named
groups
in
the
regular
expression
capture.
B
It
will
just
return
an
X
domain,
but
some
of
the
plugins
we
want
to
allow
to
take
a
look
at
the
request,
decide
whether
or
not
they
know
anything
about
it,
but
if
they
don't
know
anything
about
it,
pass
it
on
to
the
to
the
next
next
plugin
in
the
chain.
So
that's
what
fall
3
does.
Essentially,
if
you
get
back
or
the
the,
if
the
request,
if
this
plugins
analysis
of
the
request
determines
that
it's
an
NX
domain
rather
than
returning
NX
domain
and
falls
through
the
next
plug-in
and
just
passes
it
on.
B
So
in
this
case,
when
you
get
a
match
for
something,
that's
not
an
a
record
and
it's
any
other
type
of
record,
but
it
still
matches
the
regular
expression
that
we
showed
up
here
then
we're
going
to
return
the
no
error
our
code.
Basically
it's
it's
saying
everything
was
good
all
successful,
but
we're
not
actually
returning
any
answer
we're
just
returning
in
our
code
just
data,
so
the
template
will
allow
you
to
specify
an
answer
or
an
additional
section.
It's
a
number
of
different
pieces
of
the
response
that
you
can
template
eyes.
B
B
Now
we
can
take
that
another
step
and
once
we've
written
all
those
complicated
templates,
maybe
we
don't
want
to
have
to
do
the
same
thing
for
dot-org
and
as
we
did
for
calm
in
fact,
there's
there's
some
other
ways
to
do
this,
but
but
well,
you'll
notice
in
here.
Right,
calm
is
in
here
so
in
order
to
still
match
the
regular
expression,
but
have
the
exact
same
behavior
for
our
org,
we
can
use
something
called
the
rewrite.
B
B
I'll
take
that
response,
and
this
second
part
of
it
here
says,
modify
the
answer
to
flip
it
back
the
other
way.
Now
the
reason
we
do
this,
if,
if
a
DNS
server
returns
a
query
and
the
answer
in
the
in
the
response
doesn't
match
the
answer
that
the
client
said
initially
properly
behaving
clients
or
careful
clients
will
reject
that
I
mean
it's
just
an
anti
spoofing
or
say
it's
a
security
measure
to
avoid
manipulation
in
the
transport.
B
Well,
that's
not
going
to
match
the
certificate
and
things
are
going
to
fail.
You
could
actually
program
the
DNS
server
such
that
internal
clients
can
also
use
food
at
example.com
and
then
or
DNS
would
translate
that
into
the
service
name.
The
the
kubernetes
style
service
name
pass
it
on
to
the
kubernetes
plugin,
which
returns
the
correct
IP
address
then
and
map
it
back.
So
from
the
point
of
view
of
the
clients
TLS,
it
all
looks
good
in
the
handshake
succeeds.
B
Another
one
I
wanted
to
talk
about
are
several
different,
different
plugins
and
I'm
going
to
demo.
This
one
in
a
minute
is
the
metadata
plug-in
and
in
the
firewall
plug-in
so
built
into
Cordy
and
a
standard
default
image
that
you
get,
there's
a
there's,
an
apple
plug-in
and
that
aqua
plug-in
allows
you
to
control
required
to
block
requests
that,
based
on
the
IP
address
of
the
the
client,
but
we
also
have
as
an
externally
buildable
plug
in
the
firewall
plug-in
that
allows
you
to
do
arbitrary
expressions
based
on
the
data.
B
B
That's
just
recently
merged
like
yesterday
that
you
can
call
out
to
oppa,
but
you
can
also
call
out
to
info
boxes,
internal
or
open
source
policy
engine
that
they
use
in
some
of
their
projects,
which
is
where
this
was
originally
developed.
But
in
any
case,
what
I'll
show
you
is
an
example
where
we
can
actually
allow.
We
essentially
password
protect
our
DNS
server
such
that
only
clients
that
pass
this
proper,
a
DNS
option
can
can
make
use
of
the
server
a
little
background
there.
Eating
as
extensions
for
DNS
is
a
way
to
attach
additional
data.
B
Options
with
a
data
value
typically
to
any
given
request
and
that
can
be
interpreted
by
the
server.
However,
you
want
so
this
is
used
often,
like
probably
your
home
router
actually
uses
this.
It
attaches
the
the
client
subnet
and
that
helps
the
service
provider.
Decide.
What
response
to
give
you
based
on
your
how
near
some
given
server
is
to
your
client
subnet
or
something
like
that.
So
it's
a
pretty
widespread
thing
it,
your
your
individual
clients,
don't
use
it,
but
typically,
but
it
is
something
in
the
infrastructure.
B
So
important
as
plugins
metadata
is
something
that
that
that
it's
a
way
for
any
plug-in
to
sort
of
publish
information
that
can
be
used
by
other
plugins.
So,
for
example,
the
kubernetes,
if
you
enable
metadata
the
kubernetes
plugin,
will
publish
it'll
break
down
the
request
and
publish
like
the
the
namespace
as
as
as
a
namespace.
You
know
under
this
tag,
namespace
or
the
you
know
the
service
name,
and
then
you
can
use
those
later
in
your
logs.
B
So
if
you
wanted
to
log
log
things
specifically
in
a
specific,
safe,
structured
log,
you
could
do
that
using
the
metadata
one
and
in
fact,
with
kubernetes,
we
have
the
ability
to
enable
it
called
pods
verified
mode
which,
which
will
listen
on
pods
and
when
it
does
that
and
actually
will
map
back
in
the
metadata.
It'll
take
the
source,
IP
and
map
that
back
to
the
original
pod.
B
So
you
could
actually
log
in
your
dns
logs
the
both
the
source
IP,
the
source,
pod
name
and
source
namespace
of
the
client,
as
well
as
of
the
server,
so
that
could
be
useful
and
and
with
firewall,
actually
operate
on
that.
So
I'll
mention
a
few
things
you
can
do
with
that
later,
but
any
case
our
situation
here.
B
What
it
does
is
metadata
simply
enables
the
metadata
plugin
since
it
when
the
request
comes
in
the
metadata,
plugin
picks
it
up
and
actually
call
all
the
other
plugins
before
they
even
see
the
request
and
sort
of
give
them
a
sneak
peek
of
it.
So
they
can
parse
it
and
do
whatever
they
want
and
look
up
data
somewhere
if
they
need
to
and
then
it'll
pass
it
down
the
chain.
The
metadata
Idina
zero
is
used
to
parse
metadata.
B
Take
take
those
EDS
options
that
were
attached
to
the
request,
parse
them
out
and
publish
them
within
this
metadata
for
other
plugins
to
use.
So
in
this
case,
what
it's
going
to
do
it's
going
to
create
a
metadata
tag
named
secret,
and
it's
going
to
do
that
by
parsing
option,
65,000
200
out
as
bytes,
and
just
sticking
that
in
as
the
data
value
the
firewall
plug-in,
is
smart
enough
to
take
advantage
of
that
and
allow
you
to
create
this
expression.
So
here
this
refers
to
that
metadata.
B
B
B
Accordion
s
here
and
then
we
can
try.
I'm
gonna
run
a
client
as
well.
Just
alright
and
let's
try
to
query
remember
we
have
those
templates
in
there.
Let's
try
and
query
this
alright,
so
we
say
the
query
come
in
and
it
gets
refused.
That's
because
in
our
query,
we
do
not
have
any
IDI
in
this
option.
This
is
just
a
plain,
vanilla,
DNS
request
to
this
IP
address.
If
we
look
at
where
did
my?
B
If
we
look
at
this
Digg
command,
it
says,
attach
a
DNS
opt
50
to
250
65
200,
and
this
is
the
hacks
for
for
that
password.
I
guess.
I'm
gonna
have
to
change
my
banking
password
now
and
we
see
now
it
comes
in.
We
get
the
no
error
and
in
fact
we
get
back
1
2
3
4,
because
our
template
matches
that
format
and
returns
the
1
2
3
4.
B
Let's
try
another
one
just
so
we
can
see
how
our
template
will
will
give
us
an
NX
domain
for
something
that
doesn't
match,
and
we
see
in
the
query
log
that,
yes,
it
came
through,
but
oh
yeah
we
got
the
domaine
and
of
course
we
see
the
same
thing
in
a
client.
So
that's
some
of
the
fun
tricks
you
can
do
with
the
template
and
the
rewrite
and
the
firewall.
And
if
you
extend
that
with
kubernetes,
you
can
actually
build,
and
maybe
I'll
do
this
for
Amsterdam.
B
You
could
actually
build
a
multi-tenant
service
discovery
using
these
things.
These
are
sort
of
the
primitives.
You
need
to
do
that
within
a
kubernetes
environment,
all
right.
So
how
much
time
do
we
have
four
minutes?
Four
minutes.
Only
ok,
crap
I'm
out
of
time
almost
I
also
do
have
multi
service
and
multicolor
service
discovery.
B
I
won't
demo
it,
but
actually
that
that
link
up
there,
some
scripts,
that
will
do
it
in
a
gke
environment,
but
basically
there's
a
plugin
called
Cooper
net
ID
it
allows
accordion
has
to
talk
to
multiple
clusters,
API
servers
at
once
and
then
publish
that
data.
It
has
some
limitations
like
cluster
I
Peter,
meaningless
right
across
clusters.
So
it's
really
for
headless
services
in
a
GK
environment
pot.
Ipas
are
routable,
so
it's
useful
and
meaningful.
B
C
B
B
If
you
want
to
play
with
it,
it's
on
my
public
GCR,
but
it's
easy
and
you
can
go
back
and
watch
the
video
the
d5
yesterday
I
show
you
how
to
rebuild
with
it
with
a
plug-in,
but
the
core
file
there's
a
reload
plug-in
that
allows
your
file
to
reload
at
any
time.
So
that
would
be
one
way
to
do
it
without
having
to
do
it
right
at
startup.
B
But
the
other
thing
is,
since
you
can
actually
call
out
to
OPA-
or
you
can
call
out
to
this
Themis
policy
engine-
the
policies
that
live
there,
then,
and
all
of
that
you
can
just
populate
those
policies
on
the
fly,
which
is
actually
what
Infoblox
does
in
their
in
their
one
of
their
product
offerings.
Is
they
have
these
big
famous
engines,
full
of
policies
and
then
Cordilleras
calls
out
to
with
each
request.
D
Right
here,
yeah,
so
so
general
question
about
the
product
itself
like
do
you
guys
have
any
plans
to
do
weight
based
load
balancing
at
the
server
level
and
the
reason
why
I
asked
is
like
you
know?
Can
we
actually
start
looking
at
code?
Ian
has
to
do
something
like
a
GSLV
right,
you
know.
Undone
configured
to
yourself
is
using
coordinates
because
you
know
there
are
number
of
comprendo
products
that
we
actually
use
right
now
and
we've
blocked
kind
of
like
C
code.
Ian
has
actually
support
something
like
that.
D
A
B
Ambitious
you
could
do
that
in
a
plugin
or
I
have
to
say
right.
Policies
are
arbitrary,
so
it's
theoretically
possible.
You
could
actually
do
that
within
one
of
these
policies,
but
they
would
have
to
hold
the
data
to
and
do
health
checks
and
do
a
lot
of
things.
So
it's
not
definitely
not
in
our
plans
per
se,
but
it
is
certainly
possible.