►
Description
DNS forms the backbone of service discovery, both internally and externally, with OpenShift. Did you know OpenShift has separate DNS for Pods and nodes? This episode we’re joined by Christian Hernandez, DNS expert and Technical Marketing Manager for OpenShift, to talk about how DNS is used and configured for both Pods and nodes in the cluster. We’ll also discuss external DNS requirements for connecting to applications hosted by OpenShift.
About Ask an OpenShift Admin:
Do you have questions? We want to answer them! Every Wednesday at 11am ET, hosts Andrew Sullivan and Chris Short sit down to answer your questions about Red Hat OpenShift.
Follow us:
Andrew Sullivan https://twitter.com/practicalandrew
Chris Short https://twitter.com/chrisshort
Christian Hernandez https://twitter.com/christianh814
Subscribe to Red Hat's YouTube channel: https://www.youtube.com/redhat/?sub_confirmation=1
About OpenShift:
Red Hat OpenShift is an open source container application platform based on the Kubernetes container orchestrator for enterprise application development and deployment.
Openshift.com https://red.ht/33Fh6uV
OpenShift on github https://github.com/openshift/
OpenShift on redhat.com https://red.ht/2o4ccDk
#RedHat #OpenShift #Kubernetes
A
Good
morning,
good
afternoon,
good
evening,
welcome
to
another
edition
of
ask
an
open
shift
admin.
I
am
chris
short
executive
producer
of
openshift
tv,
I'm
joined
by
the
the
main
you
know,
host
of
the
show,
andrew
sullivan,
but
we're
also
having
our
special
guest,
the
one
teammate.
I
know
that
brags
about
his
knowledge
of
dns
christian
hernandez.
How
are
you
today.
B
C
B
Other's
streams-
just
not
not
actually
in
person,
so
hello,
welcome
everybody
to
the
ask
an
openshift
administrator
office
hour
stream.
So
this
is
one
of
the
office
hour
series
of
streams
that
we
have
here
on
openshift
tv
and
the
goal
here
is
really
for
you
all
for
our
audience.
The
people
who
are
listening
and
watching
in
to
ask
us
anything
at
any
time
about
whatever
it
is
that
is
at
the
top
of
your
mind.
So
please
don't
hesitate
to
do
that.
B
B
B
B
B
So
today's
topic
as
or,
if
you
didn't
see
any
of
the
social
media
or
other
things
leading
into
today,
we're
going
to
be
talking
primarily
about
dns
and
also
a
little
bit
about
cluster
networking,
but
primarily
about
dns
and
the
genesis
for
this
is
christian
and
I
spend
what
what
feels
like
a
substantial
amount
of
time.
I
mean
relatively.
B
B
B
Understanding
how
it
works
and
knowing
how
it
works
in
openshift
and
kubernetes
is
not
the
same
thing
exactly
and
that's
what
we
often
see
as
a
problem.
So
today
we
wanted
to
kind
of
look
at.
You
know,
maybe
demonstrate
a
little
and
and
explore
dns
inside
of
openshift
and
keep
in
mind
that
a
lot
of
this
will
also
apply
to
kubernetes
as
a
whole.
So
it
doesn't
necessarily
matter
if
you're,
using
openshift
or
not,
hopefully
we'll
be
able
to
answer
some
of
those.
B
Yep
and
it's
it's
funny
because
you
know
I
was
an
infrastructure
administrator
for
a
long
long
time
and
it
was,
it
was
always
the
network's
fault
until
virtualization
came
along
and
then
it
was
storage's
fault
right
and
now
that
we've
kind
of
worked
past,
all
of
those
right
most
folks
are
using
either
hybrid
or
or
all
flash
storage.
Now,
suddenly
it's
back
to
being
the
network's
fault
and
a
lot
of
times
it's
dns
enough
yeah.
A
B
C
B
Was
a
few
things
that
I
wanted
to
talk
about
so
for
those
who
are
regular,
watchers,
regular
attendees
of
our
stream?
You
know
that
I
like
to
cover
a
few
things
that
I
have
seen,
either
internally
or
externally-
that
I
believe
are
relevant
and
also
important
things
that
maybe
you
haven't
heard
yet.
So
let
me
find
the
right
tab
here,
which
is
always.
A
B
All
right,
that's
the
one
I'm
looking
for.
Oh
there,
you
go
so
first
and
foremost
a
bit
of
shameless
self-promotion.
We
have
been
doing
a
weekly
blog
post
after
each
one
of
our
shows.
They
come
out
on
fridays,
so
this
one
happens
to
be
from
last
week.
If
you
missed
anything
from
last
week,
not
only
do
we
have
a
link
to
the
stream
itself,
but
we
also
go
through
and
try
and
put
as
many
of
the
questions
as
many
of
the
things
that
we
can
find
in
there.
B
So
if
you
want
to
right
quickly
skim-
because
I
know
you
know
one
of
the
big
things
about
doing
a
video
stream
is,
there
is
no
transcript.
There's
no
way
to
do
like
a
control
f
and
find
a
topic
of
interest.
So
I
I
try
to
go
through.
I
try
to
identify
the
questions
and
pull
them
out
and
then
link
to
where
they're
answered
inside
of
the
inside
of
the
video.
So.
A
B
B
I
actually
had
not
heard
or
encountered
this.
I
don't
like
to
bring
up
bugs
very
frequently,
because
you
know
they
happen
all
the
time,
so
usually
until
it's
something
that
I
feel
is
coming
up
or
or
more,
I
guess
serious
or
coming
up
more
frequently
than
a
any
generic
old
bug.
I'd
tend
not
to
bring
them
up.
So
this
one
happened
because
I
saw
no
less
than
three
customers
this
week
that
encountered
the
scenario
where
their
vsphere
ipi
node
had
gone
offline.
B
So
for
whatever
reason
the
worker
node
was
offline
right,
maybe
it
was
turned
off.
Maybe
the
physical
node
had
had.
You
know,
powered
off
failed
for
whatever
reason
some
yeah
and
the
ipi
process
effectively
reaped
that
node
right.
It
deleted
the
node
because
it
was
going
to
provision
a
new
one
to
recapture
that
that
capacity
yeah.
The
problem
is
that
virtual
node,
the
vm
had
some
pvcs
attached,
yeah
and
so
the
the
power
the
node
was
running.
It
had
some
pods.
Those
pods
were
using
pvcs.
B
The
node
failed
for
whatever
reason,
so
it
still
had
those
vmdks
attached
to
it.
Okay
and
when
ipi
came
along
and
destroyed
the
node,
so
too
did
the
pvcs
yeah.
So
that's,
that's
not
good!
You
know.
Data
loss
is
never
a
good
day
on
at
any
point
in
time.
Ever
so
a
couple
of
things
to
be
aware
of
here
so
first
and
I'm
scrolling
down.
Yes,
there's
a
number
of
missing
comments
in
here
I
apologize.
B
C
B
B
B
B
So
if
you're,
if
you
have
upgraded
to
4.7
or
if
you've
deployed
a
new
4.7
cluster
on
vsphere
and
you're
starting
to
see,
you
know
one
two,
three
five
percent
packet
loss.
This
could
be
the
result
of
that
there
is
a
workaround.
I
don't
know
similar
to
the
other
one
I'm
not
logged
in,
because
there's
some
customer
information
here
there
is
a
workaround.
B
It
doesn't
look
like
it's
in
the
public
comments.
If
anybody
needs
that,
just
let
me
know,
andrew.sullivan
redhat.com
I'll
share
that
with
you
effectively
it's
setting
or
turning
off
the
vxlan
offload
for
the
network
adapters
inside
of
the
virtual
machine.
So
it's
just
a
couple
assist
controls
that
you
execute.
B
B
Agree,
you
know,
I
I
try
to
you
know
again,
it's
it's.
I
I
try
to
preempt
or
try
to
make
you
aware
of
things.
So
that
way,
you
don't
accidentally
stumble
into
a
bad,
a
bad
situation
yeah.
So
the
next
one
is
a
good
one.
You
know
I
I
talked
about
sizing
in
a
couple
of
different
ways,
with
three
or
four
different
aspects,
whether
it's
sizing,
the
cluster
sizing,
the
nodes,
sizing,
storage
right.
All
those
things
across
a
handful
of
shows
here
on
the
openshift
admin
hour,
ask
an
openshift
admin
hour.
B
So
a
really
good
reads:
you
know:
share
this
one
with
your
your
application,
developer
application
admin
peers
that
kind
of
walks,
through
all
of
the
different
relevant
settings,
different
capabilities
things
like
that
to
help
you
size
those
clusters,
both
how
the
application
is
allocated,
resources
and
how
those
resources
are
then
reflected
inside
of
the
cluster,
and
when
I
do
the
show
notes
for
this
one
I'll
I'll,
try
and
link
those
other
episodes
inside
of
there.
If
I
remember
to
make
a
note
to
myself.
B
C
Of
like
scale
right
because,
oh
I
need
to
be
able
to
now
that's
different
now,
you're
essentially
constraining
them.
What
do
you
mean?
I
only
get
you
know,
half
a
cpu
cycle,
it's
like
well.
It
doesn't
completely
work
that
way,
so
that
that
episode,
your
episode
of
of
of
resources,
resource
limits
and
ranges
is
good
too.
I
got
it.
I
got.
B
All
right,
so
the
last
topic
I
wanted
to
talk
about
before
we
get
started
here
is
one
and
we
were
joking
before
the
show
started
that
I'm
I'm
just
gonna.
Kick
this
hornet's
nest,
because
it's
it's
a
bit
of
a
a
sensitive
topic.
I
think
internally,
and
I
know
that
there
are
some
people
who
are
passionate
about
it
externally
as
well,
and
that
is
reference
architectures.
A
B
A
B
So
reference
architectures
for
a
little
bit
of
background
here,
so
anybody
who
has
been
keeping
up
with
openshift
for
the
last
roughly
two
to
three
years,
you'll,
remember
that
we
used
to
publish
reference
architectures
more
or
less
every
version
or
every
two
versions
for
various.
I
see
somebody
asked
for
the
sizing
link.
It's
it's
the
second
one
up
the
sizing.
C
B
So
the
big
one
was
quite
simply,
resources
right,
constantly
trying
to
and
having
you
know,
devoting
not
just
the
people
resources,
but
the
physical
resources
and
all
of
the
things
associated
with
going
through
and
generating.
Those
documents
was,
you
know,
quite
frankly,
hard,
and
it
really
was-
and
invariably
it
always
led
to
you
know
if
we
used
one
partner's,
you
know
set
of
resources
instead
of
another
partners
right
sometimes
there
would
be.
B
You
know,
hurt
feelings
and
stuff
like
that,
so
it
it
became
a
bit
overwhelming
in
a
number
of
different
ways,
so
the
decision
was
made
rather
than
creating
reference
architectures,
which
the
perspective
was,
and
I
would
be
very
welcome
to
anybody's
anybody's
additional
thoughts
or
perspective
on
this.
But
the
perspective
was
that
most
folks
read
a
reference
architecture
not
to
literally
implement
it
as
written,
but
rather
to
glean
right
rather
to
determine
what
information
is
important.
What
information
is
relevant?
What
decision
points?
B
B
They
are
doing
exactly
that
they're,
taking
as
much
of
that
information
as
they
have
as
they
can
get
and
putting
it
directly
into
the
documents
right
recommended.
Host
practices
is
a
great
one
and
allowing
you
our
audience
right.
The
people
who
want
to
ingest
those
reference
architectures
to
really
understand
the
rationale
behind
those
decisions.
Right
not
just
oh,
I
see
that
you
know
in
the
reference
architecture.
They
said
you
know
this
value
to
x.
Well,
why?
Why
was
it
set
to
x?
Sometimes
we
explained
that
sometimes
we
didn't
so
through
the
documentation.
B
B
So
with
that
in
mind,
however,
we
didn't
completely
abandon
reference
architectures
right.
It
seems
that
way,
and
some
of
you
may
be
thinking
well,
I
have
seen
some
reference
architectures
come
out
and
you
are
absolutely
correct.
We
now
rely
on
our
partner
ecosystem
for
those,
so
I'm
going
to
post
this
blog
post
into
the
chat
here,
so
this
one,
which
is
coming
up
on
a
year
old
now,
so
I
I
assume
dave,
will
probably
update
it
and
I've
known
dave
for
a
few
years
now
he
works
over
on
our
partner
team
right.
B
B
So
if
you
are
using
hpe
hardware-
and
let's
say
you
want
to
deploy
openshift
onto
your
dl,
whatever
servers
right
dl380,
I
don't
even
know
what
the
current
gen
is.
So
we
can
click
on
this
4.6,
gl
and
dl
excuse
me
and
it
walks
through
all
of
the
different
components
of
their
reference
architecture.
This
is
all
created
by
our
partners,
so
they
still
exist.
C
That
intuitively,
that
intuitively
makes
sense,
because
being
a
software
vendor
red
hat
like
we,
we
one
really
can't
recommend
hardware,
because
there's
just
like
a
ton
of
hardware
that
we're
supported
on,
like
we
like
andrew,
was
saying:
we're
are
we're
just
we
don't
have
enough
people
to
go
out
and
buy
every
single
hardware
and
you
know
vet
everything
every
possible
combination.
So
we
we
lean
heavily
on
our
on
our
providers
like
like
hp
and
dell
dell
emc
to
do
these
right
and
we
can
review
them.
C
B
So
I
happen
to
click
on
hpe
over
here.
You
know
you
see.
Netapp
and
cisco.
Have
one
for
flexpod.
Netapp
has
one
for
their.
You
know
netapp
hci,
there's
there's
you
know,
literally
dozens
of
partners
that
do
these
now.
You
will
see
one
exception
to
this,
and
that
is
openstack
because
red
hat
is
you
know,
red
hat
openstack.
B
Yeah
august
simonelli
resox
and
him
and
company
right,
so
they
they
create
that
open
shift
on
openstack
reference
architecture
and
that's
because
it's
a
whole,
you
know
red
hat
stack
there
just
like.
If
you
were
to
you
know.
Similarly-
and
I
think
I've
said
this
before
cni
plugins
csi
plugins-
that
come
from
partners,
we
don't
document
those
inside
of
the
openshift
documentation.
We
rely
on
the
partners
for
those,
the
exceptions
being.
If
it's
you
know,
red
hat
virtualization
or
a
red
hat
openstack
platform.
B
B
So
so
christian
you-
and
I
started
this
conversation
last
week
or
maybe
the
week
before
and
really
it
came
out
of
some
confusion
around.
How
does
dns
resolution
happen
for
openshift
and
it
turns
out
that
this
is
a
little
more
complex
than
you
might
expect.
So
can
you
elaborate
on
that
and
talk
about?
You
know
dns
in
openshift
and
the
difference
between
node-based
dns
and
pod-based
dns.
C
Yeah,
so
so,
where
do
I
start
right?
You
know
what
I
mean
with
with
with
with
with
with
dns,
so
I
originally,
I
was
gonna
start
like
in
the
beginning,
what's
dns,
but
I
imagine
that
at
some
level,
since
this
is
asking
admin,
there's
some
fundamental
understanding
of
what
dns
is
right,
so
dns
and
kind
of
sort
of
what
it
how
it
works
from
a
high
level.
C
So
I'll
start
with
the
fact
that
I
guess
you
guys
all
know
how
you
know
what
dns
is
what
the
root
servers
are.
What
you
know
what
author
you
know:
server
authority
is,
and
all
that
stuff,
so
so
dns
in
open
shift,
is
kind
of
a
layered
design
right
so
originally
dns
in
kubernetes.
So
I
think
I'm
just
gonna
start
there
dns
in
kubernetes
and
what
it's
used
for
then
I'll
work.
My
way
up
so
dns
kubernetes
is
used
for
service
discovery
right.
C
C
So,
by
by
service
discovery,
meaning
that
as
an
application
or
as
a
service
inside
of
openshift
kubernetes
in
general,
it
can
reference
a
service
by
a
name.
For
example,
I
have
a
front
on
web,
give
a
stupidly
dumb,
yeah
two
two
tier
application
right,
I
have
you
know
node.js
front-end
and
some
sort
of
database
back-end.
C
I
want
to
be
able
to
just
say
database
in
my
application
and
it
should
just
work
right.
I
shouldn't
be
as
a
developer
or
even
as
like
an
admin
or
as
an
end
user.
I
shouldn't
have
to
care
or
memorize
ip
addresses
or
what
the
ip
addresses
are
or
how
to
connect
to
that.
So
it
should
be
as
simple
as
just
saying
my
sequel,
right
or
database
or
whatever
name
you
decide
to
deploy
your
database
as
so
that's
the
idea
of
service
discovery.
C
I
can
reference
something
by
name
and
it
automatic
automatically
knows
the
ip
address.
So
and
essentially,
you
know,
funnily
enough.
Dns
is
a
perfect
software
to
do
that,
because
that's
just
what
it's
been
doing,
there's
and
that's
what
originally
it
was.
The
the
original
intent
right
for
kubernetes
service
service
discovery.
So
in
kubernetes,
that's
kind
of
like
the
the
bear.
B
So
pods
are
deployed
that
represent
some
micro
service
right
front
end
backend
database,
whatever
that
happens
to
be,
and
then
they
have
quite
literally
a
kubernetes
service
in
front
of
it.
That
says
point
to
these
pods
and
it
it
discovers
those
ips
using
this
front
facing
right
external
facing
external
being
still
within
the
cluster,
but
right
dns
name,
so
that
other
components
can
say,
connect
me
to
front
end
and
the
service
translates
that
into
the
set
of
pods
the
set
of
ips
for
the
pods
that
represent
that
front-end
microservice.
C
C
C
A
C
Way,
yeah
so
dns
right,
so
I
will
what's
what's
funny
about
searching
for
dns
on
the
openshift
docs.
Is
that
it's
like?
Not
the
first
one,
there's
the
api
for
networking
right,
so
it's
under
networking.
That's
that's
how
I
remember
how
to
get
to
it
and
then
there
is
understanding
the
dns
operator,
so
openshift
deploys
core
dns
via
an
operator
right,
and
so
let
me
make
this
a
little
bigger,
because
there
we
go,
I
can
make
it
bigger.
If
you
like,
is
that
too
big?
C
C
So
this
is,
it
shows
the
dns
operator
and
just
like
all
things
in
openshift,
it's
controlled
by
an
operator.
So
we
have
a
dns
operator
here
and
you
can
see
the
version
here
and
that's
all
good.
So
what's
really
cool
about
this
here
when
you
describe
here,
it'll,
give
you
information
about
your
cluster,
and
so
the
important
information
is
this.
C
This
information
here,
so
the
dns
service
for
for
kubernetes
runs
on
the
the
service
address
right,
so
the
service
address
from
a
high
level-
I
guess
now
I
could
I
could
play
dummy
to
you
andrew-
is
an
overlay
network
for
the
most
part.
It's
an
overlay
network
that
sits
on
top
of
your
regular
network
right,
a
software
defined
network,
it's
possible,
but
this
will
get.
I
don't
want
to
rabbit
hole
too
much,
but
it's
possible
to
have
kubernetes
running
without
an
sdn.
C
That
it
is
hard
it
is
hard
because,
anytime,
you
add
a
node,
you
have
to
add
the
routing
table
to
all
nodes
and
it
just
makes
sense
just
to
use
a
software
network.
So
this
is
an
overlay
network.
So
when
you
see
this,
this
is
my
service
overlay
network
and
my
cluster
domain
is
cluster.local,
which
is
the
default.
So
cluster.local
is
the
domain
for
kubernetes
the
internal
domain
for
kubernetes.
B
C
B
C
Yeah
yeah,
so
it
it
gleans
that
information
from
the
range
you
give
it
and
it'll
it'll
take
that
information
and
then
it'll
create
this
ip
address.
So,
and
this
is
the
dns
ip
for
your
pods
and
that's
the
cluster
domain.
So
one
also
quick
thing
before
I
actually
just
drill
down
into
the
pods
is
the
the
cluster.local.
C
C
B
C
Yeah
so
I'll,
actually
I'm
actually
going
to
get
to
that
workflow.
So
I
imagine
you
mean
yeah
so,
but
in
general
the
service,
the
the
service
layer,
is
a
non-routable
layer,
but
that
doesn't
mean
things
can't
get
in
and
out
so
but
I'll
I'll
talk
about
that
workflow
in
a
bit
so
so
yeah.
So
then
this
is
the
the
ip
address
for
the
dns
service
inside
the
the
service
name
right.
C
So,
that's
that
same,
that's
the
the
service
network
range
so
as
as
sully
was
talking
about.
This
is
the
range
and
that's
and
that
matches
this
this
ip
here,
let
me
clear
it.
I
always
like
to
clear,
because
you
know
people
don't
like
looking
at
the
bottom.
I
know
I
hate
it
when
someone's
sharing
their
screen
and
they
they're
like.
C
So
so
before
I
wanted
to
go
through
this
dot
line
by
line,
but
I
think
I'm
gonna
skip
around
a
little
bit
because
it
just
makes
more
sense
right.
So
the
core
dns
has
a
has
a
configuration
and
so
and
that's
this
is
stored
in
a
config
map
right
and
by
the
way,
andrew
and
chris.
I
can
ramble
all
and
on
so
please
give
me
time
checks,
so
I
can
get
to
all
the
points
I
want
to
get
to,
and
so
so
this
is
the
configuration
file
all
right.
C
Yeah
in
1.21,
I
guess
which
would
be
openshift4.8
it'll
it'll,
take
take
out
the
manage
fields.
You
have
to
specifically
ask
for
them.
So
so
this
is
the
configuration
file
for
core
dns.
It's
pretty
simple.
It
first
gives
the
the
the
domains,
it's
it's
it's
the
authority
for
and
then
it
even
gives
an
arpa
for
ipv6
as
well.
So.
C
That's
you
know
something
some
our
customers
ask
for
is
ipv6
support,
so
it'll
send
information.
You
know
to
prometheus,
so
you
know
it.
It
has
that
plugin
already
set,
and
then
it
has
this
line
here
called
forward
dot
resolve
dot
com.
So
let's,
let's
explore
that
a
bit
so
so
the
pods
all
the
pods
have
their
resolve.conf
set
to.
Let
me
describe
that
again.
C
C
C
C
C
C
The
it
does
a
search
right
if
I
do
like
an
nslookup
of
fubar
dot
test
is
style.
Local!
Oh
sorry,
if
I
do
a
foobar
it'll
automatically
tack
this
on
look
for
that
then
tack
this
on.
Look
for
that
and
then
it'll
go
down
that
side.
Then
it
has
the
name
server
for
this
pod
to
that
the
dns,
the
internal
dns
server
inside
of
openshift.
So
it
says
172.30
so
it'll,
look
up!
This
is
its
main
dns
server
and
it's
the
only
dns
server.
C
C
C
A
C
A
C
C
C
C
C
C
Yeah
yeah
well
the
machine
config.
If
you
want
to
just
actually
change
the
order
on
disk
or
dhcp
right
like
if
your
dhcp
is
handing
out
your
name
servers,
then
just
change
the
order
there
and
next
time
the
lease
happens:
it'll
it'll,
flip
them
and
so
yeah.
So
here
I'm
I'm
in
the
node
and
if
I
do
a
cat,
etsyresult.conf
notice
it
it's
I'm
using
nm
state
right,
and
so
here
it'll
choose
this
name
server.
C
C
C
C
If,
if
I
go
back
here,
it
says
forward
everything
I
don't
know
about
the
resolve.conf
and
then
it'll
use
those
name
servers
as
well,
so
very
cool.
There
is
a
few
things
I
wanna
so
here
right
it
tells
you
operator
status.
You
know
you
just
describe
it
and
just
kind
of
see.
You
know
it
was
degraded
because
I
did
earlier
because
I
was
doing
an
upgrade,
but
that's
and
then
the
the
logs
here
in
the
dns
operator
that'll
give
you
information
about
the
logs.
C
C
B
I'll
I'll
add
on
to
your
responses,
saying
I
would,
I
don't
think
it's
required,
but
it
is
strongly
encouraged
so
and
that
is
specific
to
on-prem
ipi,
so
the
on-prem
ipis
use
mdns
for
their
local
node
resolution.
So
inside
of
the
cluster,
it
will
resolve
those
ip
addresses
without
an
issue
because
it's
using
mdns.
B
C
C
I
actually
have
seven
nodes
or
one
ohm's,
a
windows
node,
but
the
staple
set
selector
is
set
to
os
lytics
right.
So,
if
I
do,
a
demon
demon
set
sorry
demon
said
staple.
I
was
working
with
something
else
with
staples
and
I
have
staple
set
on
the
mine
and
so
yeah
so
that
I
have.
I
have
six
so
there's
the
daemon
set.
Does
you
know
one
pod
for
each
each
host?
C
C
C
C
So
the
the
container
that
I
wanted
to
call
out
inside
the
pod
is
the
dns
node
resolver
and
its
file
is
essential.
Its
job
is
essentially
to
manipulate
the
etsy
host
file
right.
So
if
I
do
a
or
is
that
rsh-
and
I
think
that's
on
the
pod
hosts-
no,
it's
not
here
so
its
job
is
to
basically
manipulate
the
etsy
hosts
file
on
the
pod,
and
so
you
know
notice.
This
has
like
the
ip
of
the
pot.
C
C
Yeah,
so
it
has
the
dns
server
right,
so
it
doesn't
have
to
go
and
look
for
the
the
name
for
like
the
pod
itself,
yeah
right,
because
it
has
that
entry
in
etsy
host
for
anything
else.
It
uses
that
dns
and
if
it
doesn't
find
that,
then
it
just
forwards
it
on
to
the
etsy
resolve.com
file
on
the
node.
So
the
last
remaining
five
minutes.
Let's
take
a
look
at
I've,
been
promising
the
dns
forwarding.
C
Yeah
plugins
right,
so
it's
it's
a
it
has
the
ability
to
do
plugins
right,
so
it's
essentially
core
dns
was
made
to
be
extensible
and
one
of
the
things
so
just
beyond
name
resolution.
One
of
the
things
is
that
forwarding
is
written
as
a
plugin
and
you
do
that
by
editing
the
the
default
configuration.
So
let's
take
a
look
at
that
here
without
the
dollar
who
put
the
dollar
there
that
copy
that
tell
docs,
okay,
so
here
essentially
yeah!
So
essentially
here:
let's,
let's
do
this?
Okay!
C
So
it's
not
there
spec
we're
deleting
you
spec
and
adding
these
here.
So
here,
you're
plugging
in
dns,
saying
that
okay,
so
anytime,
someone
looks
up
food.com,
instead
of
going
through
that
that
whole
chain
right.
So,
let's
kind
of
recap:
the
chain
the
pod
looks
at
its
etsy
host
file
locally.
Then
it
looks
at
the
its
own
resolve.conf.
If
it
can't
find
it,
it
will
then
forward
it
to
the
resolve.conf
file
on
the
node
itself.
C
So,
instead
of
doing
that,
the
the
pod
will
then
the
the
d.
Sorry,
the
pod,
the
core
dns
when
the
pod
asks
core
dns
it'll,
say
well
for
any
domain
foo.com,
I'm
just
going
to
forward
that
request
to
these
dns
servers.
So
this
is
you
know,
I
I
ran
it
in
my
day.
I
ran
you
know
clustered
dna
server
sprawled
for
for
my
company
across
all
over
north
america.
So
you
know
sometimes
you
do
dns
delegations.
C
That's
kind
of
isolated
from
the
other
ones
that
they
don't
know
about
each
other.
So
if
you
have,
you
know
stuff
out
there
that
you
want
to
reach
out
to.
You
may
have
to
ask
that
dns
server,
and
this
is
essentially
an
array
right,
so
I
say
foo
server.
The
zones
right,
I
can,
you
know,
put
baz
right
anything
under
baz
and
use
this
dns
server.
What
I
find
cool
about
core
dns
is
that
you
can
specify
a
port.
You
can't
do
that
in
bind
bind
everything's
on
53.
C
well
bind
you
can
listen,
but
the
client
can't
ask
on
other
ports
so
and
then
the
bar
server
yeah
bar
example.com
forward
it
to
these
dns
server.
So
in
this
configuration
then,
once
you
know,
if
accordion,
then
it
kind
of
injects
itself
in
the
middle
if
core
dns
can't
find
the
name
instead
of
forwarding
it
to
resolve.conf
it'll,
try
these
servers
and
then
from
there.
If
it
doesn't
know,
then
it'll
forward
it
to
the
resolve.com
locally.
C
B
So
I
have
a
question
for
you
christian
as
well
as
there
is
a
a
question
from
eamonn
eiman,
so
I'll
I'll
ask
mine
first,
because
I
think
it'll
be
a
quick
one
which
is
core
dns
right.
The
the
openshift
dns
service
also
applies
to
static
pods
that
are
deployed
so,
for
example,
the
lcd
pods
on
the
control
plane.
C
B
B
C
Correct
correct
and
then
also
one
last
kind
of
thing
to
interject
there.
The
host
is
the
nodes
host
etsy
hosts
file
also
does
come
into
play
in
that
same
layer
as
the
result.com
file
right
so
it'll.
You
know
we're
looking
at
the
host
resolve.com
file
that
that
etsy
host
there
also
comes
into
play
so.
B
B
So
that
is
on
the
road
map,
so
I
know
that
technically,
if
you
were
to
look
today
at
the
documentation
for
like
the
in-stream
in
entry
provisioner
and
all
that
other
stuff,
you
can
create
the
vsphere.conf
and
have
it
understand,
multiple
clusters
and
all
that,
so
we've
had
a
number
of
customers
that
are
asking
about
this.
We
did
some
internal
testing.
We
found
that
it
mostly
works
with
4.6.
I
think
they
were
like
95
success,
but
they
found
a
few
things
they
created
issues.
B
B
C
So
I
so
the
authentication
cluster
operator,
so
I'm
gonna
so
first
and
foremost,
I'm
gonna
need
more
information,
not
that
or
like
dig
into
the
why
that
would
be
so
before
I
go
into
my
long-winded
answer
for
my
short-winded
answer.
Is
I
don't
know,
but
I've
had
issues
so
usually
the
authentication
cluster
operator
being
degraded
is
a
symptom
of
something
else
right,
and
so
I've
always
found
some
weirdness
with
the
router.
C
So
if
you
have
like
a
router
operator,
I
would
check
to
look
at
the
the
router
logs.
I
would
look
at
the
authentication
logs.
I
would
look
to
see
there
might
be
a
breakdown
of
the
dns
chain.
At
that
point,
the
cluster,
the
authentication
cluster
operator
probably
has
the
upstream
quarter
quote
upstream
dns
name
like
oauth
dots.
You
know
you
know
clustername.example.com
and
that's
probably
in
the
pod,
and
since
it
can't
look
that
up,
it's
probably
breaking
down
from
I'm
just
guessing
at
that
point.
Where
is
what's
happening?
C
C
B
C
B
B
B
C
B
B
You
so
for
our
audience.
Thank
you
for
joining
us
today.
As
I
said,
please
don't
hesitate
to
reach
out
at
any
time
with
any
of
your
questions.
You're
welcome
to
contact
me
directly
via
email,
andrew.sullivan,
redhat.com,
social
media,
practical
andrew
on
twitter
christian.
Do
you
have
social
media
or
other.