bright-jordan-61721
10/03/2022, 3:28 PMv1.24.6+k3s1
and I have some pods configured with dnsPolicy: ClusterFirst
(which is the default) and noticing weird DNS resolution problems.
When I shell into a pod with this dns policy and cat /etc/resolv.conf
this is what I see:
bash-5.1# cat /etc/resolv.conf
search default.svc.cluster.local svc.cluster.local cluster.local [home search domains redacted]
nameserver 10.43.0.10
options ndots:5
I believe ndots:5 is causing the problem, as ping <http://github.com|github.com>
fails due to dns resolution, but ping <http://github.com|github.com>.
works instead.
Why is k3s setting the ndots:5 option by default? I’m not setting this with the pod’s dnsConfig at all. If this option were removed or reduced to ndots:1 it would likely solve my issue.bland-account-99790
10/03/2022, 4:27 PMndots:5
is a Kubernetes default parameter, i.e. it is not set by k3s. You can change it though https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-dns-configndots:5
<http://github.com|github.com>.
you are telling your OS that the string is already a FQDN and thus it does not need to add any search domain<http://github.com|github.com>.$OneOfYourSearchDomains[[home search domains redacted]
returns an IP from a server which does not reply to pingskind-nightfall-56861
10/03/2022, 7:44 PMbright-jordan-61721
10/04/2022, 3:15 AMbash-5.1# nslookup <http://github.com|github.com>
Server: 10.43.0.10
Address: 10.43.0.10#53
*** Can't find <http://github.com.private.home.jtcressy.net|github.com.private.home.jtcressy.net>: No answer
but this makes no sense, except that there are exactly 5 dots in that FQDN it stopped with.
and this is the first search domain after cluster.local<http://github.com.private.home.jtcressy.net|github.com.private.home.jtcressy.net>
instead of NXDOMAIN
since when I dig <http://github.com|github.com>.svc.cluster.local
it will give me NXDOMAIN, and this must be the response needed for the resolver to query the next search domain*.<http://home.jtcressy.net|home.jtcressy.net> in CAA
As soon as I deleted them I get NXDOMAIN instead of NOERROR
I hate DNS!kind-nightfall-56861
10/04/2022, 7:25 AMbland-account-99790
10/04/2022, 12:27 PM