I'm trying to figure out why I'm not getting a positive response when I run `nslookup kubernetes.default` in my Kubernetes clusters. I thought this should work based on what I've heard, but I can only resolve it using the full domain name `kubernetes.default.svc.cluster.local`. I suspect that this might relate to the version of `nslookup` I'm using, because when I use the dnsutils package, it gives me the correct IP. Can anyone run this test in their cluster and share the results? I'd also appreciate any tips on troubleshooting CoreDNS issues!
3 Answers
Your success with service addressing seems to hinge on what's set in `/etc/resolv.conf` within the container. I found that the search domains might differ among setups. Here’s my configuration:
nameserver 10.43.0.10
options ndots:5
The flow of DNS resolution in Kubernetes usually goes like this: When a Pod makes a DNS request, it hits the CoreDNS service. For internal names, CoreDNS should respond directly, while external requests get forwarded upstream based on your config. Checking your CoreDNS config might give you clues.
What’s your DNS config map look like? I tested this in my k3s cluster and ran a debug container to check. When I ran `nslookup kubernetes.default`, I got a message about recursion not being available from my DNS server (10.43.0.10). It could explain why you're only seeing success with `kubernetes.default.svc.cluster.local`. Here’s a little more detail on my findings:
The cluster IP for kube-dns appears to be 10.43.0.10. You might want to check your DNS service with `kubectl get svc -n kube-system` and verify your settings.
The `ndots` option is crucial for DNS behavior. If your queries have fewer dots than the `ndots` value, they'll try the search domains first. For instance, with `ndots: 3`, a simple name like `redis` will attempt to resolve using available namespaces before checking the literal name. I think your cluster not resolving `kubernetes.default` might actually be a good sign for performance. Higher `ndots` values can lead to unnecessary queries, so yeah, it might be worth sticking with the full domain.
Related Questions
How To Get Your Domain Unblocked From Facebook
How To Find A String In a Directory of Files Using Linux