Send only cluster domain queries to kube-dns

Note: all PTR request must still traverse kube-dns. We can restrict this to just the clusterCIDR in the future to reduce the amount of PTR traffic.

Send only cluster domain queries to kube-dns
da291a7b · Bowei Du · 8621bd3e · da291a7b · da291a7b · da291a7b
Commit da291a7b authored Feb 08, 2017 by Bowei Du
3 changed files
--- a/cluster/addons/dns/kubedns-controller.yaml.base
+++ b/cluster/addons/dns/kubedns-controller.yaml.base
@@ -49,7 +49,7 @@ spec:
      - name: kube-dns-config
        configMap:
          name: kube-dns
-          optional: true    
+          optional: true
      containers:
      - name: kubedns
        image: gcr.io/google_containers/k8s-dns-kube-dns-amd64:1.12.1
@@ -116,8 +116,9 @@ spec:
          failureThreshold: 5
        args:
        - --cache-size=1000
-        - --no-resolv
+        - --server=/__PILLAR__DNS__DOMAIN__/127.0.0.1#10053
-        - --server=127.0.0.1#10053
+        - --server=/in-addr.arpa/127.0.0.1#10053
+        - --server=/ip6.arpa/127.0.0.1#10053
        - --log-facility=-
        ports:
        - containerPort: 53

--- a/cluster/addons/dns/kubedns-controller.yaml.in
+++ b/cluster/addons/dns/kubedns-controller.yaml.in
@@ -49,7 +49,7 @@ spec:
      - name: kube-dns-config
        configMap:
          name: kube-dns
-          optional: true    
+          optional: true
      containers:
      - name: kubedns
        image: gcr.io/google_containers/k8s-dns-kube-dns-amd64:1.12.1
@@ -116,8 +116,9 @@ spec:
          failureThreshold: 5
        args:
        - --cache-size=1000
-        - --no-resolv
+        - --server=/{{ pillar['dns_domain'] }}/127.0.0.1#10053
-        - --server=127.0.0.1#10053
+        - --server=/in-addr.arpa/127.0.0.1#10053
+        - --server=/ip6.arpa/127.0.0.1#10053
        - --log-facility=-
        ports:
        - containerPort: 53

--- a/cluster/addons/dns/kubedns-controller.yaml.sed
+++ b/cluster/addons/dns/kubedns-controller.yaml.sed
@@ -49,7 +49,7 @@ spec:
      - name: kube-dns-config
        configMap:
          name: kube-dns
-          optional: true    
+          optional: true
      containers:
      - name: kubedns
        image: gcr.io/google_containers/k8s-dns-kube-dns-amd64:1.12.1
@@ -115,8 +115,9 @@ spec:
          failureThreshold: 5
        args:
        - --cache-size=1000
-        - --no-resolv
+        - --server=/$DNS_DOMAIN/127.0.0.1#10053
-        - --server=127.0.0.1#10053
+        - --server=/in-addr.arpa/127.0.0.1#10053
+        - --server=/ip6.arpa/127.0.0.1#10053
        - --log-facility=-
        ports:
        - containerPort: 53