Feature request: support zone transfers in Kubernetes middleware #660

ae6rt · 2017-05-05T16:15:00Z

As a Kubernetes cluster operator, I want to perform zone transfers of cluster.local, or whatever cluster domain is otherwise configured. This feature is not currently supported in CoreDNS-007, at this writing, the latest coredns version.

Context

Kubernetes cluster version:

$ k version
Client Version: version.Info{Major:"1", Minor:"6", GitVersion:"v1.6.1", GitCommit:"b0b7a323cc5a4a2019b2e9520c21c7830b7f708e", GitTreeState:"clean", BuildDate:"2017-04-03T20:44:38Z", GoVersion:"go1.7.5", Compiler:"gc", Platform:"darwin/amd64"}
Server Version: version.Info{Major:"1", Minor:"6", GitVersion:"v1.6.2", GitCommit:"477efc3cbe6a7effca06bd1452fa356e2201e1ee", GitTreeState:"clean", BuildDate:"2017-04-19T20:22:08Z", GoVersion:"go1.7.5", Compiler:"gc", Platform:"linux/amd64"}

Pods running in my cluster

$ pods
NAMESPACE     NAME                      READY     STATUS    RESTARTS   AGE       IP             NODE
default       centos7                   1/1       Running   2          2h        10.7.119.136   lxc016
kube-system   coredns-512496995-4638p   1/1       Running   0          2h        10.7.119.135   lxc015

CoreDNS version:

$ k -n kube-system exec coredns-512496995-4638p -- /coredns -version
CoreDNS-007

Corefile

Consider this Corefile that configures the pod above

.:53 {
    errors
    log stdout
    health
    kubernetes cluster.local {
      transfer to *
      cidrs 169.254.8.0/21
    }
    proxy . /etc/resolv.conf 
    cache 30
}

Prove DNS works in the cluster:

$ k exec centos7 nslookup kubernetes
Server:		169.254.8.53
Address:	169.254.8.53#53

Name:	kubernetes.default.svc.cluster.local
Address: 169.254.8.1

Attempt a zone transfer

$ k exec centos7 dig cluster.local axfr

; <<>> DiG 9.9.4-RedHat-9.9.4-29.el7_2.3 <<>> cluster.local axfr
;; global options: +cmd
cluster.local.		5	IN	SOA	ns.dns.cluster.local. hostmaster.cluster.local. 1494000263 7200 1800 86400 60
; Transfer failed.

Observe the same failure report in the coredns container logs

$ k -n kube-system logs coredns-512496995-4638p
.:53
2017/05/05 13:41:57 [INFO] CoreDNS-007
CoreDNS-007
10.7.119.136 - [05/May/2017:13:42:26 +0000] "A IN kubernetes.default.svc.cluster.local. udp 54 false 512" NOERROR 70 362.92µs
10.7.119.136 - [05/May/2017:13:42:32 +0000] "A IN api.twilio.com.default.svc.cluster.local. udp 58 false 512" NXDOMAIN 111 221.227µs
10.7.119.136 - [05/May/2017:13:42:32 +0000] "A IN api.twilio.com.svc.cluster.local. udp 50 false 512" NXDOMAIN 103 186.635µs
10.7.119.136 - [05/May/2017:13:42:32 +0000] "A IN api.twilio.com.cluster.local. udp 46 false 512" NXDOMAIN 99 190.527µs
10.7.119.136 - [05/May/2017:13:42:32 +0000] "A IN api.twilio.com.lxc016.qa.xoom.com. udp 51 false 512" NXDOMAIN 99 1.02957ms
10.7.119.136 - [05/May/2017:13:42:32 +0000] "A IN api.twilio.com.qa.xoom.com. udp 44 false 512" NXDOMAIN 92 846.828µs
10.7.119.136 - [05/May/2017:13:42:32 +0000] "A IN api.twilio.com.xoom.com. udp 41 false 512" NXDOMAIN 104 5.387866ms
10.7.119.136 - [05/May/2017:13:42:32 +0000] "A IN api.twilio.com. udp 32 false 512" NOERROR 445 42.750638ms
10.7.119.136 - [05/May/2017:13:42:32 +0000] "A IN api.twilio.com. tcp 32 false 65535" NOERROR 709 1.268809ms
10.7.119.136 - [05/May/2017:13:42:39 +0000] "AXFR IN cluster.local. tcp 43 false 65535" NXDOMAIN 96 180.064µs
10.7.119.136 - [05/May/2017:13:42:47 +0000] "A IN webserver.2.xoomapi. udp 37 false 512" NOERROR 277 2.827296ms
10.7.119.136 - [05/May/2017:16:03:42 +0000] "A IN kubernetes.default.svc.cluster.local. udp 54 false 512" NOERROR 70 317.948µs
10.7.119.136 - [05/May/2017:16:04:23 +0000] "AXFR IN cluster.local. tcp 43 false 65535" NXDOMAIN 96 208.056µs

The text was updated successfully, but these errors were encountered:

miekg · 2017-05-05T16:41:32Z

[ Quoting <notifications@github.com> in "[coredns/coredns] Feature request: ..." ]

As a Kubernetes cluster operator, I want to perform zone transfers of cluster.local, or whatever cluster domain is otherwise configured. This feature is not currently supported in CoreDNS-007, at this writing, the latest coredns version.

No true, this is not supported. I thought it would be pretty hard, but now that I think about it should actually be pretty trivial. The only nit is when to update the SOA's serial, i.e. how do we know something has changed in the k8s service registration?

johnbelamaric · 2017-05-05T18:03:26Z

We have watches on all the K8s resources of interest. We can keep a serial number of some sort, or perhaps construct one out of the individual resource serial numbers.

miekg · 2017-05-05T18:19:17Z

Ah didn't know we had watches. Then it should be relatively easy. For the soa serial I would just use the current time truncated to uint32 On 5 May 2017 7:03 pm, "John Belamaric" <notifications@github.com> wrote: We have watches on all the K8s resources of interest. We can keep a serial number of some sort, or perhaps construct one out of the individual resource serial numbers. — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#660 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AAVkWwl0vYTEdxS3wFvzZPOSzlGo_4E1ks5r22RugaJpZM4NSH9U> .

johnbelamaric · 2017-05-05T18:22:21Z

But only change it when something comes across the watches? Or we don't care?

miekg · 2017-05-05T18:26:21Z

Indeed. Otherwise we keep transferring the same data over and over.

…

On 5 May 2017 7:22 pm, "John Belamaric" ***@***.***> wrote: But only change it when something comes across the watches? Or we don't care? — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#660 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AAVkW1sKJZzrXuqxwAASZloSnsVYkhdqks5r22jdgaJpZM4NSH9U> .

johnbelamaric · 2017-05-05T18:29:43Z

Of course, sure. Do we support notifies today? Given the frequency of changes that could happen in K8s that would be a concern.

miekg · 2017-05-06T08:37:57Z

Yes, we can do notifies, code is in the file middleware.

There is no generic notify layer/middleware that handles though - might also not be worth the complexity.

miekg · 2017-06-26T15:06:36Z

I might actually be tempted to work on this (modulo 8 other PRs)

miekg · 2017-06-26T15:07:04Z

tentatively for 009, but maybe 010 would be better

miekg · 2017-08-21T14:47:06Z

I've been playing with some code today, far from finished, but I should have some tangible within a few days.

miekg · 2017-08-21T15:27:25Z

See #963 which shows the gist of it. Interesting questions this poses:

We may be able to put this in the secondary middleware and use the same tricks as we did for autopath and federation?

stale · 2017-10-23T11:06:47Z

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

miekg · 2017-12-01T15:31:14Z

this is happening in #1259 (and possible followup PRs)

johnbelamaric · 2018-02-14T15:55:43Z

Done in #1259! There is still follow up on how to handle records that are provided via the fallthrough mechanism, but the basic K8s records are now available via AXFR.

johnbelamaric assigned chrisohaver May 5, 2017

miekg added the enhancement label May 30, 2017

miekg added this to the 008 milestone May 30, 2017

johnbelamaric modified the milestones: 008, 009 May 30, 2017

johnbelamaric removed this from the 009 milestone Jun 26, 2017

chrisohaver removed their assignment Aug 4, 2017

miekg mentioned this issue Aug 20, 2017

Get list of hosted zones from running CoreDNS server #347

Closed

miekg added this to the 1.1.0 milestone Aug 24, 2017

stale bot added the wontfix label Oct 23, 2017

johnbelamaric removed the wontfix label Jan 18, 2018

miekg added the plugin/kubernetes label Jan 22, 2018

johnbelamaric closed this as completed Feb 14, 2018

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Feature request: support zone transfers in Kubernetes middleware #660

Feature request: support zone transfers in Kubernetes middleware #660

ae6rt commented May 5, 2017

miekg commented May 5, 2017 via email

johnbelamaric commented May 5, 2017

miekg commented May 5, 2017 via email

johnbelamaric commented May 5, 2017

miekg commented May 5, 2017 via email

johnbelamaric commented May 5, 2017

miekg commented May 6, 2017

miekg commented Jun 26, 2017

miekg commented Jun 26, 2017

miekg commented Aug 21, 2017

miekg commented Aug 21, 2017

stale bot commented Oct 23, 2017

miekg commented Dec 1, 2017

johnbelamaric commented Feb 14, 2018

Feature request: support zone transfers in Kubernetes middleware #660

Feature request: support zone transfers in Kubernetes middleware #660

Comments

ae6rt commented May 5, 2017

Context

Kubernetes cluster version:

Pods running in my cluster

CoreDNS version:

Corefile

Prove DNS works in the cluster:

Attempt a zone transfer

miekg commented May 5, 2017 via email

johnbelamaric commented May 5, 2017

miekg commented May 5, 2017 via email

johnbelamaric commented May 5, 2017

miekg commented May 5, 2017 via email

johnbelamaric commented May 5, 2017

miekg commented May 6, 2017

miekg commented Jun 26, 2017

miekg commented Jun 26, 2017

miekg commented Aug 21, 2017

miekg commented Aug 21, 2017

stale bot commented Oct 23, 2017

miekg commented Dec 1, 2017

johnbelamaric commented Feb 14, 2018