DNS in Kubernetes (CoreDNS) - Deep Dive

Overview - DNS in Kubernetes (CoreDNS)

What is it?

DNS in Kubernetes is a system that helps services and pods find each other by name instead of IP addresses. CoreDNS is the default DNS server inside Kubernetes clusters that answers these name requests. It translates service names into IP addresses so that components can communicate easily. This makes managing network connections simpler and more reliable.

Why it matters

Without DNS in Kubernetes, every service or pod would need to know the exact IP addresses of others, which change often. This would make communication fragile and hard to manage, especially as clusters grow or services restart. CoreDNS solves this by providing a stable naming system, enabling smooth service discovery and communication inside the cluster.

Where it fits

Before learning DNS in Kubernetes, you should understand basic Kubernetes concepts like pods, services, and networking. After this, you can explore advanced networking topics like network policies, service meshes, and external DNS integration.

Mental Model

Core Idea

CoreDNS acts like a phone book inside Kubernetes, translating friendly service names into IP addresses so components can call each other without knowing exact numbers.

Think of it like...

Imagine a large office building where employees only know each other's names, not their desk numbers. CoreDNS is like the receptionist who looks up the desk number when you ask for a colleague by name, so you can reach them easily.

┌───────────────┐       ┌───────────────┐       ┌───────────────┐
│ Pod A         │──────▶│ CoreDNS       │──────▶│ Pod B         │
│ (asks for    │       │ (looks up     │       │ (receives     │
│ service IP)  │       │ service name) │       │ connection)   │
└───────────────┘       └───────────────┘       └───────────────┘

Build-Up - 7 Steps

1

Foundation

What is DNS in Kubernetes

Concept: Introduce the basic idea of DNS and its role in Kubernetes.

DNS stands for Domain Name System. It converts human-friendly names into IP addresses computers use. In Kubernetes, DNS helps pods and services find each other by name instead of IP. This is important because IPs can change when pods restart or move.

Result

Learners understand that DNS is a naming system that simplifies communication inside Kubernetes.

Understanding DNS is key because it removes the need to track changing IP addresses manually, making cluster communication stable.

2

Foundation

CoreDNS as Kubernetes DNS Server

Concept: Explain CoreDNS as the default DNS server in Kubernetes clusters.

CoreDNS is a lightweight DNS server running inside Kubernetes as a pod. It listens for DNS queries from pods and services and responds with the correct IP addresses. CoreDNS replaces older DNS solutions and is highly configurable.

Result

Learners know CoreDNS is the main DNS service inside Kubernetes clusters.

Knowing CoreDNS is the default DNS server helps learners focus on the current standard and its features.

3

Intermediate

How CoreDNS Resolves Service Names

🤔Before reading on: do you think CoreDNS resolves only service names or also pod names? Commit to your answer.

Concept: Describe how CoreDNS translates Kubernetes service names into cluster IPs and supports pod name resolution.

CoreDNS uses Kubernetes API to watch services and endpoints. When a pod asks for a service name like 'my-service.default.svc.cluster.local', CoreDNS returns the service's cluster IP. It can also resolve pod names if configured. This allows pods to connect using stable names.

Result

Learners see that CoreDNS dynamically updates DNS records based on Kubernetes state.

Understanding that CoreDNS integrates with Kubernetes API explains how DNS stays accurate as services and pods change.

4

Intermediate

CoreDNS Configuration and Plugins

🤔Before reading on: do you think CoreDNS configuration is fixed or customizable? Commit to your answer.

Concept: Introduce CoreDNS configuration file and its plugin-based architecture.

CoreDNS uses a ConfigMap in Kubernetes to define its behavior. It has plugins like 'kubernetes' for service discovery, 'cache' for faster responses, and 'forward' to send queries outside the cluster. You can customize CoreDNS by editing this ConfigMap to add or remove plugins or change settings.

Result

Learners understand CoreDNS is flexible and can be tailored to cluster needs.

Knowing CoreDNS is plugin-based reveals how it can be extended or optimized for different environments.

5

Intermediate

DNS Query Flow Inside Kubernetes

Concept: Explain the step-by-step process of a DNS query from a pod to CoreDNS and back.

When a pod wants to connect to a service, it sends a DNS query to the cluster DNS IP (usually 10.96.0.10). This query reaches CoreDNS, which looks up the service name in its cache or Kubernetes API. CoreDNS replies with the IP address. The pod then uses this IP to connect to the service.

Result

Learners visualize the DNS request and response cycle inside the cluster.

Understanding the query flow clarifies how DNS requests are handled efficiently and reliably.

6

Advanced

Handling DNS Failures and Caching

🤔Before reading on: do you think CoreDNS caches DNS results indefinitely or for a limited time? Commit to your answer.

Concept: Discuss how CoreDNS caches DNS responses and handles failures to improve performance and reliability.

CoreDNS caches DNS answers for a configurable time (TTL). This reduces load on Kubernetes API and speeds up responses. If CoreDNS cannot reach the API or a service is missing, it returns an error or fallback. Proper caching and error handling prevent DNS storms and improve cluster stability.

Result

Learners grasp how caching and failure handling make DNS robust in production.

Knowing caching behavior helps prevent common issues like stale records or excessive API calls.

7

Expert

Customizing CoreDNS for Multi-Cluster and External DNS

🤔Before reading on: do you think CoreDNS can resolve names outside the cluster by default? Commit to your answer.

Concept: Explore advanced CoreDNS setups for multi-cluster DNS and forwarding external queries.

CoreDNS can be configured to forward DNS queries it cannot resolve to external DNS servers, enabling access to internet names. For multi-cluster setups, CoreDNS can be extended with plugins or custom zones to resolve services across clusters. This requires careful configuration to avoid conflicts and ensure security.

Result

Learners see how CoreDNS supports complex real-world Kubernetes networking scenarios.

Understanding these advanced configurations prepares learners for scaling Kubernetes DNS beyond single clusters.

Under the Hood

CoreDNS runs as a pod inside Kubernetes and uses a plugin chain to process DNS queries. The 'kubernetes' plugin watches the Kubernetes API server for services, endpoints, and pods, maintaining an internal cache of DNS records. When a query arrives, CoreDNS matches it against this cache or forwards it externally if needed. It uses UDP/TCP sockets to listen for DNS requests on the cluster DNS IP and port 53.

Why designed this way?

CoreDNS was chosen to replace kube-dns because it is lightweight, modular, and easier to extend. Its plugin architecture allows adding features without bloating the core. Integrating directly with Kubernetes API ensures DNS records are always up-to-date. Alternatives like kube-dns were monolithic and harder to maintain.

┌───────────────┐
│ Pod DNS Query │
└──────┬────────┘
       │
       ▼
┌───────────────┐
│ CoreDNS Pod   │
│ ┌───────────┐ │
│ │ Plugins:  │ │
│ │ kubernetes│ │
│ │ cache     │ │
│ │ forward   │ │
│ └───────────┘ │
└──────┬────────┘
       │
       ▼
┌───────────────┐
│ Kubernetes API│
│ (Services,    │
│ Endpoints)    │
└───────────────┘

Myth Busters - 4 Common Misconceptions

Quick: Does CoreDNS automatically resolve external internet names without configuration? Commit yes or no.

Common Belief: CoreDNS resolves all DNS queries, including internet domains, by default.

Reality: CoreDNS only resolves Kubernetes cluster names by default and forwards external queries only if configured with a forward plugin.

Why it matters: Assuming CoreDNS resolves internet names without setup can cause failed DNS lookups and broken external connectivity.

Quick: Do you think CoreDNS stores DNS records permanently? Commit yes or no.

Common Belief: CoreDNS keeps DNS records forever once learned.

Reality: CoreDNS caches DNS records temporarily and updates them by watching Kubernetes API to reflect changes.

Why it matters: Believing records are permanent can lead to confusion when services move or restart and DNS names resolve incorrectly.

Quick: Is CoreDNS a separate service outside Kubernetes? Commit yes or no.

Common Belief: CoreDNS runs outside Kubernetes as an independent DNS server.

Reality: CoreDNS runs inside Kubernetes as a pod and integrates tightly with the cluster's API.

Why it matters: Thinking CoreDNS is external can cause misconfiguration and misunderstanding of DNS resolution flow.

Quick: Does CoreDNS resolve pod names by default? Commit yes or no.

Common Belief: CoreDNS always resolves pod names to their IPs by default.

Reality: CoreDNS resolves service names by default; pod name resolution requires specific configuration and is not always enabled.

Why it matters: Expecting pod name resolution without setup can cause failed connections and debugging confusion.

Expert Zone

1

CoreDNS performance depends heavily on cache TTL settings; too low causes API overload, too high causes stale records.

2

The order of plugins in CoreDNS ConfigMap affects query handling; misordering can break DNS resolution or cause security issues.

3

CoreDNS logs and metrics are essential for diagnosing DNS issues but require enabling and understanding plugin-specific outputs.

When NOT to use

CoreDNS is not suitable for DNS outside Kubernetes clusters or for very large multi-cluster environments without extensions. Alternatives like external DNS services or service meshes with built-in discovery may be better for cross-cluster or hybrid cloud setups.

Production Patterns

In production, CoreDNS is often customized with caching tuned for cluster size, forwarding configured for external DNS, and additional plugins for metrics and security. Operators monitor CoreDNS pods for health and scale replicas to handle load. Multi-cluster DNS setups use CoreDNS federation or external DNS solutions.

Connections

Service Discovery

DNS in Kubernetes is a core mechanism enabling service discovery by name.

Understanding DNS helps grasp how services find each other automatically without hardcoded IPs.

Load Balancing

CoreDNS works with Kubernetes services that load balance traffic to pods behind the scenes.

Knowing DNS resolves service names to cluster IPs clarifies how load balancing targets are found.

Telephone Directory Systems

DNS functions similarly to telephone directories mapping names to numbers.

Recognizing this parallel helps understand DNS as a naming system that abstracts complex addressing.

Common Pitfalls

#1 Editing CoreDNS ConfigMap without validating syntax causes DNS failures.

Wrong approach:

apiVersion: v1
kind: ConfigMap
metadata:
name: coredns
namespace: kube-system
data:
Corefile: |
.:53 {
kubernetes cluster.local
forward . 8.8.8.8
cache 30
errors
}

Correct approach:

apiVersion: v1
kind: ConfigMap
metadata:
name: coredns
namespace: kube-system
data:
Corefile: |
.:53 {
errors
health
kubernetes cluster.local
forward . 8.8.8.8
cache 30
loop
reload
}

Root cause:

Misunderstanding CoreDNS plugin order and missing required plugins leads to DNS service disruption.

#2 Assuming DNS queries to external domains work without forward plugin configured.

Wrong approach:

CoreDNS ConfigMap without forward plugin:
.:53 {
kubernetes cluster.local
cache 30
errors
}

Correct approach:

CoreDNS ConfigMap with forward plugin:
.:53 {
errors
health
kubernetes cluster.local
forward . 8.8.8.8
cache 30
loop
reload
}

Root cause:

Not configuring forwarding causes CoreDNS to fail resolving internet domains.

#3 Using hardcoded IP addresses in pod configurations instead of service names.

Wrong approach:

curl http://10.244.1.5:8080/api

Correct approach:

curl http://my-service.default.svc.cluster.local:8080/api

Root cause:

Not using DNS names ignores Kubernetes service abstraction, causing fragile connections.

Key Takeaways

CoreDNS is the default DNS server inside Kubernetes that translates service names to IP addresses, enabling stable communication.

It integrates tightly with the Kubernetes API to keep DNS records updated as services and pods change.

CoreDNS uses a plugin-based configuration that can be customized for caching, forwarding, and other features.

Proper DNS setup is critical for cluster reliability; misconfiguration can cause service discovery failures.

Advanced CoreDNS configurations support multi-cluster DNS and external name resolution, essential for complex Kubernetes environments.