Node local DNS cache not working with bind IP true

[sanjaykkr]

I enabled the bind IP true while deploying this chart.

This the corefile used for node local dns cache,

Corefile: |
cluster.local:53 {
log
errors
cache {
success 9984 30
denial 9984 5
prefetch 3 60s 20%
}
reload
loop
bind 169.254.20.25 172.20.0.10
forward . PILLAR__CLUSTER__DNS {
force_tcp
}
prometheus :9253
health :62434
}
in-addr.arpa:53 {
errors
cache {
prefetch 3 60s 20%
}
reload
loop
bind 169.254.20.25 172.20.0.10
forward . PILLAR__CLUSTER__DNS {
force_tcp
}
prometheus :9253
}
ip6.arpa:53 {
errors
cache {
prefetch 3 60s 20%
}
reload
loop
bind 169.254.20.25 172.20.0.10
forward . PILLAR__CLUSTER__DNS {
force_tcp
}
prometheus :9253
}
.:53 {
log
errors
cache {
prefetch 3 60s 20%
}
reload
loop
bind 169.254.20.25 172.20.0.10
forward . PILLAR__UPSTREAM__SERVERS
prometheus :9253
}

kube-system kube-dns ClusterIP 172.20.0.10 dns:53►0╱UDP dns-tcp:53►0 metrics:9153►0

I dont see the node local dns cache getting bind to the requests coming towards coredns

[sanjaykkr]

│ [INFO] 169.254.20.25:59384 - 35974 "HINFO IN 6748091981269100221.5931735662964552412. udp 57 false 512" NXDOMAIN qr,rd,ra 132 0.004483071s │
│ [INFO] Added back nodelocaldns rule - {raw PREROUTING [-p tcp -d 169.254.20.25 --dport 53 -j NOTRACK -m comment --comment NodeLocal DNS Cache: skip conntrack]} │
│ [INFO] Added back nodelocaldns rule - {raw PREROUTING [-p udp -d 169.254.20.25 --dport 53 -j NOTRACK -m comment --comment NodeLocal DNS Cache: skip conntrack]} │
│ [INFO] Added back nodelocaldns rule - {filter INPUT [-p tcp -d 169.254.20.25 --dport 53 -j ACCEPT -m comment --comment NodeLocal DNS Cache: allow DNS traffic]} │
│ [INFO] Added back nodelocaldns rule - {filter INPUT [-p udp -d 169.254.20.25 --dport 53 -j ACCEPT -m comment --comment NodeLocal DNS Cache: allow DNS traffic]} │
│ [INFO] Added back nodelocaldns rule - {raw OUTPUT [-p tcp -s 169.254.20.25 --sport 53 -j NOTRACK -m comment --comment NodeLocal DNS Cache: skip conntrack]} │
│ [INFO] Added back nodelocaldns rule - {raw OUTPUT [-p udp -s 169.254.20.25 --sport 53 -j NOTRACK -m comment --comment NodeLocal DNS Cache: skip conntrack]} │
│ [INFO] Added back nodelocaldns rule - {filter OUTPUT [-p tcp -s 169.254.20.25 --sport 53 -j ACCEPT -m comment --comment NodeLocal DNS Cache: allow DNS traffic]} │
│ [INFO] Added back nodelocaldns rule - {filter OUTPUT [-p udp -s 169.254.20.25 --sport 53 -j ACCEPT -m comment --comment NodeLocal DNS Cache: allow DNS traffic]} │
│ [INFO] Added back nodelocaldns rule - {raw OUTPUT [-p tcp -d 169.254.20.25 --dport 53 -j NOTRACK -m comment --comment NodeLocal DNS Cache: skip conntrack]} │
│ [INFO] Added back nodelocaldns rule - {raw OUTPUT [-p udp -d 169.254.20.25 --dport 53 -j NOTRACK -m comment --comment NodeLocal DNS Cache: skip conntrack]} │
│ [INFO] Added back nodelocaldns rule - {raw OUTPUT [-p tcp -d 169.254.20.25 --dport 8080 -j NOTRACK -m comment --comment NodeLocal DNS Cache: skip conntrack]} │
│ [INFO] Added back nodelocaldns rule - {raw OUTPUT [-p tcp -s 169.254.20.25 --sport 8080 -j NOTRACK -m comment --comment NodeLocal DNS Cache: skip conntrack]} │
│ [INFO] Added back nodelocaldns rule - {raw PREROUTING [-p tcp -d 172.20.0.10 --dport 53 -j NOTRACK -m comment --comment NodeLocal DNS Cache: skip conntrack]} │
│ [INFO] Added back nodelocaldns rule - {raw PREROUTING [-p udp -d 172.20.0.10 --dport 53 -j NOTRACK -m comment --comment NodeLocal DNS Cache: skip conntrack]} │
│ [INFO] Added back nodelocaldns rule - {filter INPUT [-p tcp -d 172.20.0.10 --dport 53 -j ACCEPT -m comment --comment NodeLocal DNS Cache: allow DNS traffic]} │
│ [INFO] Added back nodelocaldns rule - {filter INPUT [-p udp -d 172.20.0.10 --dport 53 -j ACCEPT -m comment --comment NodeLocal DNS Cache: allow DNS traffic]} │
│ [INFO] Added back nodelocaldns rule - {raw OUTPUT [-p tcp -s 172.20.0.10 --sport 53 -j NOTRACK -m comment --comment NodeLocal DNS Cache: skip conntrack]} │
│ [INFO] Added back nodelocaldns rule - {raw OUTPUT [-p udp -s 172.20.0.10 --sport 53 -j NOTRACK -m comment --comment NodeLocal DNS Cache: skip conntrack]} │
│ [INFO] Added back nodelocaldns rule - {filter OUTPUT [-p tcp -s 172.20.0.10 --sport 53 -j ACCEPT -m comment --comment NodeLocal DNS Cache: allow DNS traffic]} │
│ [INFO] Added back nodelocaldns rule - {filter OUTPUT [-p udp -s 172.20.0.10 --sport 53 -j ACCEPT -m comment --comment NodeLocal DNS Cache: allow DNS traffic]} │
│ [INFO] Added back nodelocaldns rule - {raw OUTPUT [-p tcp -d 172.20.0.10 --dport 53 -j NOTRACK -m comment --comment NodeLocal DNS Cache: skip conntrack]} │
│ [INFO] Added back nodelocaldns rule - {raw OUTPUT [-p udp -d 172.20.0.10 --dport 53 -j NOTRACK -m comment --comment NodeLocal DNS Cache: skip conntrack]} │
│ [INFO] Added back nodelocaldns rule - {raw OUTPUT [-p tcp -d 172.20.0.10 --dport 8080 -j NOTRACK -m comment --comment NodeLocal DNS Cache: skip conntrack]} │
│ [INFO] Added back nodelocaldns rule - {raw OUTPUT [-p tcp -s 172.20.0.10 --sport 8080 -j NOTRACK -m comment --comment NodeLocal DNS Cache: skip conntrack]} │

there is not traffic coming into the node local dns cache after this

[S-Abhishek]

Hey, I faced the same issue in AWS EKS with CoreDNS addon.

Do check whether your /etc/resolv.conf of the pods that are making DNS queries have nameserver as 10.100.0.10 instead of 172.20.0.10 (which you have configured). Turns out, CoreDNS server IP can either be 172.20.0.10 or 10.100.0.10 depending on your VPC CIDR (Ref). Configuring config.dnsServer on node-local-cache as 10.100.0.10 fixed my issue.

[github-actions]

This issue is stale because it has been open 14 days with no activity. Remove stale label or comment or this will be closed in 5 days.

[github-actions]

This issue is stale because it has been open 14 days with no activity. Remove stale label or comment or this will be closed in 5 days.