DNS Resolution via CoreDNS
When a Pod connects to a Service by name, who turns that name into an IP? The Kubelet configures a resolv.conf pointing at the kube-dns ClusterIP, so the query reaches a CoreDNS Pod where the plugin chain checks its cache first and falls through to the kubernetes plugin on a miss. That plugin answers the cluster zone from its own watch of Services and EndpointSlices, never querying the API per lookup, and returns an A record holding the ClusterIP.
Play the animation 5 steps, animated, best on a wide screen
DNS Resolution via CoreDNS, step by step
-
The Kubelet configured the Pod /etc/resolv.conf when the Pod started. Its nameserver is the kube-dns Service ClusterIP, it lists the cluster search domains, and it sets ndots:5. The app asks for a name and knows nothing about CoreDNS.
Play from step 1 -
The short name web has fewer than 5 dots, so the resolver expands it against the search list to web.default.svc.cluster.local and sends it to the kube-dns ClusterIP. The query reaches a CoreDNS Pod and runs down its plugin chain to cache, the first stage that can answer it.
Play from step 2 -
The order of the chain is compiled into the binary rather than taken from the Corefile, and cache stands before the kubernetes plugin in it. A fresh name is not in the cache, so the request falls to that plugin. A name outside the cluster zone would keep falling, to forward.
Play from step 3 -
The kubernetes plugin answers the cluster zone from its own watch of Services and EndpointSlices on the API, never querying it per lookup, and it builds an A record holding the Service ClusterIP 10.96.0.20. The answer climbs back up the chain, and cache keeps a copy on the way out, unless the Corefile disables caching for the cluster zone, as kubeadm does.
Play from step 4 -
The answer leaves the chain the way the query came in and travels home. The client now has an address and opens its connection to that ClusterIP, which is where the kube-proxy path takes over. While the record is inside its TTL the next lookup of this name that lands on this Pod is answered by that copy alone. Under kubeadm it goes to the kubernetes plugin every time.
Play from step 5