Pod DNS Policy and dnsConfig
Where does the resolv.conf inside a Pod come from? The Kubelet configures it from its own clusterDNS settings, the resolver file its resolvConf setting names and the Pod spec, and dnsPolicy picks the source: ClusterFirst when unset, Default for the Node file, None for dnsConfig alone. A hostNetwork Pod left on ClusterFirst silently gets the Node file, and dnsConfig merges on top, appending nameservers up to three and overriding options by name.
Play the animation 6 steps, animated, best on a wide screen
Pod DNS Policy and dnsConfig, step by step
-
Pod web was created with dnsPolicy unset, so the API server defaulted it to ClusterFirst, not Default, before the Kubelet got it from its API watch. The nameserver is the Kubelet clusterDNS, three cluster search domains come before the Node ones, and the Node options are dropped for ndots:5.
Play from step 1 -
With dnsPolicy Default the Kubelet copies the nameserver, search and options lines of the file its resolvConf setting names, /etc/resolv.conf by default. On systemd-resolved hosts it should name /run/systemd/resolve/resolv.conf, since the stub file can cause a forwarding loop.
Play from step 2 -
A Pod with hostNetwork true shares the network namespace of the Node. Left on ClusterFirst it quietly falls back to Default, so it gets the Node file, and cluster names resolve only if the Node resolver forwards the cluster domain to cluster DNS.
Play from step 3 -
Setting dnsPolicy ClusterFirstWithHostNet is how a host network Pod gets the cluster file back: the cluster nameserver, the cluster search domains before the Node ones, and ndots:5, exactly as for a ClusterFirst Pod. Windows Nodes do not support this policy.
Play from step 4 -
With dnsPolicy None the Kubelet starts from an empty configuration and uses neither the Node file nor its cluster settings. Everything comes from dnsConfig, which must then list at least one nameserver, and its searches and options are written as given, minus duplicates.
Play from step 5 -
On the other policies dnsConfig merges on top. Its three nameservers are appended to the ClusterFirst one and then cut to the first 3 with a warning event, so 192.0.2.3 is dropped. Its searches are appended minus duplicates, so only lab.test is new, and ndots:2 replaces ndots:5 by name while edns0 is added.
Play from step 6