C12s/c12s-kubespray
3
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
c12s-kubespray/roles/dnsmasq/templates/01-kube-dns.conf.j2

34 lines
897 B
Text
Raw Normal View History

configure dnsmasq to listen on localhost only
2016-01-19 12:34:30 +00:00
#Listen on localhost
bind-interfaces
Use dnsmasq inside pods
2016-03-18 14:07:33 +00:00
listen-address=0.0.0.0
Initial commit
2015-10-03 20:19:50 +00:00
addn-hosts=/etc/hosts
Make dnsmasq daemon set optional Change additional dnsmasq opts: - Adjust caching size and TTL - Disable resolve conf to not create loops - Change dnsPolicy to default (similarly to kubedns's dnsmasq). The ClusterFirst should not be used to not create loops - Disable negative NXDOMAIN replies to be cached - Make its very installation as optional step (enabled by default). If you don't want more than 3 DNS servers, including 1 for K8s, disable it. - Add docs and a drawing to clarify DNS setup. - Fix stdout logs for dnsmasq/kubedns app configs - Add missed notifies to resolvconf -u handler - Fix idempotency of resolvconf head file changes Signed-off-by: Bogdan Dobrelya <bdobrelia@mirantis.com>
2016-09-22 17:14:51 +00:00
strict-order
# Forward k8s domain to kube-dns
server=/{{ dns_domain }}/{{ skydns_server }}
Do not forward bogus domains for upstream resolvers Also fix kube log level 4 to log dnsmasq queries. Signed-off-by: Bogdan Dobrelya <bdobrelia@mirantis.com>
2016-11-30 13:06:11 +00:00
# Reply NXDOMAIN to bogus domains requests like com.cluster.local.cluster.local
local=/{{ bogus_domains }}
Make dnsmasq daemon set optional Change additional dnsmasq opts: - Adjust caching size and TTL - Disable resolve conf to not create loops - Change dnsPolicy to default (similarly to kubedns's dnsmasq). The ClusterFirst should not be used to not create loops - Disable negative NXDOMAIN replies to be cached - Make its very installation as optional step (enabled by default). If you don't want more than 3 DNS servers, including 1 for K8s, disable it. - Add docs and a drawing to clarify DNS setup. - Fix stdout logs for dnsmasq/kubedns app configs - Add missed notifies to resolvconf -u handler - Fix idempotency of resolvconf head file changes Signed-off-by: Bogdan Dobrelya <bdobrelia@mirantis.com>
2016-09-22 17:14:51 +00:00
Initial commit
2015-10-03 20:19:50 +00:00
#Set upstream dns servers
Also add the system nameservers to upstream servers in dnsmasq Also make no-resolv unconditional again. Otherwise, we may end up in a resolver loop. The resolver loop was the cause for the piling up parallel queries.
2017-02-07 10:54:07 +00:00
{% if system_and_upstream_dns_servers|length > 0 %}
{% for srv in system_and_upstream_dns_servers %}
Initial commit
2015-10-03 20:19:50 +00:00
server={{ srv }}
{% endfor %}
Only use default resolver in dnsmasq when we are using host_resolvconf mode
2017-01-06 09:21:07 +00:00
{% elif resolvconf_mode == 'host_resolvconf' %}
{# The default resolver is only needed when the hosts resolv.conf was modified by us. If it was not modified, we can rely on dnsmasq to reuse the systems resolv.conf #}
Preconfigure DNS stack and docker early In order to enable offline/intranet installation cases: * Move DNS/resolvconf configuration to preinstall role. Remove skip_dnsmasq_k8s var as not needed anymore. * Preconfigure DNS stack early, which may be the case when downloading artifacts from intranet repositories. Do not configure K8s DNS resolvers for hosts /etc/resolv.conf yet early (as they may be not existing). * Reconfigure K8s DNS resolvers for hosts only after kubedns/dnsmasq was set up and before K8s apps to be created. * Move docker install task to early stage as well and unbind it from the etcd role's specific install path. Fix external flannel dependency on docker role handlers. Also fix the docker restart handlers' steps ordering to match the expected sequence (the socket then the service). * Add default resolver fact, which is the cloud provider specific and remove hardcoded GCE resolver. * Reduce default ndots for hosts /etc/resolv.conf to 2. Multiple search domains combined with high ndots values lead to poor performance of DNS stack and make ansible workers to fail very often with the "Timeout (12s) waiting for privilege escalation prompt:" error. * Update docs. Signed-off-by: Bogdan Dobrelya <bdobrelia@mirantis.com>
2016-12-07 15:57:05 +00:00
server={{ default_resolver }}
Initial commit
2015-10-03 20:19:50 +00:00
{% endif %}
Do not forward bogus domains for upstream resolvers Also fix kube log level 4 to log dnsmasq queries. Signed-off-by: Bogdan Dobrelya <bdobrelia@mirantis.com>
2016-11-30 13:06:11 +00:00
{% if kube_log_level == '4' %}
Tune dnsmasq/kubedns limits, replicas, logging * Add dns_replicas, dns_memory/cpu_limit/requests vars for dns related apps. * When kube_log_level=4, log dnsmasq queries as well. * Add log level control for skydns (part of kubedns app). * Add limits/requests vars for dnsmasq (part of kubedns app) and dnsmasq daemon set. * Drop string defaults for kube_log_level as it is int and is defined in the global vars as well. * Add docs Signed-off-by: Bogdan Dobrelya <bdobrelia@mirantis.com>
2016-11-25 10:33:39 +00:00
log-queries
{% endif %}
Also add the system nameservers to upstream servers in dnsmasq Also make no-resolv unconditional again. Otherwise, we may end up in a resolver loop. The resolver loop was the cause for the piling up parallel queries.
2017-02-07 10:54:07 +00:00
no-resolv
Disable reverse lookups again Initially this was removed, but it turns out that services that perform reverse lookups (such as MariaDB) will encounter severe performance degredation with this disabled.
2016-09-29 06:48:32 +00:00
bogus-priv
Make dnsmasq daemon set optional Change additional dnsmasq opts: - Adjust caching size and TTL - Disable resolve conf to not create loops - Change dnsPolicy to default (similarly to kubedns's dnsmasq). The ClusterFirst should not be used to not create loops - Disable negative NXDOMAIN replies to be cached - Make its very installation as optional step (enabled by default). If you don't want more than 3 DNS servers, including 1 for K8s, disable it. - Add docs and a drawing to clarify DNS setup. - Fix stdout logs for dnsmasq/kubedns app configs - Add missed notifies to resolvconf -u handler - Fix idempotency of resolvconf head file changes Signed-off-by: Bogdan Dobrelya <bdobrelia@mirantis.com>
2016-09-22 17:14:51 +00:00
no-negcache
Allow to specify number of concurrent DNS queries ndots creates overhead as every pod creates 5 concurrent connections that are forwarded to sky dns. Under some circumstances dnsmasq may prevent forwarding traffic with "Maximum number of concurrent DNS queries reached" in the logs. This patch allows to configure the number of concurrent forwarded DNS queries "dns-forward-max" as well as "cache-size" leaving the default values as they were before. Signed-off-by: Sergii Golovatiuk <sgolovatiuk@mirantis.com>
2017-01-19 09:07:37 +00:00
cache-size={{ cache_size }}
dns-forward-max={{ dns_forward_max }}
Make dnsmasq daemon set optional Change additional dnsmasq opts: - Adjust caching size and TTL - Disable resolve conf to not create loops - Change dnsPolicy to default (similarly to kubedns's dnsmasq). The ClusterFirst should not be used to not create loops - Disable negative NXDOMAIN replies to be cached - Make its very installation as optional step (enabled by default). If you don't want more than 3 DNS servers, including 1 for K8s, disable it. - Add docs and a drawing to clarify DNS setup. - Fix stdout logs for dnsmasq/kubedns app configs - Add missed notifies to resolvconf -u handler - Fix idempotency of resolvconf head file changes Signed-off-by: Bogdan Dobrelya <bdobrelia@mirantis.com>
2016-09-22 17:14:51 +00:00
max-cache-ttl=10
max-ttl=20
log-facility=-
Reference in a new issue Copy permalink