Chapter 2. DNS Operator in OpenShift Dedicated

1. Use the oc get command to view the deployment status:

   $ oc get -n openshift-dns-operator deployment/dns-operator

   Example output

   NAME           READY     UP-TO-DATE   AVAILABLE   AGE
   dns-operator   1/1       1            1           23h

2. Use the oc get command to view the state of the DNS Operator:

   $ oc get clusteroperator/dns

   Example output

   NAME      VERSION     AVAILABLE   PROGRESSING   DEGRADED   SINCE   MESSAGE
   dns       4.1.15-0.11  True        False         False      92m

   AVAILABLE, PROGRESSING, and DEGRADED provide information about the status of the Operator. AVAILABLE is True when at least 1 pod from the CoreDNS daemon set reports an Available status condition, and the DNS service has a cluster IP address.

Procedure

1. Use the oc describe command to view the default dns:

   $ oc describe dns.operator/default

   Example output

   Name:         default
   Namespace:
   Labels:       <none>
   Annotations:  <none>
   API Version:  operator.openshift.io/v1
   Kind:         DNS
   ...
   Status:
     Cluster Domain:  cluster.local 1
     Cluster IP:      172.30.0.10 2
   ...

   1

   The Cluster Domain field is the base DNS domain used to construct fully qualified pod and service domain names.

   2

   The Cluster IP is the address pods query for name resolution. The IP is defined as the 10th address in the service CIDR range.

Procedure

1. Modify the DNS Operator object named default:

   $ oc edit dns.operator/default

   After you issue the previous command, the Operator creates and updates the config map named dns-default with additional server configuration blocks based on spec.servers.

   Important

   When specifying values for the zones parameter, ensure that you only forward to specific zones, such as your intranet. You must specify at least one zone. Otherwise, your cluster can lose functionality.

   If none of the servers have a zone that matches the query, then name resolution falls back to the upstream DNS servers.

   Configuring DNS forwarding

   apiVersion: operator.openshift.io/v1
   kind: DNS
   metadata:
     name: default
   spec:
     cache:
       negativeTTL: 0s
       positiveTTL: 0s
     logLevel: Normal
     nodePlacement: {}
     operatorLogLevel: Normal
     servers:
     - name: example-server 1
       zones:
       - example.com 2
       forwardPlugin:
         policy: Random 3
         upstreams: 4
         - 1.1.1.1
         - 2.2.2.2:5353
     upstreamResolvers: 5
       policy: Random 6
       protocolStrategy: ""  7
       transportConfig: {}  8
       upstreams:
       - type: SystemResolvConf 9
       - type: Network
         address: 1.2.3.4 10
         port: 53 11
       status:
         clusterDomain: cluster.local
         clusterIP: x.y.z.10
         conditions:
      ...

   1

   Must comply with the rfc6335 service name syntax.

   2

   Must conform to the definition of a subdomain in the rfc1123 service name syntax. The cluster domain, cluster.local, is an invalid subdomain for the zones field.

   3

   Defines the policy to select upstream resolvers listed in the forwardPlugin. Default value is Random. You can also use the values RoundRobin, and Sequential.

   4

   A maximum of 15 upstreams is allowed per forwardPlugin.

   5

   You can use upstreamResolvers to override the default forwarding policy and forward DNS resolution to the specified DNS resolvers (upstream resolvers) for the default domain. If you do not provide any upstream resolvers, the DNS name queries go to the servers declared in /etc/resolv.conf.

   6

   Determines the order in which upstream servers listed in upstreams are selected for querying. You can specify one of these values: Random, RoundRobin, or Sequential. The default value is Sequential.

   7

   When omitted, the platform chooses a default, normally the protocol of the original client request. Set to TCP to specify that the platform should use TCP for all upstream DNS requests, even if the client request uses UDP.

   8

   Used to configure the transport type, server name, and optional custom CA or CA bundle to use when forwarding DNS requests to an upstream resolver.

   9

   You can specify two types of upstreams: SystemResolvConf or Network. SystemResolvConf configures the upstream to use /etc/resolv.conf and Network defines a Networkresolver. You can specify one or both.

   10

   If the specified type is Network, you must provide an IP address. The address field must be a valid IPv4 or IPv6 address.

   11

   If the specified type is Network, you can optionally provide a port. The port field must have a value between 1 and 65535. If you do not specify a port for the upstream, the default port is 853.

Verification

1. To review the resulting change, enter the following command:

   $ oc get dnses.operator -A -oyaml

   You should see two log level entries. The operatorLogLevel applies to OpenShift DNS Operator issues, and the logLevel applies to the daemonset of CoreDNS pods:

    logLevel: Trace
    operatorLogLevel: Debug

2. To review the logs for the daemonset, enter the following command:

   $ oc logs -n openshift-dns ds/dns-default

Procedure

1. Edit the DNS Operator object named default by running the following command:

   $ oc edit dns.operator.openshift.io/default

2. Modify the time-to-live (TTL) caching values:

   Configuring DNS caching

   apiVersion: operator.openshift.io/v1
   kind: DNS
   metadata:
     name: default
   spec:
     cache:
       positiveTTL: 1h 1
       negativeTTL: 0.5h10m 2

   1

   The string value 1h is converted to its respective number of seconds by CoreDNS. If this field is omitted, the value is assumed to be 0s and the cluster uses the internal default value of 900s as a fallback.

   2

   The string value can be a combination of units such as 0.5h10m and is converted to its respective number of seconds by CoreDNS. If this field is omitted, the value is assumed to be 0s and the cluster uses the internal default value of 30s as a fallback.

Verification

1. To review the change, look at the config map again by running the following command:

   oc get configmap/dns-default -n openshift-dns -o yaml

2. Verify that you see entries that look like the following example:

          cache 3600 {
               denial 9984 2400
           }