It Is Always DNS… Even at the Edge: Taming Proxy-Only Lookups With Cilium and eBPF
summary
Edge deployments hit customer DNS servers that return NXDOMAIN for public names so the team builds a small DNS-over-HTTPS proxy plus Cilium and Envoy wiring to force lookups through the customer HTTP forward proxy over port 443, avoiding firewall changes. CoreDNS is reconfigured to detect NXDOMAIN and call the proxy; Cilium uses Cilium network-policy traffic redirect to send DOH traffic into an Envoy tunnel-over-HTTP CONNECT defined by an CoreDNS NXDOMAIN-triggered DOH proxy. Demo shows it works; caching reduces added latency.
AI-written summary · about
chapters (7)
- 0:00Cloud native journey at Roche
- 3:30Kubernetes at the edge challenges
- 6:39Proxy setup for edge clusters
- 9:27DNS issues with customer DNS
- 13:21Live demo of DNS proxy
- 21:09Conclusion and key takeaways from the solution
- 22:34Q&A
related talks
34mIt’s Always DNS: So Let’s Break It On Purpose
35mCoreDNS: Beyond the Basics
32mDemystifying DNS: A Guide to Understanding and Debugging Request Flows in Kubernetes Clusters
29mCan We Really Parse DNS in eBPF? Improving Cilium ToFQDN With In-kernel Policy Upda...
27mMeshing It up Securely: How Roche Manages Network Connectivity for...
27mCoreDNS Deep Dive
35mDeep Dive: CoreDNS
41mService Discovery With Hybrid and Multi-Cloud: Introduction to CoreDNS