Rethinking the K8s DNS for the Modern Enterprise
Talkat KubeCon + CloudNativeCon North America 2019 · on Tuesday, 2019-11-19· at 11:50· Room 30ABCDE - San Diego Convention Center, Upper Level·
summary
Proposes a concrete design: a drafted per-namespace DNS CRD that binds groups of namespaces to tenant DNS servers and routes pod DNS through an Envoy DNS filter sidecar, enabling isolation so services in staging cannot resolve production names. Implements whitelist/blacklist policy checks (local or gRPC policy server), emits DNS metrics via Envoy stats scraped by Prometheus Operator for observability, supports protocol upgrade to DNS-over-HTTPS/TLS, and updates policies at runtime via xDS without restarting pods.
AI-written summary · about
chapters (18)
- 0:00Introduction
- 0:10Agenda
- 1:02Naming in general
- 1:47Can we use DNS
- 2:22Multitenant
- 4:24Service Discovery
- 6:10Service Isolation
- 9:13Current State of DNS
- 10:54DNS Isolation
- 12:50DNS Observability
- 14:28DNS Filtering
- 17:30Extensible Model
- 18:17DNS Evolution
- 19:59Demo
- 21:37Containers
- 23:10Code
- 25:02Summary
- 26:22Questions Answers
related talks
29mIntro: CoreDNS
23mIstio and DNS
34mIt’s Always DNS: So Let’s Break It On Purpose
32mDemystifying DNS: A Guide to Understanding and Debugging Request Flows in Kubernetes Clusters
38mMulti-Tenancy WG Deep Dive
43mKubeCon: A Story of Two Service Discoveries: Bringing Legacy to Kubernetes
35mDeep Dive: CoreDNS
38mIntro: CoreDNS