kubernetes-sigs / kubernetes-sigs/kubespray

'Nameserver limits were exceeded' on new Kubespray setup

Open
#13,402 9 comments 0 reactions 0 assignees View on GitHub
kind/bug triage/needs-information Ubuntu 24
Dominant language
Jinja
Stars
18.7k
Forks
6.9k
Avg merge
2d 11h
Merged PRs (30d)
53

Description

### What happened?

K8s destination servers have 2 DNS Servers setup to use the company DNS servers for name resolution.
After applying Kubespray, two more DNS servers are added by Kubespray:

* one IP for the `nodelocaldns_ip` when `enable_nodelocaldns` is `true` (`169.254.25.10`)
* one IP for the `kube_service_addresses` and `kube_pods_subnet` (`10.233.0.3`)

With this, the total count of DNS servers written in `/etc/resolv.conf` sum up to 4, which triggers an error in K8s:

> Nameserver limits were exceeded, some nameservers have been omitted, the applied nameserver line is: [...]

Image

After kubespray, the `/etc/resolv.conf` file looks like this on the nodes:

Image

### What did you expect to happen?

Not receive an error when nothing was done wrong. Having 2 DNS Servers is a best practice for server administration due to fallback reasons.
If Kubespray changes this, it shouldn't create a situation which makes K8s complain.

### How can we reproduce it (as minimally and precisely as possible)?

* Have cluster nodes which have 2 DNS Servers in `/etc/resolv.conf`
* Set `enable_nodelocaldns: true` in `group_vars/k8s_cluster/k8s-cluster.yml` (default)

### OS

Ubuntu 24

### Version of Ansible

ansible [core 2.18.16]
config file = /kubespray/ansible.cfg
configured module search path = ['/kubespray/library']
ansible python module location = /usr/local/lib/python3.12/dist-packages/ansible
ansible collection location = /root/.ansible/collections:/usr/share/ansible/collections
executable location = /usr/local/bin/ansible
python version = 3.12.3 (main, Mar 23 2026, 19:04:32) [GCC 13.3.0] (/usr/bin/python3)
jinja version = 3.1.6
libyaml = True

### Version of Python

Python 3.12.3

### Version of Kubespray (commit)

1c9add4

### Network plugin used

calico

### Full inventory with variables

https://gist.github.com/The-Judge/5a53fd4d945fed7d1ec5b7469a0e6c97

### Command used to invoke ansible

ansible-playbook -i /inventory/hosts.yaml --private-key /root/.ssh/id_rsa cluster.yml -b -v

### Output of ansible run

https://gist.github.com/The-Judge/e89ed791e8a472fb2cf4679f1929abea

### Anything else we need to know

_No response_

Contributor guide

Open the contributing guide

Research direction

Reproduce the issue with two existing DNS servers and enable_nodelocaldns: true in group_vars/k8s_cluster/k8s-cluster.yml. Compare the resulting /etc/resolv.conf with the Kubernetes nameserver limit warning, using the supplied inventory and Ansible output for context. Done means the configured DNS servers remain usable without Kubernetes reporting that nameservers were omitted.

Written by the indexing model from the issue text.

Assessment

Tech stack
ansible, kubernetes, ubuntu
Domain
infrastructure, networking
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.