kubernetes-sigs / kubernetes-sigs/kubespray
'Nameserver limits were exceeded' on new Kubespray setup
- Dominant language
- Jinja
- Stars
- 18.7k
- Forks
- 6.9k
- Avg merge
- 2d 11h
- Merged PRs (30d)
- 53
Description
### What happened?
K8s destination servers have 2 DNS Servers setup to use the company DNS servers for name resolution.
After applying Kubespray, two more DNS servers are added by Kubespray:
* one IP for the `nodelocaldns_ip` when `enable_nodelocaldns` is `true` (`169.254.25.10`)
* one IP for the `kube_service_addresses` and `kube_pods_subnet` (`10.233.0.3`)
With this, the total count of DNS servers written in `/etc/resolv.conf` sum up to 4, which triggers an error in K8s:
> Nameserver limits were exceeded, some nameservers have been omitted, the applied nameserver line is: [...]
After kubespray, the `/etc/resolv.conf` file looks like this on the nodes:
### What did you expect to happen?
Not receive an error when nothing was done wrong. Having 2 DNS Servers is a best practice for server administration due to fallback reasons.
If Kubespray changes this, it shouldn't create a situation which makes K8s complain.
### How can we reproduce it (as minimally and precisely as possible)?
* Have cluster nodes which have 2 DNS Servers in `/etc/resolv.conf`
* Set `enable_nodelocaldns: true` in `group_vars/k8s_cluster/k8s-cluster.yml` (default)
### OS
Ubuntu 24
### Version of Ansible
ansible [core 2.18.16]
config file = /kubespray/ansible.cfg
configured module search path = ['/kubespray/library']
ansible python module location = /usr/local/lib/python3.12/dist-packages/ansible
ansible collection location = /root/.ansible/collections:/usr/share/ansible/collections
executable location = /usr/local/bin/ansible
python version = 3.12.3 (main, Mar 23 2026, 19:04:32) [GCC 13.3.0] (/usr/bin/python3)
jinja version = 3.1.6
libyaml = True
### Version of Python
Python 3.12.3
### Version of Kubespray (commit)
1c9add4
### Network plugin used
calico
### Full inventory with variables
https://gist.github.com/The-Judge/5a53fd4d945fed7d1ec5b7469a0e6c97
### Command used to invoke ansible
ansible-playbook -i /inventory/hosts.yaml --private-key /root/.ssh/id_rsa cluster.yml -b -v
### Output of ansible run
https://gist.github.com/The-Judge/e89ed791e8a472fb2cf4679f1929abea
### Anything else we need to know
_No response_
Contributor guide
Research direction
Reproduce the issue with two existing DNS servers and enable_nodelocaldns: true in group_vars/k8s_cluster/k8s-cluster.yml. Compare the resulting /etc/resolv.conf with the Kubernetes nameserver limit warning, using the supplied inventory and Ansible output for context. Done means the configured DNS servers remain usable without Kubernetes reporting that nameservers were omitted.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- ansible, kubernetes, ubuntu
- Domain
- infrastructure, networking
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100