openshift / openshift/origin

DNS resolution fails if default search domain has a wildcard match

Open
#17,316 14 comments 0 reactions 1 assignee View on GitHub

@knobunc is already working on this.

Since Nov 15, 2017.

component/networking kind/bug lifecycle/frozen priority/P2
Dominant language
Go
Stars
8.7k
Forks
4.8k
Avg merge
4d 10h
Merged PRs (30d)
53

Description

Name resolution from inside the pod seams to be broken because of multiple factor.

Version
# oc version
oc v3.7.0-rc.0+e92d5c5
kubernetes v1.7.6+a08f5eeb62
features: Basic-Auth GSSAPI Kerberos SPNEGO

Server https://127.0.0.1:8443
openshift v3.7.0-rc.0+e92d5c5
kubernetes v1.7.6+a08f5eeb62
Steps To Reproduce

Look like the /etc/resolv.conf file generated by openshift is not working in every scenario.

Just to show it's working with something...

# cat /etc/resolv.conf
nameserver 8.8.8.8
search patrikdufresne.com

# nslookup -debug dl-cdn.alpinelinux.org
Server:		8.8.8.8
Address:	8.8.8.8#53

------------
    QUESTIONS:
	dl-cdn.alpinelinux.org, type = A, class = IN
    ANSWERS:
    ->  dl-cdn.alpinelinux.org
	canonical name = global.prod.fastly.net.
	ttl = 59
    ->  global.prod.fastly.net
	internet address = 151.101.0.249
	ttl = 19
    ->  global.prod.fastly.net
	internet address = 151.101.64.249
	ttl = 19
    ->  global.prod.fastly.net
	internet address = 151.101.128.249
	ttl = 19
    ->  global.prod.fastly.net
	internet address = 151.101.192.249
	ttl = 19
    AUTHORITY RECORDS:
    ADDITIONAL RECORDS:
------------
Non-authoritative answer:
dl-cdn.alpinelinux.org	canonical name = global.prod.fastly.net.
Name:	global.prod.fastly.net
Address: 151.101.0.249
Name:	global.prod.fastly.net
Address: 151.101.64.249
Name:	global.prod.fastly.net
Address: 151.101.128.249
Name:	global.prod.fastly.net
Address: 151.101.192.249

This is the /etc/resolv.conf generated in the pod. not working

# cat /etc/resolv.conf 
nameserver 8.8.8.8
search default.svc.cluster.local svc.cluster.local cluster.local patrikdufresne.com
options ndots:5

# nslookup -debug dl-cdn.alpinelinux.org
Server:		8.8.8.8
Address:	8.8.8.8#53

------------
    QUESTIONS:
	dl-cdn.alpinelinux.org.default.svc.cluster.local, type = A, class = IN
    ANSWERS:
    AUTHORITY RECORDS:
    ->  .
	origin = a.root-servers.net
	mail addr = nstld.verisign-grs.com
	serial = 2017111401
	refresh = 1800
	retry = 900
	expire = 604800
	minimum = 86400
	ttl = 86385
    ADDITIONAL RECORDS:
------------
** server can't find dl-cdn.alpinelinux.org.default.svc.cluster.local: NXDOMAIN
Server:		8.8.8.8
Address:	8.8.8.8#53

------------
    QUESTIONS:
	dl-cdn.alpinelinux.org.svc.cluster.local, type = A, class = IN
    ANSWERS:
    AUTHORITY RECORDS:
    ->  .
	origin = a.root-servers.net
	mail addr = nstld.verisign-grs.com
	serial = 2017111401
	refresh = 1800
	retry = 900
	expire = 604800
	minimum = 86400
	ttl = 86394
    ADDITIONAL RECORDS:
------------
** server can't find dl-cdn.alpinelinux.org.svc.cluster.local: NXDOMAIN
Server:		8.8.8.8
Address:	8.8.8.8#53

------------
    QUESTIONS:
	dl-cdn.alpinelinux.org.cluster.local, type = A, class = IN
    ANSWERS:
    AUTHORITY RECORDS:
    ->  .
	origin = a.root-servers.net
	mail addr = nstld.verisign-grs.com
	serial = 2017111401
	refresh = 1800
	retry = 900
	expire = 604800
	minimum = 86400
	ttl = 86378
    ADDITIONAL RECORDS:
------------
** server can't find dl-cdn.alpinelinux.org.cluster.local: NXDOMAIN
Server:		8.8.8.8
Address:	8.8.8.8#53

------------
    QUESTIONS:
	dl-cdn.alpinelinux.org.patrikdufresne.com, type = A, class = IN
    ANSWERS:
    AUTHORITY RECORDS:
    ->  patrikdufresne.com
	origin = ns2.no-ip.com
	mail addr = hostmaster.no-ip.com
	serial = 2010091255
	refresh = 10800
	retry = 1800
	expire = 604800
	minimum = 1800
	ttl = 1799
    ADDITIONAL RECORDS:
------------
Non-authoritative answer:
*** Can't find dl-cdn.alpinelinux.org: No answer

If I remove my domain name patrikdufresne.com. working

# cat /etc/resolv.conf 
nameserver 8.8.8.8
search default.svc.cluster.local svc.cluster.local cluster.local
options ndots:5
root@tymara:/home/ikus060# nslookup dl-cdn.alpinelinux.org
Server:		8.8.8.8
Address:	8.8.8.8#53

Non-authoritative answer:
dl-cdn.alpinelinux.org	canonical name = global.prod.fastly.net.
Name:	global.prod.fastly.net
Address: 151.101.0.249
Name:	global.prod.fastly.net
Address: 151.101.64.249
Name:	global.prod.fastly.net
Address: 151.101.128.249
Name:	global.prod.fastly.net
Address: 151.101.192.249

Also working if I remove ndots:5.

# cat /etc/resolv.conf 
nameserver 8.8.8.8
search default.svc.cluster.local svc.cluster.local cluster.local patrikdufresne.com
root@tymara:/home/ikus060# nslookup dl-cdn.alpinelinux.org
Server:		8.8.8.8
Address:	8.8.8.8#53

Non-authoritative answer:
dl-cdn.alpinelinux.org	canonical name = global.prod.fastly.net.
Name:	global.prod.fastly.net
Address: 151.101.0.249
Name:	global.prod.fastly.net
Address: 151.101.64.249
Name:	global.prod.fastly.net
Address: 151.101.128.249
Name:	global.prod.fastly.net
Address: 151.101.192.249

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.