Openshift/Kubernates kube dns best practise (ndots = 5)

user_1321050 0
Viewed 1128

I have been using Openshift/Kubernates for some time and this has been the understanding. For service to service communication

  • use DNS name of ${service-name} if they are under the same namespace
  • use DNS name of ${service-name}.${namespace}.svc.cluster.local if they are from different namespaces (network is joined)

Recently i was introduced with the topic of "we should add a dot after the svc.cluster.local to make it FQDN, for better DNS lookup speed". Done some testing and indeed with lookup is much faster with the dot. (~100ms without dot, 10ms with dot)

After some research, it was caused by the default dns setting from the kubernates

sh-4.2$ cat /etc/resolv.conf
search ${namespace}.svc.cluster.local svc.cluster.local cluster.local
nameserver X.X.X.X
options ndots:5

the ndots = 5 will perform a local search (sequential) if the dns name does not contain 5 dots. In the case of ${service-name}.${namespace}.svc.cluster.local, the local search will be as such

  1. ${service-name}.${namespace}.svc.cluster.local + ${namespace}.svc.cluster.local // FAILED LOOKUP
  2. ${service-name}.${namespace}.svc.cluster.local + svc.cluster.local // FAILED LOOKUP
  3. ${service-name}.${namespace}.svc.cluster.local + cluster.local // FAILED LOOKUP
  4. ${service-name}.${namespace}.svc.cluster.local // SUCCESS LOOKUP

And for ${service-name}.${namespace}.svc.cluster.local., the local search will be as such

  1. ${service-name}.${namespace}.svc.cluster.local // SUCCESS LOOKUP

References

  1. link
  2. how to debug

Questions:

  1. Since the ndots = 5 is the default setting for kubernetes, why ${service-name}.${namespace}.svc.cluster.local. is not documented on the official side ?
  2. Should we change all service call to ${service-name}.${namespace}.svc.cluster.local. ? any potential downsides ?
kube-dns openshift kubernetes dns networking
2 Answers

Since the ndots = 5 is the default setting for kubernetes, why ${service-name}.${namespace}.svc.cluster.local. is not documented on the official side ?

Well, it's a really good question. I searched through the official docs and it looks like this is not a documented feature. For this reason much better place for posting your doubts and also request for documentation improvement is the official GitHub site of Kubernetes DNS.

Should we change all service call to ${service-name}.${namespace}.svc.cluster.local. ? any potential downsides ?

If it works well for you and definitely increases the performance, I would say - Why not ? I can't see any potential downsides here. By adding the last dot you're simply omitting those first 3 lookups that are doomed to failure anyway if you use Service domain name in a form of ${service-name}.${namespace}.svc.cluster.local

Inferring from lookup process you described and your tests, I guess if you use only ${service-name} (of course only within the same namespace), dns lookup should be also much faster and closer to those 10ms you observed when using ${namespace}.svc.cluster.local svc.cluster.local cluster.local. as then it is matched in the very first iteration.

user_117141140

Based on the latest document here, it states that that we should use ${service}.${namespace} to call a service from different namespace and expect to resolve on the second attempt

user_13210500
Related