98 lines
3.7 KiB
YAML
98 lines
3.7 KiB
YAML
# Route internal AD-zone lookups straight to the Samba DC instead of the LAN
|
|
# router, for every pod in the cluster.
|
|
#
|
|
# WHY: k3s CoreDNS forwards to the node's /etc/resolv.conf, which lists the
|
|
# router (192.168.10.1) — and that resolver flaps. When it hangs, CoreDNS's
|
|
# forward plugin blocks and even CLUSTER-INTERNAL lookups
|
|
# (*.svc.cluster.local) start timing out, which is how Authelia ended up in
|
|
# CrashLoopBackOff: its startup check resolves both dc1.ad.ddupan.top and
|
|
# smtp-relay.smtp-relay.svc.cluster.local, and a strict startup check turns a
|
|
# transient DNS blip into a restart loop.
|
|
#
|
|
# dc1 is AUTHORITATIVE for ad.ddupan.top, so sending that zone directly to it
|
|
# removes the router from the path entirely — no forwarding, no upstream
|
|
# dependency, no flap.
|
|
#
|
|
# k3s picks this up via `import /etc/coredns/custom/*.server` in its Corefile.
|
|
# The `reload` plugin applies it without restarting CoreDNS.
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: coredns-custom
|
|
namespace: kube-system
|
|
data:
|
|
ad-ddupan-top.server: |
|
|
ad.ddupan.top:53 {
|
|
errors
|
|
cache 30
|
|
forward . 192.168.10.5 {
|
|
policy sequential
|
|
}
|
|
}
|
|
# ── stop search-domain permutations from hanging on the router ──────────
|
|
# Pods get `options ndots:5` plus the NODE's search list, which still carries
|
|
# `lab.ddupan.top` (the RETIRED domain) and tailscale's MagicDNS suffix. A name
|
|
# like dc1.ad.ddupan.top has only 3 dots, so glibc tries EVERY suffix first:
|
|
# dc1.ad.ddupan.top.tail7e769.ts.net
|
|
# dc1.ad.ddupan.top.lab.ddupan.top
|
|
# Both are forwarded upstream to the flaky router and time out, so the client
|
|
# gives up before the bare name is ever tried. That is what put Authelia in
|
|
# CrashLoopBackOff -- and it hit the cluster-internal smtp-relay name too
|
|
# (4 dots < ndots:5).
|
|
#
|
|
# Answer these locally with an instant NXDOMAIN. Neither zone should ever
|
|
# resolve from inside the cluster.
|
|
dead-search-domains.server: |
|
|
lab.ddupan.top:53 {
|
|
errors
|
|
template ANY ANY {
|
|
rcode NXDOMAIN
|
|
}
|
|
}
|
|
tail7e769.ts.net:53 {
|
|
errors
|
|
template ANY ANY {
|
|
rcode NXDOMAIN
|
|
}
|
|
}
|
|
# Split-horizon blocks are generated from ../../infrastructure/dns/records.yml.
|
|
# They keep pod traffic on the LAN while preserving public hostnames and LE certs.
|
|
# BEGIN GENERATED: homelab DNS (coredns)
|
|
git-ddupan-top.server: |
|
|
git.ddupan.top:53 {
|
|
errors
|
|
template IN A {
|
|
answer "{{ .Name }} 60 IN A 192.168.10.127"
|
|
}
|
|
template IN AAAA {
|
|
rcode NOERROR
|
|
}
|
|
}
|
|
auth-ddupan-top.server: |
|
|
auth.ddupan.top:53 {
|
|
errors
|
|
template IN A {
|
|
answer "{{ .Name }} 60 IN A 192.168.10.127"
|
|
}
|
|
template IN AAAA {
|
|
rcode NOERROR
|
|
}
|
|
}
|
|
# END GENERATED: homelab DNS (coredns)
|
|
---
|
|
# NOTE: `serve_stale` could NOT be added here.
|
|
#
|
|
# The cache plugin already exists in k3s's own Corefile (`cache 30`), and CoreDNS
|
|
# rejects a duplicate plugin in the same server block — so the *.override import
|
|
# cannot carry it. It was applied by patching the `coredns` ConfigMap directly;
|
|
# the intended Corefile is kept alongside as `Corefile.desired`.
|
|
#
|
|
# ⚠️ A k3s restart/upgrade re-applies its bundled manifest and will REVERT that
|
|
# patch. Re-apply from Corefile.desired if external name resolution starts
|
|
# failing hard during WAN outages again.
|
|
#
|
|
# WHY: the ISP drops the WAN at random and it cannot be changed. serve_stale
|
|
# keeps answering with expired entries while the upstream is unreachable, so
|
|
# previously-resolved external names (smtp.office365.com, package mirrors) keep
|
|
# working through a blip instead of hanging.
|