Monday, 21 September 2020

Debugging Kubernetes DNS

This is totally cribbed from here -> Debugging DNS Resolution


 Create dnsutils.yaml file

cat << EOF > ~/dnsutils.yaml
apiVersion: v1
kind: Pod
metadata:
  name: dnsutils
  namespace: default
spec:
  containers:
  - name: dnsutils
    image: gcr.io/kubernetes-e2e-test-images/dnsutils:1.3
    command:
      - sleep
      - "3600"
    imagePullPolicy: IfNotPresent
  restartPolicy: Always
EOF

Validate YAML


cat ~/dnsutils.yaml

apiVersion: v1
kind: Pod
metadata:
  name: dnsutils
  namespace: default
spec:
  containers:
  - name: dnsutils
    image: gcr.io/kubernetes-e2e-test-images/dnsutils:1.3
    command:
      - sleep
      - "3600"
    imagePullPolicy: IfNotPresent
  restartPolicy: Always


Apply to cluster


kubectl apply -f ~/dnsutils.yaml


pod/dnsutils created


Check running pods


kubectl get pods


NAME                                  READY   STATUS      RESTARTS   AGE

dnsutils                              1/1     Running     0          47s


Use dnsutils to lookup default K8s servicename


kubectl exec -ti dnsutils -- nslookup kubernetes.default


Server: 10.96.0.10

Address: 10.96.0.10#53


Name: kubernetes.default.svc.cluster.local

Address: 10.96.0.1


Use dnsutils to inspect /etc/resolv.conf


kubectl exec -ti dnsutils -- cat /etc/resolv.conf


nameserver 10.96.0.10

search default.svc.cluster.local svc.cluster.local cluster.local

options ndots:5


Use dnsutils to get help for the ping command


kubectl exec -ti dnsutils -- ping --help


BusyBox v1.26.2 (2018-05-30 13:53:45 GMT) multi-call binary.


Usage: ping [OPTIONS] HOST


Send ICMP ECHO_REQUEST packets to network hosts


-4,-6 Force IP or IPv6 name resolution

-c CNT Send only CNT pings

-s SIZE Send SIZE data bytes in packets (default:56)

-t TTL Set TTL

-I IFACE/IP Use interface or IP address as source

-W SEC Seconds to wait for the first response (default:10)

(after all -c CNT packets are sent)

-w SEC Seconds until ping exits (default:infinite)

(can exit earlier with -c CNT)

-q Quiet, only display output at start

and when finished

-p Pattern to use for payload


Use dnsutils to ping google.com


kubectl exec -ti dnsutils -- ping www.google.com


PING www.google.com (172.217.2.100): 56 data bytes

64 bytes from 172.217.2.100: seq=0 ttl=114 time=1.216 ms

64 bytes from 172.217.2.100: seq=1 ttl=114 time=1.328 ms

64 bytes from 172.217.2.100: seq=2 ttl=114 time=1.344 ms

64 bytes from 172.217.2.100: seq=3 ttl=114 time=1.278 ms

64 bytes from 172.217.2.100: seq=4 ttl=114 time=1.483 ms

64 bytes from 172.217.2.100: seq=5 ttl=114 time=1.393 ms

64 bytes from 172.217.2.100: seq=6 ttl=114 time=1.227 ms

64 bytes from 172.217.2.100: seq=7 ttl=114 time=1.343 ms

^C

--- www.google.com ping statistics ---

8 packets transmitted, 8 packets received, 0% packet loss

round-trip min/avg/max = 1.216/1.326/1.483 ms


Use dnsutils to send only 5 pings to google.com


kubectl exec -ti dnsutils -- ping -c 5 www.google.com


PING www.google.com (172.217.2.100): 56 data bytes

64 bytes from 172.217.2.100: seq=0 ttl=114 time=1.382 ms

64 bytes from 172.217.2.100: seq=1 ttl=114 time=1.480 ms

64 bytes from 172.217.2.100: seq=2 ttl=114 time=1.414 ms

64 bytes from 172.217.2.100: seq=3 ttl=114 time=1.326 ms

64 bytes from 172.217.2.100: seq=4 ttl=114 time=1.276 ms


--- www.google.com ping statistics ---

5 packets transmitted, 5 packets received, 0% packet loss

round-trip min/avg/max = 1.276/1.375/1.480 ms


Use dnsutils to ping google.com with a 5-second Time To Live (TTL)


kubectl exec -ti dnsutils -- ping -t 5 www.google.com


PING www.google.com (172.217.2.100): 56 data bytes

^C

--- www.google.com ping statistics ---

276 packets transmitted, 0 packets received, 100% packet loss


Use dnsutils to ping google.com with a 5 second wait


kubectl exec -ti dnsutils -- ping -w 5 www.google.com


PING www.google.com (172.217.2.100): 56 data bytes

64 bytes from 172.217.2.100: seq=0 ttl=114 time=1.153 ms

64 bytes from 172.217.2.100: seq=1 ttl=114 time=1.660 ms

64 bytes from 172.217.2.100: seq=2 ttl=114 time=1.312 ms

64 bytes from 172.217.2.100: seq=3 ttl=114 time=1.144 ms

64 bytes from 172.217.2.100: seq=4 ttl=114 time=1.289 ms


--- www.google.com ping statistics ---

5 packets transmitted, 5 packets received, 0% packet loss

round-trip min/avg/max = 1.144/1.311/1.660 ms


Delete pod

delete pod dnsutils

pod "dnsutils" deleted


No comments:

Yay, VMware Fusion and macOS Big Sur - no longer "NAT good friends" - forgive the double negative and the terrible pun ...

After macOS 11 Big Sur was released in 2020, VMware updated their Fusion product to v12 and, sadly, managed to break Network Address Trans...