25Lock down a namespace so pods can talk only to their own dependencies. Why does DNS break first, and how do you get it right?▼hardRed HatGoldman SachsDatabricks○ sign inDefault-deny egress breaks name resolution before it breaks anything else, and every connection times out confusingly. The practitioners are the ones who test with positive AND negative probes and know their CNI's fine print.Open full answer →
59With tens of thousands of services, DNS lookups start timing out for five seconds at a stretch. Diagnose and fix Kubernetes DNS at scale.▼hard★ EssentialCloudflareUberLinkedIn◆ premiumThe classic five-second stall is rarely CoreDNS being slow; it is UDP, conntrack races and ndots expansion. The diagnosis ladder and the NodeLocal DNSCache fix separate operators from readers of architecture blogs.Open full answer →
08Requests inside the cluster fail with DNS errors, but only sometimes. Diagnose it.▼hardUberCloudflareShopify2 notes & commentsunlockedIntermittent DNS is the most-reported and least-understood Kubernetes failure. There are three well-known causes and each leaves a different fingerprint.Open full answer →
64Every outbound call from the cluster carries an extra 20ms and DNS query volume is five times what it should be. Why?▼mediumGoogleCloudflareUber◆ premiumThe pod's resolver is configured to try five search domains before the real one. An uncached external hostname can trigger several search-expanded queries before its absolute lookup, and the failures are what you are paying for.Open full answer →
