--- apiVersion: apps/v1 items: - apiVersion: apps/v1 kind: DaemonSet metadata: annotations: deprecated.daemonset.template.generation: "1" creationTimestamp: "2025-10-11T10:28:48Z" generation: 1 labels: dns.operator.openshift.io/owning-dns: default managedFields: - apiVersion: apps/v1 fieldsType: FieldsV1 fieldsV1: f:metadata: f:annotations: .: {} f:deprecated.daemonset.template.generation: {} f:labels: .: {} f:dns.operator.openshift.io/owning-dns: {} f:ownerReferences: .: {} k:{"uid":"b5540444-b7a1-4eff-88fb-49b234be383b"}: {} f:spec: f:minReadySeconds: {} f:revisionHistoryLimit: {} f:selector: {} f:template: f:metadata: f:annotations: .: {} f:cluster-autoscaler.kubernetes.io/enable-ds-eviction: {} f:target.workload.openshift.io/management: {} f:labels: .: {} f:dns.operator.openshift.io/daemonset-dns: {} f:spec: f:containers: k:{"name":"dns"}: .: {} f:args: {} f:command: {} f:image: {} f:imagePullPolicy: {} f:livenessProbe: .: {} f:failureThreshold: {} f:httpGet: .: {} f:path: {} f:port: {} f:scheme: {} f:initialDelaySeconds: {} f:periodSeconds: {} f:successThreshold: {} f:timeoutSeconds: {} f:name: {} f:ports: .: {} k:{"containerPort":5353,"protocol":"TCP"}: .: {} f:containerPort: {} f:name: {} f:protocol: {} k:{"containerPort":5353,"protocol":"UDP"}: .: {} f:containerPort: {} f:name: {} f:protocol: {} f:readinessProbe: .: {} f:failureThreshold: {} f:httpGet: .: {} f:path: {} f:port: {} f:scheme: {} f:initialDelaySeconds: {} f:periodSeconds: {} f:successThreshold: {} f:timeoutSeconds: {} f:resources: .: {} f:requests: .: {} f:cpu: {} f:memory: {} f:terminationMessagePath: {} f:terminationMessagePolicy: {} f:volumeMounts: .: {} k:{"mountPath":"/etc/coredns"}: .: {} f:mountPath: {} f:name: {} f:readOnly: {} k:{"name":"kube-rbac-proxy"}: .: {} f:args: {} f:image: {} f:imagePullPolicy: {} f:name: {} f:ports: .: {} k:{"containerPort":9154,"protocol":"TCP"}: .: {} f:containerPort: {} f:name: {} f:protocol: {} f:resources: .: {} f:requests: .: {} f:cpu: {} f:memory: {} f:terminationMessagePath: {} f:terminationMessagePolicy: {} f:volumeMounts: .: {} k:{"mountPath":"/etc/tls/private"}: .: {} f:mountPath: {} f:name: {} f:readOnly: {} f:dnsPolicy: {} f:nodeSelector: {} f:priorityClassName: {} f:restartPolicy: {} f:schedulerName: {} f:securityContext: {} f:serviceAccount: {} f:serviceAccountName: {} f:terminationGracePeriodSeconds: {} f:tolerations: {} f:volumes: .: {} k:{"name":"config-volume"}: .: {} f:configMap: .: {} f:defaultMode: {} f:items: {} f:name: {} f:name: {} k:{"name":"metrics-tls"}: .: {} f:name: {} f:secret: .: {} f:defaultMode: {} f:secretName: {} f:updateStrategy: f:rollingUpdate: .: {} f:maxSurge: {} f:maxUnavailable: {} f:type: {} manager: dns-operator operation: Update time: "2025-10-11T10:28:48Z" - apiVersion: apps/v1 fieldsType: FieldsV1 fieldsV1: f:status: f:currentNumberScheduled: {} f:desiredNumberScheduled: {} f:numberAvailable: {} f:numberMisscheduled: {} f:numberReady: {} f:observedGeneration: {} f:updatedNumberScheduled: {} manager: kube-controller-manager operation: Update subresource: status time: "2025-10-11T10:40:17Z" name: dns-default namespace: openshift-dns ownerReferences: - apiVersion: operator.openshift.io/v1 controller: true kind: DNS name: default uid: b5540444-b7a1-4eff-88fb-49b234be383b resourceVersion: "21026" uid: a4513b6f-0cf5-4574-93d4-d8cecf42f79f spec: minReadySeconds: 9 revisionHistoryLimit: 10 selector: matchLabels: dns.operator.openshift.io/daemonset-dns: default template: metadata: annotations: cluster-autoscaler.kubernetes.io/enable-ds-eviction: "true" target.workload.openshift.io/management: '{"effect": "PreferredDuringScheduling"}' creationTimestamp: null labels: dns.operator.openshift.io/daemonset-dns: default spec: containers: - args: - -conf - /etc/coredns/Corefile command: - coredns image: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:def4bc41ba62687d8c9a68b6f74c39240f651ec7a039a78a6535233581f430a7 imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 5 httpGet: path: /health port: 8080 scheme: HTTP initialDelaySeconds: 60 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 5 name: dns ports: - containerPort: 5353 name: dns protocol: UDP - containerPort: 5353 name: dns-tcp protocol: TCP readinessProbe: failureThreshold: 3 httpGet: path: /ready port: 8181 scheme: HTTP initialDelaySeconds: 10 periodSeconds: 3 successThreshold: 1 timeoutSeconds: 3 resources: requests: cpu: 50m memory: 70Mi terminationMessagePath: /dev/termination-log terminationMessagePolicy: FallbackToLogsOnError volumeMounts: - mountPath: /etc/coredns name: config-volume readOnly: true - args: - --logtostderr - --secure-listen-address=:9154 - --tls-cipher-suites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_RSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 - --upstream=http://127.0.0.1:9153/ - --tls-cert-file=/etc/tls/private/tls.crt - --tls-private-key-file=/etc/tls/private/tls.key image: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:f22b65e5c744a32d3955dd7c36d809e3114a8aa501b44c00330dfda886c21169 imagePullPolicy: IfNotPresent name: kube-rbac-proxy ports: - containerPort: 9154 name: metrics protocol: TCP resources: requests: cpu: 10m memory: 40Mi terminationMessagePath: /dev/termination-log terminationMessagePolicy: FallbackToLogsOnError volumeMounts: - mountPath: /etc/tls/private name: metrics-tls readOnly: true dnsPolicy: Default nodeSelector: kubernetes.io/os: linux priorityClassName: system-node-critical restartPolicy: Always schedulerName: default-scheduler securityContext: {} serviceAccount: dns serviceAccountName: dns terminationGracePeriodSeconds: 30 tolerations: - key: node-role.kubernetes.io/master operator: Exists volumes: - configMap: defaultMode: 420 items: - key: Corefile path: Corefile name: dns-default name: config-volume - name: metrics-tls secret: defaultMode: 420 secretName: dns-default-metrics-tls updateStrategy: rollingUpdate: maxSurge: 10% maxUnavailable: 0 type: RollingUpdate status: currentNumberScheduled: 3 desiredNumberScheduled: 3 numberAvailable: 3 numberMisscheduled: 0 numberReady: 3 observedGeneration: 1 updatedNumberScheduled: 3 - apiVersion: apps/v1 kind: DaemonSet metadata: annotations: deprecated.daemonset.template.generation: "1" creationTimestamp: "2025-10-11T10:28:48Z" generation: 1 managedFields: - apiVersion: apps/v1 fieldsType: FieldsV1 fieldsV1: f:metadata: f:annotations: .: {} f:deprecated.daemonset.template.generation: {} f:ownerReferences: .: {} k:{"uid":"b5540444-b7a1-4eff-88fb-49b234be383b"}: {} f:spec: f:revisionHistoryLimit: {} f:selector: {} f:template: f:metadata: f:annotations: .: {} f:target.workload.openshift.io/management: {} f:labels: .: {} f:dns.operator.openshift.io/daemonset-node-resolver: {} f:spec: f:containers: k:{"name":"dns-node-resolver"}: .: {} f:command: {} f:env: .: {} k:{"name":"CLUSTER_DOMAIN"}: .: {} f:name: {} f:value: {} k:{"name":"NAMESERVER"}: .: {} f:name: {} f:value: {} k:{"name":"SERVICES"}: .: {} f:name: {} f:value: {} f:image: {} f:imagePullPolicy: {} f:name: {} f:resources: .: {} f:requests: .: {} f:cpu: {} f:memory: {} f:securityContext: .: {} f:privileged: {} f:terminationMessagePath: {} f:terminationMessagePolicy: {} f:volumeMounts: .: {} k:{"mountPath":"/etc/hosts"}: .: {} f:mountPath: {} f:name: {} f:dnsPolicy: {} f:hostNetwork: {} f:nodeSelector: {} f:priorityClassName: {} f:restartPolicy: {} f:schedulerName: {} f:securityContext: {} f:serviceAccount: {} f:serviceAccountName: {} f:terminationGracePeriodSeconds: {} f:tolerations: {} f:volumes: .: {} k:{"name":"hosts-file"}: .: {} f:hostPath: .: {} f:path: {} f:type: {} f:name: {} f:updateStrategy: f:rollingUpdate: .: {} f:maxSurge: {} f:maxUnavailable: {} f:type: {} manager: dns-operator operation: Update time: "2025-10-11T10:28:48Z" - apiVersion: apps/v1 fieldsType: FieldsV1 fieldsV1: f:status: f:currentNumberScheduled: {} f:desiredNumberScheduled: {} f:numberAvailable: {} f:numberReady: {} f:observedGeneration: {} f:updatedNumberScheduled: {} manager: kube-controller-manager operation: Update subresource: status time: "2025-10-11T10:39:24Z" name: node-resolver namespace: openshift-dns ownerReferences: - apiVersion: operator.openshift.io/v1 controller: true kind: DNS name: default uid: b5540444-b7a1-4eff-88fb-49b234be383b resourceVersion: "19760" uid: 9b9dff80-73fd-498e-a107-4d9232b3783b spec: revisionHistoryLimit: 10 selector: matchLabels: dns.operator.openshift.io/daemonset-node-resolver: "" template: metadata: annotations: target.workload.openshift.io/management: '{"effect": "PreferredDuringScheduling"}' creationTimestamp: null labels: dns.operator.openshift.io/daemonset-node-resolver: "" spec: containers: - command: - /bin/bash - -c - | #!/bin/bash set -uo pipefail trap 'jobs -p | xargs kill || true; wait; exit 0' TERM OPENSHIFT_MARKER="openshift-generated-node-resolver" HOSTS_FILE="/etc/hosts" TEMP_FILE="/etc/hosts.tmp" IFS=', ' read -r -a services <<< "${SERVICES}" # Make a temporary file with the old hosts file's attributes. if ! cp -f --attributes-only "${HOSTS_FILE}" "${TEMP_FILE}"; then echo "Failed to preserve hosts file. Exiting." exit 1 fi while true; do declare -A svc_ips for svc in "${services[@]}"; do # Fetch service IP from cluster dns if present. We make several tries # to do it: IPv4, IPv6, IPv4 over TCP and IPv6 over TCP. The two last ones # are for deployments with Kuryr on older OpenStack (OSP13) - those do not # support UDP loadbalancers and require reaching DNS through TCP. cmds=('dig -t A @"${NAMESERVER}" +short "${svc}.${CLUSTER_DOMAIN}"|grep -v "^;"' 'dig -t AAAA @"${NAMESERVER}" +short "${svc}.${CLUSTER_DOMAIN}"|grep -v "^;"' 'dig -t A +tcp +retry=0 @"${NAMESERVER}" +short "${svc}.${CLUSTER_DOMAIN}"|grep -v "^;"' 'dig -t AAAA +tcp +retry=0 @"${NAMESERVER}" +short "${svc}.${CLUSTER_DOMAIN}"|grep -v "^;"') for i in ${!cmds[*]} do ips=($(eval "${cmds[i]}")) if [[ "$?" -eq 0 && "${#ips[@]}" -ne 0 ]]; then svc_ips["${svc}"]="${ips[@]}" break fi done done # Update /etc/hosts only if we get valid service IPs # We will not update /etc/hosts when there is coredns service outage or api unavailability # Stale entries could exist in /etc/hosts if the service is deleted if [[ -n "${svc_ips[*]-}" ]]; then # Build a new hosts file from /etc/hosts with our custom entries filtered out if ! sed --silent "/# ${OPENSHIFT_MARKER}/d; w ${TEMP_FILE}" "${HOSTS_FILE}"; then # Only continue rebuilding the hosts entries if its original content is preserved sleep 60 & wait continue fi # Append resolver entries for services rc=0 for svc in "${!svc_ips[@]}"; do for ip in ${svc_ips[${svc}]}; do echo "${ip} ${svc} ${svc}.${CLUSTER_DOMAIN} # ${OPENSHIFT_MARKER}" >> "${TEMP_FILE}" || rc=$? done done if [[ $rc -ne 0 ]]; then sleep 60 & wait continue fi # TODO: Update /etc/hosts atomically to avoid any inconsistent behavior # Replace /etc/hosts with our modified version if needed cmp "${TEMP_FILE}" "${HOSTS_FILE}" || cp -f "${TEMP_FILE}" "${HOSTS_FILE}" # TEMP_FILE is not removed to avoid file create/delete and attributes copy churn fi sleep 60 & wait unset svc_ips done env: - name: SERVICES value: image-registry.openshift-image-registry.svc - name: NAMESERVER value: 172.30.0.10 - name: CLUSTER_DOMAIN value: cluster.local image: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:c1bf279b80440264700aa5e7b186b74a9ca45bd6a14638beb3ee5df0e610086a imagePullPolicy: IfNotPresent name: dns-node-resolver resources: requests: cpu: 5m memory: 21Mi securityContext: privileged: true terminationMessagePath: /dev/termination-log terminationMessagePolicy: FallbackToLogsOnError volumeMounts: - mountPath: /etc/hosts name: hosts-file dnsPolicy: ClusterFirst hostNetwork: true nodeSelector: kubernetes.io/os: linux priorityClassName: system-node-critical restartPolicy: Always schedulerName: default-scheduler securityContext: {} serviceAccount: node-resolver serviceAccountName: node-resolver terminationGracePeriodSeconds: 30 tolerations: - operator: Exists volumes: - hostPath: path: /etc/hosts type: File name: hosts-file updateStrategy: rollingUpdate: maxSurge: 0 maxUnavailable: 33% type: RollingUpdate status: currentNumberScheduled: 3 desiredNumberScheduled: 3 numberAvailable: 3 numberMisscheduled: 0 numberReady: 3 observedGeneration: 1 updatedNumberScheduled: 3 kind: DaemonSetList metadata: resourceVersion: "64399"