Use ClusterFirst DNS instead of hardcoded public resolvers for secure-by-default#449
Use ClusterFirst DNS instead of hardcoded public resolvers for secure-by-default#449noeljackson wants to merge 1 commit intokubernetes-sigs:mainfrom
Conversation
The secure-by-default DNS policy set DNSNone + 8.8.8.8/1.1.1.1 for sandboxes without an explicit dnsPolicy. This breaks any sidecar or init container that needs to resolve cluster-internal names (e.g. service discovery via *.svc.cluster.local). Switch to ClusterFirst, which still prevents external DNS enumeration via the cluster's CoreDNS policy while allowing pods to resolve cluster services -- needed for health checks, sidecars, and any multi-container pod pattern.
✅ Deploy Preview for agent-sandbox canceled.
|
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: noeljackson The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
k8s-ci-robot
added
cncf-cla: yes
|
Hi @noeljackson. Thanks for your PR. I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with Regular contributors should join the org to skip this step. Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
k8s-ci-robot
added
the
size/M
|
/ok-to-test |
k8s-ci-robot
added
ok-to-test
3 participants
Summary
The secure-by-default DNS policy currently sets
DNSNonewith hardcoded8.8.8.8and1.1.1.1nameservers when a sandbox template doesn't specify an explicitdnsPolicy. This completely breaks cluster-internal DNS resolution, which means any sidecar container that needs to discover cluster services (health checks, coordinators, etc.) can't resolve*.svc.cluster.localnames at all.This switches the default to
ClusterFirst, which is what Kubernetes uses by default for pods anyway. It still prevents DNS enumeration of external services through the cluster's CoreDNS policy and network policy egress rules, but lets pods resolve the cluster services they actually need. TheDNSNone+ public resolver approach was too aggressive for any multi-container pod pattern where a sidecar needs to talk to other cluster services.What changed:
sandboxclaim_controller.go: default DNS policy is nowClusterFirstinstead ofDNSNonewith hardcoded nameserverssandboxwarmpool_controller.go: same change for warm pool sandboxessandboxclaim_controller_test.go: updated test expectations to matchThe behavior when users explicitly set a
dnsPolicyin their template is unchanged. This only affects the fallback when no policy is specified.Test plan
go test ./extensions/controllers/...passesresolv.confin sandbox pods shows cluster DNS (nameserver 10.43.0.10or equivalent)