Internal DNS #719
-
|
Hello! I did run the task ansible:nuke and I did follow each steps from the readme of the v4.0.1 template. First, DNS wasn't correctly setuped on cloudlfare. My second issue is non related to the migration, but each internal dns request like the kubernetes dashboard or hajimari doesn't work/ are not resolved. My router have one dns server, which is metallb gateway IP that I put on my .config.env. Any help on this would be appreciated! |
Beta Was this translation helpful? Give feedback.
Replies: 5 comments 24 replies
-
Yes part of the migration to cloudflared would be to remove the ipv4 references from your records and any TXT records as well. But since this CNAME changed to
This implementation uses external-dns to populate DNS records that points to your cfargotunnel address. So yes, there does need to be DNS records for cloudflared to work.
I would rather keep that here in the discussions so people are chime in with their thoughts. 😄
I might need a little more details here, internal DNS will not work OOTB and requires setup on another device that does DNS for your home network in order to work. However, you can test with your workstations host file. Since what people use for DNS at home varies, it's hard to describe exactly what you need to do as explained here. Edit: I just updated the README on clearer internal DNS things, hopefully it helps. |
Beta Was this translation helpful? Give feedback.
-
|
Thanks for taking the time to support and updating the readme! I did followed the README and setup a pi hole instance.
As you can see I can ping pi-hole, and my domain is redirected to the gateway lb address, Ping |
Beta Was this translation helpful? Give feedback.
-
|
So are you saying that |
Beta Was this translation helpful? Give feedback.
-
|
That's right. I also had issues where my ISP issued DNS Ipv6 server returned authoritative results over my pihole. |
Beta Was this translation helpful? Give feedback.
-
|
I did remove any authoritative upstream dns server like cloudflare on pi-hole and set the dns record just like you said and it worked! I also set the upstream dns server on pi-hole to my gateway address! Thank you so much to both of you! |
Beta Was this translation helpful? Give feedback.
-
|
It seems that just set |
Beta Was this translation helpful? Give feedback.
-
|
I wish there was a more streamlined way to do dns@home but everyone does things a bit differently here due to the vast majority of solutions |
Beta Was this translation helpful? Give feedback.
-
|
I use AdGuard Home and when I set DNS rewrite from |
Beta Was this translation helpful? Give feedback.
-
|
What happens when you run: If that returns the address of |
Beta Was this translation helpful? Give feedback.
-
|
that is the second dig output in my comment above. it correctly returns the IP of Not sure which option to set AdGuard Home to. Here's the options: 
I'm using the first one: pointing it to |
Beta Was this translation helpful? Give feedback.
-
|
I don't think that is where you want to set that, see here. e.g. 
|
Beta Was this translation helpful? Give feedback.
-
|
ah! was coming here to say that I found out that this is the right place to configure it. setting it this way works perfectly. thank you! I used to use the DNS rewrite option for my compose apps running behind nginx-proxy-manager. |
Beta Was this translation helpful? Give feedback.
-
|
I have a similar set up to one of the previous commenters (AdGuard Home, and I have my upstream config set up for conditional forwarding), but I'm having a different problem. I was trying to use Jellyfin, which is "external", but because clients on my network are using AdGuard Home so they're forwarding all requests to EDIT: Something is screwy with my k8s-gateway deployment, because it's saying |
Beta Was this translation helpful? Give feedback.
-
|
No dice. WTF? Here's part of the output when I describe the hemlrelease: EDIT: I should probably add that I've tried nuking and installing my cluster several times... |
Beta Was this translation helpful? Give feedback.
-
|
Not related but be careful with that since you might get rate limited by Let's Encrypt. As for the helm issue that is very strange, here is another related issue: fluxcd/flux2#3974 |
Beta Was this translation helpful? Give feedback.
-
|
Hadn't thought of that. Good point. Yeah...at this point, it's clearly not a DNS issue (which I find very hard to believe, because it's ALWAYS DNS), so you can probably safely just ignore this. |
Beta Was this translation helpful? Give feedback.
-
|
FWIW I just pushed a commit that will use the staging certificate by default |
Beta Was this translation helpful? Give feedback.
-
|
OK...so I ended up having to reboot my machine because I was dumb. When it came back up, I see this when I look at all the pods I have running: What's weird (IMO) is that |
Beta Was this translation helpful? Give feedback.
-
|
Hey 🙂, I'm relatively new to the world of Kubernetes, flux, and related services. While I'm well-versed in Docker and have already set up a cloudflare and reverse proxy with public services with Docker containers, networking isn't something I deal with regularly. So, configuring things like DNS setup only comes up when necessary and my Pihole and DoH configuration was some time ago. Unfortunately, when it comes to the Kubernetes setup / internal DNS and troubleshooting where requests are getting stuck, I find it quite challenging to keep track. Current SituationLet me outline my current situation and configuration: Current Configuration:RouterMy Router has Bind9Bind9 is configured like this: named.confacl internal {
192.168.0.0/24; //internal Clients
172.19.0.0/24; //some random range which seems to come up by my router for push notifications or something like this
127.0.0.1;
};
options {
forwarders {
${PIHOLE_IP};
};
recursion yes; //necessary?
allow-query { internal; };
};
zone "${SECRET_DOMAIN}" IN {
type master;
file "/etc/bind/${SECRET_DOMAIN}.zone";
};So that it has a zone for ${SECRET_DOMAIN} configured and forwards requests for that zone as I configured in the ${SECRET_DOMAIN}.zone file. Other requests (external) will be forwarded to the PiHole to handle external DNS and blocking/filtering of unwanted requests. My Zone configuration looks like this (with example entry for Grafana): ${SECRET_DOMAIN}.zone$TTL 2d
$ORIGIN ${SECRET_DOMAIN}.
@ IN SOA ns.${SECRET_DOMAIN}. mail.${SECRET_DOMAIN} (
2023063000 ;serial
12h ;refresh
15m ;retry
3w ;expiry
2h ;minimum-ttl
)
@ IN NS ns.${SECRET_DOMAIN}.
ns IN A ${BIND9_IP}
ingress IN A ${BOOTSTRAP_METALLB_K8S_GATEWAY_ADDR}
grafana IN CNAME ingress.${SECRET_DOMAIN}.I also tried PiHoleMy PiHole Configuration looks like this: Currently, I don't have activated this setting from the Readme: # /etc/dnsmasq.d/99-k8s-gateway-forward.conf
server=/${SECRET_DOMAIN}/${METALLB_K8S_GATEWAY_ADDR}as I want Bind9 to rewrite my domain requests. Expected DNS ResolvingMy DNS-Chain I would like to achieve (or what I thought would make sense) is: For external requests like e.g., google.com: I have noticed that something like Conditional Forwarding in Pi-Hole causes issues, so I deactivated this option (was activated before for custom router domain). When I check the DNS lookup from my client: nslookup$ nslookup grafana.${SECRET_DOMAIN} ${BIND9_IP}
Server: ${BIND9_IP}
Address: ${BIND9_IP}#53
grafana.${SECRET_DOMAIN} canonical name = ingress.${SECRET_DOMAIN}.
Name: ingress.${SECRET_DOMAIN}
Address: ${BOOTSTRAP_METALLB_K8S_GATEWAY_ADDR}This looks good to me so far (I think). When opening this address in a browser from an internal client, it does not resolve. Questions:
I have tried a lot of solutions the last days so I don't know what mistake i made that is does not work right now. Update (Jul 2): Without using Bind9, so just |
Beta Was this translation helpful? Give feedback.
-
|
Looks like you made some progress but I wanted to answer your questions.
You need to choose which DNS server you want to use to serve records for your cluster, external-dns has support for pihole (and also bind9) if you choose to drop support for I don't see why you need bind9 and pihole, you could drop bind9 and go all in on pihole + external-dns which might make things easier for you.
I used to have all DNS for my network ing kubernetes but it didn't pass the WAF as if my cluster goes offline my family cannot reach the internet. I would advise against doing it and instead keep using pihole or bind9 on a external device. |
Beta Was this translation helpful? Give feedback.
-
|
Thanks for your answers! I really appreciate it! I think I'll give it a try to drop k8s_gateway as well and use external-dns like you did (but for pihole instead). Again, thank you for your useful information and I'll give it a try and provide an update if I've done the changes 🙂 |
Beta Was this translation helpful? Give feedback.
It seems that just set
BOOTSTRAP_METALLB_K8S_GATEWAY_ADDRas the only upstream DNS on Pi-hole does the job, without any local dns entry