Understand in-cluster DNS (CoreDNS)
CoreDNS is the DNS server every pod uses. It runs as a Deployment in kube-system, behind the kube-dns Service, answering in-cluster names and forwarding everything else. Syself Autopilot manages and scales it for you: you do not edit its configuration or set its replica count. Understanding how it behaves still helps you write names that resolve and diagnose failures quickly. For the tool itself, see the CoreDNS docs.
How a name resolves#
CoreDNS answers two kinds of in-cluster names:
- Service names.
my-svc.my-namespace.svc.cluster.localresolves to the Service's cluster IP.cluster.localis the cluster's DNS suffix, set byserviceDomainwhen the cluster is created. The full naming scheme is in the Kubernetes DNS for Services and Pods reference. - Pod-backed names. A headless Service (
clusterIP: None) resolves to the individual pod IPs behind it, which is how StatefulSets get stable per-pod names.
Anything CoreDNS does not own, such as a public domain, it forwards to the node's upstream resolver. That upstream is the one component you control: the dnsServers cluster variable sets it (it becomes the node's resolv.conf, which CoreDNS inherits). Point it at a resolver that also serves your private zones when pods must reach internal names. See Set up private and split DNS .
How ndots affects lookups#
A pod's /etc/resolv.conf sets ndots: 5. A name with fewer than five dots is first tried with each cluster search domain appended, before it is tried as written. Looking up a short external name such as redis therefore sends several failing queries (redis.<namespace>.svc.cluster.local, and so on) before the correct one. There are two fixes, both applied on the pod side, which you control:
- Use a fully qualified name with a trailing dot (
api.example.com.) to skip the search list. - Set a lower
ndotsin the pod'sdnsConfig for a high-volume workload.
How Syself scales CoreDNS#
CoreDNS sits on the path of nearly every connection, so its replica count must grow with the cluster. Syself Autopilot runs the cluster-proportional-autoscaler against the CoreDNS Deployment and sizes it from the cluster's node and core counts:
| Setting | Value | Effect |
|---|---|---|
nodesPerReplica | 8 | one CoreDNS replica for every 8 nodes |
coresPerReplica | 256 | one replica for every 256 vCPUs across the cluster |
preventSinglePointFailure | true | at least 2 replicas once the cluster has more than one node |
The autoscaler takes the higher of the node-based and core-based counts, so CoreDNS scales up as you add nodes and back down as you remove them. You do not set a replica count, and you do not edit the Corefile. Both are reconciled by the platform, and a manual change is overwritten on the next reconciliation.
Note
Because CoreDNS is managed, per-zone techniques that require a Corefile edit, such as a stub-domain forward block for one internal zone, are not available. To send private names to a private resolver, set the cluster's upstream with dnsServers, which routes every non-cluster name there. See Set up private and split DNS .