Skip to main content

Set up private and split DNS

Inspect 1.36

Some names should resolve only inside the cluster or over a private link, never on the public internet. On Syself Autopilot, CoreDNS is managed by the platform, so you shape private resolution with the cluster's upstream resolver and with internal-only Services, rather than by editing CoreDNS.

Resolve private names through the cluster's upstream#

CoreDNS answers cluster names itself and forwards everything else to the node's upstream resolver. That upstream is the dnsServers cluster variable. Point it at a resolver that serves your private zones, such as an on-prem DNS server reached over your , and pods resolve those names while it forwards public queries onward.

cluster.yamlyaml
		spec:
  topology:
    variables:
      - name: dnsServers
        value: ["10.100.0.53"]

This is cluster-wide, not per-zone. Every non-cluster lookup goes to that resolver, so it must answer your private zones and forward all other queries to the internet. Managed CoreDNS provides no per-zone stub-forward that you can add, so a single resolver that knows both your private names and the public internet is how you split the two views.

Internal-only Services#

A Service without type: LoadBalancer is already private. A ClusterIP Service is reachable only inside the cluster, and a headless Service (clusterIP: None) resolves to the pod IPs behind it for stable per-pod names. Neither has a public address, so nothing here exposes them. Use them for any service that other pods must reach but the internet should not.

The API endpoint must resolve publicly#

The cluster's API endpoint name is where split DNS matters most. That name must resolve to the control-plane load balancer from Syself's side, not only from your own machine, because the controllers that manage your cluster connect through the same name.

Warning

Never give the API endpoint a name that only you can resolve, an /etc/hosts entry, or a split-horizon view that answers differently inside your own network. If the name does not resolve to the load balancer from the management side, the cluster never finishes provisioning and the control plane remains unavailable. Publish real, public A and AAAA records for the endpoint name. See for the endpoint DNS setup.

Restricting who may reach the API is a separate concern from resolving its name; that is the allowlist's responsibility, not DNS's. See .

Where to go next#

Rotate and renew certificates

How cert-manager renews certificates before they expire, and how to force, monitor, and recover a rotation.

Configure a Hetzner load balancer

Tune the control-plane load balancer with topology variables and per-Service load balancers with annotations, including the full annotation reference.