A kind cluster no longer copies the DNS search domains of the host into its nodes and pods (#271, #279). The new field spec.network.dnsSearch keeps the domains that a cluster needs. The change is in Go and in bash. Read Behaviour changes before you upgrade.

Behaviour changes

• The host DNS search domains stay out of kind clusters (#271). The kind config that lo renders now sets networking.dnsSearch: []. The nodes and pods of a new cluster get no search domain from the host. The search list of a pod holds only the cluster domains. Short host names no longer resolve on the nodes either: image pulls (containerd resolves a registry host on the node) and pods with hostNetwork: true. Use the full name, dnsConfig.searches for one pod, or spec.network.dnsSearch for the cluster (see Fixes). The field needs kind v0.18.0 or later.

Fixes

• The host DNS search domains stay out of kind nodes and pods (#271). Docker writes the /etc/resolv.conf of a kind node from the host and copies its search line, for example search home.example corp.example.net. kubelet then added these domains to the search list of every pod, after the cluster domains, with ndots:5. So a pod sent a query for each search domain before the real name. Resolvers with a fixed time budget (musl, hickory) then failed external names. For example, a static musl build of a CLI tool in a pod failed every request after 5 s.
  • The kind config now sets networking.dnsSearch: [] in both implementations. kind starts every node with an empty KIND_DNS_SEARCH. The node entrypoint then removes the search lines from /etc/resolv.conf on every boot, before kubelet starts. The nameserver stays the same.
  • The fix holds after a node restart, and it applies to every node of the cluster.
  • Opt-out: spec.network.dnsSearch. A cluster that must resolve short names of a company or home network lists the domains:

    spec:
      network:
        dnsSearch:
          - corp.example.com
          - home.example

    The list replaces the empty default, as written. Each entry is a DNS name: letters in any case, digits, hyphens and dots, and an optional trailing dot. A label has at most 63 characters, the name at most 253. The list takes at most 32 entries, the Kubernetes limit for the search list of a pod.
  • lo up and lo lint refuse a bad entry before lo creates anything. Each bad entry gets one error line that names the fix. The Lo CRD schema checks the field too.
  • lo lint --notes notes an explicit dnsSearch: [], which is the default.
  • In the bash implementation, each read of the list has a time limit of 10 s that needs no GNU timeout, so it holds on macOS too. It also has a memory limit of 1 GiB (ulimit -d) where the operating system enforces it. Only a spec that sets dnsSearch needs yq v4.47.1 or later.
  • In the bash implementation, lo::read_config and driver::export now stop at a failed read. Before, they printed the error and went on.
• The default render works under set -u on bash before 4.4 (#279). The bash render of the empty default list expanded an empty array without a guard. On bash 4.3 under set -u, that stopped every Lo provision without spec.network.dnsSearch. The render now uses the same guard as the reader.

Upgrade

• DNS search domains (#271). kind sets the search list when it creates the nodes. An existing cluster keeps the host search domains until you recreate it with lo down and lo up. Add spec.network.dnsSearch first when the cluster needs short names. Check that your kind is v0.18.0 or later (kind version).
• A project with its own bash tree in .lok8s/ (lo assets eject bash) runs lo assets update bash to get the bash twin of the change.

Known limitations

• kind v0.18.0 or later (#271). An older kind binary stops at kind create with an unknown-field error. A node image from before kind v0.18.0 ignores the field, and its nodes keep the host search domains. lo doctor does not check the kind version yet (#274).

Follow-up

• #274: lo doctor checks the minimum kind version (v0.18.0 for dnsSearch).
• #277: one helper for the bounded yq reads of the bash implementation.

Commits

• 8f771e5 fix(lo): keep the host's DNS search domains out of kind nodes and pods (#271)
• 3a628c1 fix(lo): guard the empty dnsSearch list under set -u on bash < 4.4 (#279)