[EKS] [request]: Nodelocal DNS Cache

**Tell us about your request** I would like an officially documented and supported method for installing the Kubernetes Node Local DNS Cache Addon. **Which service(s) is this request for?** EKS **Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard?** Kubernetes clusters with a high request rate often experience high rates of failed DNS lookups. For example this affects us when using the AWS SDKs particularly with Alpine / musl-libc containers. The _Nodelocal DNS Cache_ aims to resolve this (together with kernel patches in 5.1 to fix a conntrack race condition). [Nodelocal DNS Addon](https://github.com/kubernetes/kubernetes/tree/master/cluster/addons/dns/nodelocaldns) Kubeadm is aiming to support Nodelocal-dns-cache in 1.15. [k/k #70707](https://github.com/kubernetes/kubernetes/issues/70707) **Are you currently working around this issue?** Retrying requests at the application level which fail due to DNS errors. **Additional context** Kubernetes DNS Issues include: - Linux Kernel bug in netfilter conntrack (fixed in kernel 5.1) [1][2] - Exacerbated by musl-libc behaviour of issuing parallel queries, which is widely used in Alpine Docker containers. musl-libc does not respect the resolv.conf `single-request` option and it appears this will not be changed [2][3] - The AWS EC2 limit of 1024 Packets Per Second Per ENI [5] **Attachments** [0] https://docs.aws.amazon.com/AWSJavaScriptSDK/latest/AWS/Config.html#retryDelayOptions-pro

Posted by BrianChristie on May 22, 2019, 4:51 PM

Tags

• reliability (Network)

Related issues

• I can't recall who said it, but "The biggest problem with golden ages is that you never realize you're in one until it's over".
• [BUG] No response from API error when Advisor is triggered
• I thought the general premise is that humans can't form social groups bigger than around ~200.
• great, now can we convince the rest of the internet to start adding AAAA records and ipv6 endpoints for things.
• > It's only with the emergence of whiny, persnickety Unix devs who refused to leave the comforting embrace of their editor of choice that...
• Contrary to some other comments: no, IPV6 hasn't taken over the world at all.