How do I configure a conditional forwarder with CoreDNS in my Amazon EKS cluster?

Short description

Use CoreDNS to configure a conditional forwarder for DNS queries to the domains that a customized DNS server resolves. For more information, see Customizing DNS service on the Kubernetes website.

Important: Before you make configuration changes to the CoreDNS Amazon EKS add-on, determine the settings that Amazon EKS manages. When you modify a field that Amazon EKS manages, Amazon EKS can't manage the add-on. Amazon EKS could overwrite your changes when you update an add-on.

Resolution

The following resolution applies to CoreDNS self-managed and Amazon EKS add-on configurations.

Configure the self-managed add-on

To modify the CoreDNS ConfigMap and add the custom DNS conditional forwarder configuration, run the following command:

kubectl -n kube-system edit configmap coredns

Example output:

apiVersion: v1
kind: ConfigMap
metadata:
  annotations:
  labels:
    eks.amazonaws.com/component: coredns
    k8s-app: kube-dns
  name: coredns
  namespace: kube-system
data:
  Corefile: |
    .:53 {
        errors
        ready
        health
        kubernetes cluster.local in-addr.arpa ip6.arpa {
          pods insecure
          fallthrough in-addr.arpa ip6.arpa
        }
        prometheus :9153
        forward. /etc/resolv.conf
        cache 30
        loop
        reload
        loadbalance
    }
    domain-name:53 {
        errors
        cache 30
        forward. custom-dns-server
        reload
    }

Note: Replace domain-name with your domain name and custom-dns-server with your custom DNS server IP address.

Configure the Amazon EKS add-on

To make changes to the Amazon EKS managed CoreDNS add-on, complete the following steps:

1. Open the Amazon EKS console.

2. In the navigation pane, choose Clusters.

3. Choose the name of your cluster.

4. Choose the Add-ons tab.

5. Select the CoreDNS add-on, and then choose Edit.

6. On the edit page, expand the Optional configuration settings section.

7. In the Configuration values section, add the following custom DNS conditional forwarder configuration:

   corefile: |
       .:53 {
           errors
           ready
           health
           kubernetes cluster.local in-addr.arpa ip6.arpa {
             pods insecure
             fallthrough in-addr.arpa ip6.arpa
           }
           prometheus :9153
           forward. /etc/resolv.conf
           cache 30
           loop
           reload
           loadbalance
       }
       domain-name:53 {
           errors
           cache 30
           forward. custom-dns-server
           reload
       }

   Note: Replace domain-name with your domain name and custom-dns-server with your custom DNS server IP address.

8. Choose Save changes.

Verify the domain name resolution

To verify that domain name resolution works, run the following commands:

kubectl run busybox --restart=Never --image=busybox:1.28 -- sleep 3600
kubectl exec busybox -- nslookup domain-name

Note: Replace domain-name with your domain name.

Related information

How do I troubleshoot DNS failures with Amazon EKS?

How do I prevent configuration conflicts when I create or update my Amazon EKS managed add-ons?