Linux dd-ubuntu2204-us05cd017b02p-ef8c81.localdomain 5.15.0-25-generic
25-Ubuntu SMP Wed Mar 30 15:54:22 UTC 2022 x86_64 x86_64 x86_64 GNU/Linux
Cluster Configuration:
Single node running on a VirtualBox virtual machine based off of Ubuntu 22.04. The OS is fully patched. Some DISA STIG configuration changes have been made to the image, but I'm not sure which ones would cause this problem, if any.
Describe the bug:
Running pods cannot make DNS connections outside the cluster. CoreDNS logs show "no route to host" error.
Steps To Reproduce:
- Installed K3s:
nameserver 127.0.0.53 options edns0 trust-ad search .
- Once k3s pods are available, apply a
nameserver 127.0.0.53 options edns0 trust-ad search .
1 container image [
nameserver 127.0.0.53 options edns0 trust-ad search .
- Execute shell on container
nameserver 127.0.0.53 options edns0 trust-ad search .
Expected behavior:
Valid DNS response
Actual behavior:
- Responds with
nameserver 127.0.0.53 options edns0 trust-ad search .
Additional context / logs:
I spent all day trying to troubleshoot this.
nameserver 127.0.0.53
options edns0 trust-ad
search .
5
[ERROR] plugin/errors: 2 www.google.com. A: read udp 10.42.0.2:40800->10.0.2.3:53: i/o timeout
[WARNING] No files matching import glob pattern: /etc/coredns/custom/*.server
[WARNING] No files matching import glob pattern: /etc/coredns/custom/*.server
[ERROR] plugin/errors: 2 update.traefik.io. A: read udp 10.42.0.2:54040->10.0.2.3:53: read: no route to host
[ERROR] plugin/errors: 2 update.traefik.io. AAAA: read udp 10.42.0.2:38568->10.0.2.3:53: i/o timeout
[ERROR] plugin/errors: 2 update.traefik.io. A: read udp 10.42.0.2:36468->10.0.2.3:53: i/o timeout
[ERROR] plugin/errors: 2 update.traefik.io. AAAA: read udp 10.42.0.2:35512->10.0.2.3:53: read: no route to host
[ERROR] plugin/errors: 2 collect.traefik.io. AAAA: read udp 10.42.0.2:40958->10.0.2.3:53: i/o timeout
[ERROR] plugin/errors: 2 collect.traefik.io. A: read udp 10.42.0.2:57978->10.0.2.3:53: i/o timeout
[ERROR] plugin/errors: 2 collect.traefik.io. A: read udp 10.42.0.2:49085->10.0.2.3:53: i/o timeout
[ERROR] plugin/errors: 2 collect.traefik.io. AAAA: read udp 10.42.0.2:40077->10.0.2.3:53: i/o timeout
Host
nameserver 127.0.0.53
options edns0 trust-ad
search .
6
nameserver 127.0.0.53
options edns0 trust-ad
search .
nameserver 127.0.0.53
options edns0 trust-ad
search .
7 [on host - partial]
Link 2 [enp0s3]
Current Scopes: DNS
Protocols: +DefaultRoute +LLMNR -mDNS -DNSOverTLS DNSSEC=no/unsupported
Current DNS Server: 10.0.2.3
DNS Servers: 10.0.2.3
nameserver 127.0.0.53
options edns0 trust-ad
search .
8 [On host] Works
root@dd-ubuntu2204-us05cd017b02p-ef8c81:~# dig www.google.com
; DiG 9.18.1-1ubuntu1.3-Ubuntu www.google.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER