Mirrors/coredns
1
0
Fork 0
mirror of https://github.com/coredns/coredns.git synced 2026-08-20 23:08:28 -04:00
Code Issues Packages Projects Releases Wiki Activity

plugin/kubernetes: skip zone serial bump on DNS neutral pod updates (#8338)

Browse Source 
* plugin/kubernetes: skip zone serial bump on DNS neutral pod updates

In pods verified mode every pod update event bumped the zone modified
timestamp, even when the pod IP did not change. Pod records only depend
on the pod IP, so routine status churn (conditions, container statuses,
labels) caused spurious SOA serial changes and needless zone transfer
activity, even though pod records are not part of transfers at all.

Only bump the modified timestamp when the pod IP changes, mirroring how
service and endpoint updates are already filtered. Also update the pods
verified documentation to describe the actual overhead: modest memory
for a stripped down pod object, plus watch load on the API server.

Ref #8043

Signed-off-by: Karan V <karanvknarayanan@gmail.com>

* plugin/kubernetes: keep pods verified cost description neutral

Avoid characterizing the memory overhead as modest until benchmark
data quantifies it. State only what the code does: the watch requires
additional memory in CoreDNS and adds load to the API server.

Signed-off-by: Karan V <karanvknarayanan@gmail.com>

---------

Signed-off-by: Karan V <karanvknarayanan@gmail.com>
This commit is contained in:
Karan V
2026-08-04 10:46:10 +09:00
committed by GitHub
parent 53ad30a268
commit aeaadc0f8c
3 changed files with 67 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
plugin/kubernetes/README.md
View File

@@ -87,8 +87,9 @@ kubernetes [ZONES...] {
is vulnerable to abuse if used maliciously in conjunction with wildcard SSL certs. This
option is provided for backward compatibility with kube-dns.
* `verified`: Return an A record if there exists a pod in same namespace with matching IP. This
option requires substantially more memory than in insecure mode, since it will maintain a watch
on all pods.
option maintains a watch on all pods in the cluster, which requires additional memory in
CoreDNS (it keeps the IP, name, namespace and labels of every pod) and adds load to the
Kubernetes API server, since every pod state change in the cluster is streamed to CoreDNS.
* `endpoint_pod_names` uses the pod name of the pod targeted by the endpoint as
the endpoint name in A records, e.g.,