From 4492fc5766822789344411e1deb64a9e54aef216 Mon Sep 17 00:00:00 2001 From: Geoffrey Cline Date: Fri, 18 Mar 2022 16:48:17 -0500 Subject: [PATCH 1/2] add steps for coredns permissions --- .../dns-debugging-resolution.md | 48 +++++++++++++++++++ 1 file changed, 48 insertions(+) diff --git a/content/en/docs/tasks/administer-cluster/dns-debugging-resolution.md b/content/en/docs/tasks/administer-cluster/dns-debugging-resolution.md index e9dd545955..2fb9a07a49 100644 --- a/content/en/docs/tasks/administer-cluster/dns-debugging-resolution.md +++ b/content/en/docs/tasks/administer-cluster/dns-debugging-resolution.md @@ -252,6 +252,54 @@ linux/amd64, go1.10.3, 2e322f6 2018/09/07 15:29:04 [INFO] Reloading complete 172.17.0.18:41675 - [07/Sep/2018:15:29:11 +0000] 59925 "A IN kubernetes.default.svc.cluster.local. udp 54 false 512" NOERROR qr,aa,rd,ra 106 0.000066649s ``` +### Does CoreDNS have sufficient permissions? + +CoreDNS must be able to list {{< glossary_tooltip text="service" +term_id="service" >}} and {{< glossary_tooltip text="endpoint" +term_id="endpoint" >}} related resources to properly resolve service names. + +Sample Error Message: +``` +2022-03-18T07:12:15.699431183Z [INFO] 10.96.144.227:52299 - 3686 "A IN serverproxy.contoso.net.cluster.local. udp 52 false 512" SERVFAIL qr,aa,rd 145 0.000091221s +``` + +First, get the current ClusterRole of `system:coredns`: + +``` +kubectl describe clusterrole system:coredns -n kube-system +``` + +Expected Output: +``` +PolicyRule: + Resources Non-Resource URLs Resource Names Verbs + --------- ----------------- -------------- ----- + nodes [] [] [get] + endpoints [] [] [list watch] + namespaces [] [] [list watch] + pods [] [] [list watch] + services [] [] [list watch] + endpointslices.discovery.k8s.io [] [] [list watch] +``` + +If any permissions are missing, edit the ClusterRole to add them: + +``` +kubectl edit clusterrole system:coredns -n kube-system +``` + +Example Insertion of EndpointSlices Permissions: +``` +... +- apiGroups: + - discovery.k8s.io + resources: + - endpointslices + verbs: + - list + - watch +... +``` ### Are you in the right namespace for the service? From 67c5034165036c99366d5b7ed586ce6aada9b5a8 Mon Sep 17 00:00:00 2001 From: Geoffrey Cline Date: Mon, 28 Mar 2022 12:27:33 -0500 Subject: [PATCH 2/2] Apply suggestions from code review Co-authored-by: Qiming Teng --- .../administer-cluster/dns-debugging-resolution.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/content/en/docs/tasks/administer-cluster/dns-debugging-resolution.md b/content/en/docs/tasks/administer-cluster/dns-debugging-resolution.md index 2fb9a07a49..7dbe5f2f74 100644 --- a/content/en/docs/tasks/administer-cluster/dns-debugging-resolution.md +++ b/content/en/docs/tasks/administer-cluster/dns-debugging-resolution.md @@ -258,18 +258,18 @@ CoreDNS must be able to list {{< glossary_tooltip text="service" term_id="service" >}} and {{< glossary_tooltip text="endpoint" term_id="endpoint" >}} related resources to properly resolve service names. -Sample Error Message: +Sample error message: ``` 2022-03-18T07:12:15.699431183Z [INFO] 10.96.144.227:52299 - 3686 "A IN serverproxy.contoso.net.cluster.local. udp 52 false 512" SERVFAIL qr,aa,rd 145 0.000091221s ``` First, get the current ClusterRole of `system:coredns`: -``` +```shell kubectl describe clusterrole system:coredns -n kube-system ``` -Expected Output: +Expected output: ``` PolicyRule: Resources Non-Resource URLs Resource Names Verbs @@ -284,11 +284,11 @@ PolicyRule: If any permissions are missing, edit the ClusterRole to add them: -``` +```shell kubectl edit clusterrole system:coredns -n kube-system ``` -Example Insertion of EndpointSlices Permissions: +Example insertion of EndpointSlices permissions: ``` ... - apiGroups: