image-registry not using CoreDNS's default-dns? And how to change the default external DNS servers after installation

[devzeronull]

Hi,

we are facing an issue, where we have to use a different DNS server (e.g. "172.16.1.1") for an internal domain (e.g."internal.net"), which is not covered by the default external DNS resolver (e.g. "192.168.1.1") to pull images from (e.g. "images.internal.net").

Our first approach was to alter the default DNS with a specific forwarder "172.16.1.1" for the zone "internal.net":

spec:
  servers:
  - name: zone-internal-net
    zones: 
      - internal.net
    forwardPlugin:
      upstreams: 
        - 172.16.1.1:53

This works so far from several pods, also "image-registry-xxx" or "cluster-image-registry-operator-xxx" in namespaces "openshift-image-registry", but when pulling images from "images.internal.net" we are running into pullbacks with the error:

Failed to pull image "images.internal.net/myrepo/myimage:1.2.34": rpc error: code = Unknown desc = error pinging docker registry images.internal.net: Get "https://images.internal.net/v2": dial tcp: lookup images.internal.net on 192.168.1.1:53: no such host

So obviously it is not possible to resolve the custom zone because it is asking the wrong nameserver "192.168.1.1" instead of "172.16.1.1".

On CoreOS-level we have only configured our default nameservers (e.g. "192.168.1.1" and "192.168.1.2") and no forwarding for this specific zone.

While investigating we recognized that the pods in the namespace "openshift-dns", "openshift-dns-operator" as long as the "node-ca-xxx" pods in namespace "openshift-image-registry" are also not making use of the CoreDNS resolver.

There is hardly any information about which operators are making use of the CoreDNS based Cluster default DNS resolver and which not and especially nothing about how to configure it for the registry pulling images (although trusted CA certificate customization is covered).

It would be nice if anyone could point me into the right direction, a workaround would be to change the "global" clusters external DNS on CoreOS level which seems to imply a re-installation of the Cluster, or?

Best regards
dzn