The DNS subsystem should manage keeping dnsmasq in sync

[smarterclayton]

On startup the DNS server will start a background subsystem that uses
DBus to keep dnsmasq pointing in-addr.arpa and cluster.local at the
local DNS server. If the configuration does not allow that (dnsmasq can
only talk to servers on port 53, for example) then DBus will not be
synced. The subsystem listens for dnsmasq restart events and applies
configuration, so no on-disk configuration should be necessary.

If the subsystem cannot talk to dbus the monitor routine is not
configured.

@sdodson with this change I don't believe any other dnsmasq config is
necessary. The process manages registration on startup, refreshes periodically, and detects restarts.

[giuseppe]

the change to the system container file LGTM.

[sdodson]

What's dnsIP going to be set to? I see it in the test but I'm worried that it'd be dnsIP from node config otherwise which is generally configured to the default interface which would conflict with where dnsmasq is bound.

[smarterclayton]

dnsIP has to be set by the configuration, just like today

…

On Mon, Oct 9, 2017 at 9:21 AM, Scott Dodson ***@***.***> wrote: What's dnsIP going to be set to? I see it in the test but I'm worried that it'd be dnsIP from node config otherwise which is generally configured to the default interface which would conflict with where dnsmasq is bound. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#16740 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/ABG_p1IMTNJqz2RmqoSsJl1Og6h9crQdks5sqh3qgaJpZM4PxfLM> .

[sdodson]

Ok, today we set it to the node's default interface because you can't send dns traffic from pods to 127.0.0.1 and have it hit dnsmasq running on the node. So dnsIP would point at dnsmasq and you'd be programming dnsmasq to send cluster.local and in-addr.arpa to itself.

[smarterclayton]

Yes, we'll program dnsmasq to send traffic to our bind address (if it is 0.0.0.0:53, we'll have dnsmasq send traffic to 127.0.0.1:53)

…

On Mon, Oct 9, 2017 at 9:57 AM, Scott Dodson ***@***.***> wrote: Ok, today we set it to the node's default interface because you can't send dns traffic from pods to 127.0.0.1 and have it hit dnsmasq running on the node. So dnsIP would point at dnsmasq and you'd be programming dnsmasq to send cluster.local and in-addr.arpa to itself. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#16740 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/ABG_p5phVlJixeOu20K12hOR4UYQxOqGks5sqiYvgaJpZM4PxfLM> .

[michaelgugino]

We're planning on using --bind-dynamic for dnsmasq.

http://www.thekelleys.org.uk/dnsmasq/docs/dnsmasq-man.html

bind-dynamic doesn't bind to 0.0.0.0. It binds to individual interfaces, dynamically, except for the exlcuded interfaces.

[smarterclayton]

What change is required

[michaelgugino]

@smarterclayton I looked over the 0.0.0.0 portions in this commit. It looks like it will work just fine with bind-dynamic, thanks.

[smarterclayton]

@openshift/sig-networking any comments on this?

[smarterclayton]

/retest

[smarterclayton]

/retest

[smarterclayton]

Silence is consent, discussed in person with a few people.

[sdodson]

/lgtm

[openshift-merge-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: sdodson, smarterclayton

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these OWNERS Files:

• OWNERS [smarterclayton]

You can indicate your approval by writing /approve in a comment
You can cancel your approval by writing /approve cancel in a comment

[openshift-merge-robot]

Automatic merge from submit-queue (batch tested with PRs 16725, 16779, 16798, 16783, 16740).