What reasons should I NOT use a private DNS zone and CNAME services in my AWS/K8s environment?

Question

I have a Kubernetes cluster in AWS, with apps that talk to AWS services like RDS, Elasticache, Elasticsearch, DynamoDB, etc.

For the services where it's available (Elasticache and RDS, and more recently Elasticsearch with a custom ACM certificate), I've considered making a private zone in Route53 and making CNAMEs for all the things. So instead of app-production.789yuiahsdf.redis.elastitcache.aws.com or whatever the Elasticache endpoint is, my app talks to sidekiq.redis.app. I'd use a pattern, maybe <purpose>.<service>.<app>, so I'd have sidekiq.redis.app, cache.redis.app, primary.postgres.app, replica.postgres.app, etc, etc.

The next step is having the app is configured by default to use these hosts. In development, staging, and production, they don't NEED any configuration (maybe it's still available), but the defaults should "just work" if the environment is set up properly.

What are the downsides here? What am I missing? To me, this seems sort of like simple service discovery and a reasonable idea. But reasonable ideas can sometimes bite you later on.

Answer 1

It seems a reasonable idea to me.
There migt be a few things you might want to check tho :

This article or this one. For example :

• the fact the that a private hosted zone is associated with a VPC
• there is some DNS hostnames and DNS resolution parameters on the VPC settings

enableDnsHostnames : Indicates whether instances with public IP addresses get corresponding public DNS hostnames
enableDnsSupport : Indicates whether the DNS resolution is supported.

• Only VPC resolver will resolve the private records (subnet range +2 for the ip of the VPC resolver, search for reserved ip here)
  • take care you didn't configure custom resolver and so wont be able to access your private records
  • think about the fact that you won't be able to resolve those records from outside the VPC (office for example) unless you manage to plug to the VPC resolver somehow

You could also give a look at Alias record ? Could give advantages like :

• create record that has the same name as the hosted zone
• not being charged for the queries (in opposite to CNAMEs)

These are few things I can think off right now. Hope this helps.

Cheers.