Hot answers tagged

5

You should have 3 names when you're willing to do a blue/green deployment. Two set of names, one for blue, one for green, which will works as is, and a production entrypoint which will point to either the blue name or green name. The point of a blue/green deployment is to be able to test the full deploy before switching the clients entry point, so your ...


3

If you want a DNS lookup of one domain to resolve to another one, you have 2 options. Modify the Container /etc/hosts file. By default any DNS lookup is done there. You schould do that in the Dockerfile. Modify /etc/hosts in a Dockerfile Maintain your own DNS servers with all mapping records. On container runtime just pass the DNS server. Docker docs ...


3

I believe this is an current bug in k3s that upstream DNS is hardcoded to 1.1.1.1. this should be resolved shortly https://github.com/rancher/k3s/issues/53


2

There is a comprehensive document about k8s' DNS. According to this document one could validate whether the DNS is working by running: busybox.yaml apiVersion: v1 kind: Pod metadata: name: busybox namespace: default spec: containers: - image: busybox command: - sleep - "3600" imagePullPolicy: IfNotPresent name: busybox ...


2

If you’re talking about using a Route 53 ALIAS record, you cannot set the TTL on it, for this reason. It defaults to a low value, and is managed by AWS for you (to the world it appears as an A record, and it will change often). If you’re using a CNAME, then you can set whatever TTL you like. The TTL of the DNS record for the load balancer’s domain will be ...


2

No, Kubernetes will load-balance requests to a ClusterIP across all Pods with matching labels (and passing readiness checks). It won't keep traffic within the same Node. Q: So how does the NodeLocal DNS Cache achieve to keep DNS requests local to the Node? A: When using the NodeLocal DNS Cache, it is necessary to pass a extra arg to the Kubelet of each ...


2

This looks to be answered on offcail docs here NodeLocal DNSCache improves Cluster DNS performance by running a dns caching agent on cluster nodes as a DaemonSet. With this architecture, Pods will reach out to the dns caching agent running on the same node, thereby avoiding iptables DNAT rules and connection tracking. Having a local cache will help improve ...


2

ibuildthecloud9 gave me the right hint. Since the github issue doesn't describe how to midify the dns, I figured it out and want to document it here in case someone need to change it, too. It's stored in the configmap coredns as Corefile: proxy . 1.1.1.1 You need to replace this by your dns server (192.168.0.19 in my case). It could be done manually using ...


2

Is it possible to query Amazon DNS server from our corporate network trough the VPN tunnel? Directly? No. The recursive resolver available by default when you create a VPC can only be accessed by an IP address in that VPC. This is a restriction that Amazon imposes. What you can do is create a forwarder using the Route 53 Resolver service or software like ...


2

There are two parts to owning a domain. The registration, and the hosting of the DNS entries. AS you are transferring the domain registration, AWS needs to know who's service do you want to use for managing your DNS host names and other settings. As a sensible default, select option (1) as this will keep everything managed with the current registrar / ...


1

Is this what you are trying to do? $ docker run --add-host foo:127.0.0.42 alpine ping foo -c 3 PING foo (127.0.0.42): 56 data bytes 64 bytes from 127.0.0.42: seq=0 ttl=64 time=0.045 ms 64 bytes from 127.0.0.42: seq=1 ttl=64 time=0.061 ms 64 bytes from 127.0.0.42: seq=2 ttl=64 time=0.070 ms --- foo ping statistics --- 3 packets transmitted, 3 packets ...


1

The extra_hosts setting in docker-compose might help you. Docs


1

The /etc/resolv.conf is injected as a bind mount in containers by the docker engine with settings local to that docker engine. An empty file in the parent filesystem is an artifact of that bind mount. You can safely ignore that. If a_file is not being created, check that the file is not in a volume. Temporary (anonymous) volumes are created with the ...


1

Usually to access an external API you can just use its URL. But you can create a Service for it if you like, the type of service should be ExternalName as described in the documentation https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types


1

A service in kubernetes is (mostly) used for internal communication. If you want to access an external resource by domain/ip you can just do so. If you have an IP address and you would like to have some sort of domain connected to it, you could you am service with the external name field set to the up address (we use that for database purposes). An endpoint ...


1

You can use dns.resolver or dns.rdatatype and update in Python like below: import dns.resolver import dns.rdatatype import dns.update for i in dns.resolver.query('blah.com', 'TXT').answer.response: update.replace(% i , 60, dns.rdatatype.TXT, '" NEW RECORD"')


1

Amazon web services provides such a service, called Route53. You can actually use REST calls, but it is much easier to use their command line tools or bindings for PHP, Python or JavaScript. Here is an entry point to get you started, the route53 change resource record sets call can be used to update or insert one or many records on a domain. https://...


1

On the agent I needed to set the server ip set to puppet in /etc/hosts I had accidentally put it on the agents ip address and then been incorrectly assuming i'd done something wrong on the master rather than the agent. (server ip) (domian name) puppet


1

Sounds like the problem has been resolved by deleting all of the kube-proxy pods, which is an aggressive solution but if it works then good work! Best I can offer you is a collection of links about diagnosing Kubernetes problems: Troubleshoot Applications Troubleshooting Kubernetes Networking Issues Troubleshooting GKE (GKE Specific but still useful) ...


1

When I lookup your domain thuijls.net on MXToolBox I get the following messageL Dns record not found They explain this to mean: More Information About Dns Record Published We did not find a SPF (TXT) record for the domain. Either you are using the deprecated type "SPF" record (in which case you will see a warning message for this alongside this ...


1

Both are completely correct. It can differ organisation by organisation. Also, once you start using one of the domain namespace type, you will gradually remember the format and no issues will come. However, I can see one issue here which is related to SSL. If you go with any one of the above mentioned namespaces, you need to generate multiple SSL ...


1

Found the answer here Just add --network=host to docker build or docker run. docker build --network=host foo/bar:latest .


1

To answer your question, ill first try to give simple explanations for each policy to help with the confusion (https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/routing-policy.html). Simple: a basic routing policy that randomly sends a user to one of your addresses. Failover: You have a primary (active) route and a secondary (passive) route. When ...


1

I needed to whitelist Host, Origin and Referer in the Whitelist Headers section. I've had more issues with CloudFront, wrote a blog post about it, maybe someone will find it helpful: https://medium.com/@justynazet/placing-a-craft-cms-application-behind-the-cloudfront-1602027ff72b


1

As the issue is happening only with /admin URL, this might be related with cookies which are being passed to the backend application's /admin URL. You may need to check with CraftCMS team (or some other forums) and get the list of cookies which are being used by the /admin URL. You can whitelist those cookies in cloudfront specifically for /admin URL.


1

We have not been able to figure out what the problem is or what a solution could be. The workaround is actually not using the 10.0.2.0 subnet, so I will add that as an answer as requested in the comments. If someone finds the real issue and solution here, I will gladly accept that answer though.


1

Can you obtain a secure certificate for someone else's domain or subdomain without their help - hopefully not. One of the core security pillars of a secure certificate is that it ensures that you are actually connected (through an encrypted connection) to the the site you wanted to connect to. For this purpose the minimum check every certificate issuer ...


1

As I understand it you need to establish a network service (I.e, compose file), though if you are working with a docker file (e.g, ver. docker 1.x < 2) you typically issue a command or execute a script. In either case, I’ll need to create a new network service and bridge ports (I.e, expose port) to make them accessible: A <-> B -> C Check out the ...


1

Your first step is to setup and configure the Route53 service from the rancher catalog. After that, the load-balancer will automatically update its DNS in Route53.


1

Route53 has an API for creating DNS records. The API is a bit obtuse, but there are a plethora of wrappers for various languages.


Only top voted, non community-wiki answers of a minimum length are eligible