Red Hat Connectivity Link

Learn about coreDNS components

Use the following references to configure your CoreDNS integration with your DNS infrastructure through access control and zone delegation.

CoreDNS Corefile configuration reference

A Corefile is organized into server blocks that define how DNS queries are handled based on the port and zone. Plugin execution order is determined at build time, not by Corefile order, so you can list plugins in any order.

When making configurations by using the DNS Operator, you can check the ConfigMap for the resulting server block.

Connectivity Link includes the following minimal Corefile that you can update:

Minimal Corefile

Corefile: |
    . {
        health
        ready
    }

For a Corefile with configurations added, see the following example:

Example configured Corefile

k.example.com {
    debug
    errors
    log
    health {
        lameduck 5s
    }
    ready
    geoip GeoLite2-City-demo.mmdb {
        edns-subnet
    }
    metadata
    transfer {
        to *
    }
    kuadrant
    prometheus 0.0.0.0:9153
}

Zone coordination

Each zone in the Corefile must match a zone listed in your CoreDNS provider secret’s ZONES field.

Required plugins

The geoip and metadata plugins are included by default with the Connectivity Link implementation of the CoreDNS Corefile.

Corefile updates

After any updates to your Corefile, you must always restart your pods for the CoreDNS deployment. You can use the following command:

$ oc rollout restart deployment/coredns -n kuadrant-system

You can check the status of the rollout by running the following command:

$ oc rollout status deployment/coredns -n kuadrant-system --watch

Default enabled plugins in CoreDNS

The following plugins are enabled by default in the Connectivity Link CoreDNS plugin. You must ensure CoreDNS compatibility and enable any other plugins that you want to add.

Plugin Function

Plugin	Function
acl	Enforces access control policies on source IP addresses and prevents unauthorized access to DNS servers.
cache	Enables a front-end cache.
cancel	Cancels a request’s context after 5001 milliseconds.
debug	Disables the automatic recovery when a crash happens so that a stack trace is generated.
errors	Enables error logging.
file	Enables serving zone data from an RFC 1035-style `master` file.
forward	Enables IP forwarding. Facilitates proxying DNS messages to upstream resolvers.
geoip	Lookup `.mmdb` (MaxMind db file format) databases using the client IP, then adds associated `geoip` data to the context request.
header	Modifies the header for queries and responses.
health	Enables a health check endpoint.
hosts	Enables serving zone data from an `/etc/hosts style` file.
kuadrant	Enables serving zone data from kuadrant `DNSRecord` custom resources. Uses logic from the CoreDNS file plugin to create a functioning DNS server.
local	Responds with a basic reply to a local names in the following zones, `localhost`, `0.in-addr.arpa`, `127.in-addr.arpa`, `255.in-addr.arpa` and any query asking for `localhost.<domain>`.
log	Enables query logging to standard output. Logs are structured for aggregation by cluster logging solutions.
loop	Detects simple forwarding loops and halts the server.
metadata	Enables a metadata collector.
minimal	Minimizes size of the DNS response message whenever possible.
nsid	Adds an identifier of this server to each reply.
prometheus	Enables Prometheus metrics. The default listens on `localhost:9153`. The metrics path is to `/metrics`.
ready	Enables a readiness check HTTP endpoint.
reload	Allows automatic reload of a changed Corefile.
rewrite	Rewrites queries for automatic port forwarding.
root	Simply specifies the root of where to find files.
secondary	Enables serving a zone retrieved from a primary server.
timeouts	Means that you can configure the server read, write and idle timeouts for the TCP, TLS, DoH and DoQ (idle only) servers.
tls	Means that you can configure the server certificates for the TLS, gRPC, and DoH servers.
transfer	Perform (outgoing) zone transfers for other plugins.
view	Defines the conditions that must be met for a DNS request to be routed to the server block.
whoami	Returns your resolver’s local IP address, port and transport.

acl

Enforces access control policies on source IP addresses and prevents unauthorized access to DNS servers.

cache

Enables a front-end cache.

cancel

Cancels a request’s context after 5001 milliseconds.

debug

Disables the automatic recovery when a crash happens so that a stack trace is generated.

errors

Enables error logging.

file

Enables serving zone data from an RFC 1035-style master file.

forward

Enables IP forwarding. Facilitates proxying DNS messages to upstream resolvers.

geoip

Lookup .mmdb (MaxMind db file format) databases using the client IP, then adds associated geoip data to the context request.

header

Modifies the header for queries and responses.

health

Enables a health check endpoint.

hosts

Enables serving zone data from an /etc/hosts style file.

kuadrant

Enables serving zone data from kuadrant DNSRecord custom resources. Uses logic from the CoreDNS file plugin to create a functioning DNS server.

local

Responds with a basic reply to a local names in the following zones, localhost, 0.in-addr.arpa, 127.in-addr.arpa, 255.in-addr.arpa and any query asking for localhost.<domain>.

log

Enables query logging to standard output. Logs are structured for aggregation by cluster logging solutions.

loop

Detects simple forwarding loops and halts the server.

metadata

Enables a metadata collector.

minimal

Minimizes size of the DNS response message whenever possible.

nsid

Adds an identifier of this server to each reply.

prometheus

Enables Prometheus metrics. The default listens on localhost:9153. The metrics path is to /metrics.

ready

Enables a readiness check HTTP endpoint.

reload

Allows automatic reload of a changed Corefile.

rewrite

Rewrites queries for automatic port forwarding.

root

Simply specifies the root of where to find files.

secondary

Enables serving a zone retrieved from a primary server.

timeouts

Means that you can configure the server read, write and idle timeouts for the TCP, TLS, DoH and DoQ (idle only) servers.

tls

Means that you can configure the server certificates for the TLS, gRPC, and DoH servers.

transfer

Perform (outgoing) zone transfers for other plugins.

view

Defines the conditions that must be met for a DNS request to be routed to the server block.

whoami

Returns your resolver’s local IP address, port and transport.

Tip

When using CoreDNS, if you do not need to keep all logs, you can set up the logs directive to only report errors and use the prometheus plugin to gather primary metrics instead. Prometheus metrics give you trends, for example, how many queries failed, without storing every single piece of traffic.