Use the DNS controller#

Background#

About connecting to off-mesh services#

By default, Aspen Mesh is configured not to allow on-mesh services to connect to off-mesh services. To allow on-mesh services to connect to an off-mesh service, you create a Kubernetes object called an Istio service entry for the off-mesh service. If an Istio service entry exists for an off-mesh service, any pod with a sidecar—that is, any pod in the mesh—can connect to that off-mesh service.

How Istio performs off-mesh service authorization#

This table explains what happens when an application container wants to connect to an off-mesh service:

Stage

Description

1

The application container queries CoreDNS to get the IP address of the off-mesh service.

2

To connect to the off-mesh service, the application provides the IP address to its sidecar container.

3

The sidecar compares the IP address provided by the application to the sidecar’s list of IP addresses for all service entries. If the comparison is unsuccessful, the sidecar doesn’t allow the connection.

The service entry’s resolution field#

An Istio service entry has a resolution field that specifies how the sidecar should resolve the IP address of the off-mesh service.

Resolution-field values#

The resolution field can have one of several values. This table describes two common values.

Resolution-field value

Description

Static

The IP address of the off-mesh service doesn’t change regularly. The IP address is specified in the service entry. When the service entry is created or modified, all sidecars are provided with the IP address of the off-mesh service.

DNS

The IP address of the off-mesh service may change over time. The IP address is not specified in the service entry. All sidecars must independently and repeatedly query CoreDNS to obtain the IP address of the off-mesh service.

What to notice about DNS-resolution service entries#

As the number of DNS-resolution service entries and the number of sidecars increase, the number of sidecar queries that CoreDNS must handle increases rapidly.

About the DNS controller#

Introduction#

For Istio service entries that meet specific requirements, the DNS controller can reduce the DNS traffic between sidecar proxies and CoreDNS.

Availability#

The DNS controller is available in Aspen Mesh 1.11.8-am3 and later.

How the DNS controller works#

You convert an original, DNS-resolution Istio service entry to an Aspen Mesh DNS static entry, which the DNS controller uses to create a managed, static-resolution Istio service entry. The DNS controller, not each sidecar, queries CoreDNS when necessary and updates the managed, static-resolution Istio service entry with the IP address of the off-mesh service.

Because the managed Istio service entry has a static resolution, all sidecars are provided with the IP address of the off-mesh service when the DNS controller creates or updates the managed Istio service entry. Sidecars don’t need to query CoreDNS to obtain the IP address of the off-mesh service.

Requirements for original Istio service entries#

To be eligible for conversion, original Istio service entries must meet the following requirements:

  • The value of .spec.resolution must be DNS. Other values are not supported.

  • The list of hosts in .spec.hosts must include only one host.

  • The host specified in .spec.hosts must not use a wildcard prefix (for example, *.google.com).

  • The .spec.endpoints field must not be included.

Start using the DNS controller#

When to follow these instructions#

Follow the instructions below only if you want to start using the DNS controller and only after you’ve installed Aspen Mesh. Perform the tasks in order.

About DNS-controller configuration#

The Helm chart for the DNS controller includes a values.yaml file that contains fields that Helm uses to generate the manifest files during an installation or an upgrade. You can change the default value of a field by doing both of the following:

  • Include the field in an override values file and specify a different value.

  • Specify the override values file when installing or upgrading the Helm chart.

Create a DNS-controller override values file#

  1. Change to the Aspen Mesh release directory.

  2. Change to the directory for the DNS-controller chart:

    $ cd manifests/charts/dns-controller

  3. Create a DNS-controller override values file by copying the DNS-controller values.yaml file:

    $ cp values.yaml dns-controller-override-values.yaml

  4. Open the DNS-controller override values file in a text editor.

  5. Read the comments for each field and comment out or remove any unrequired fields that you don’t want to override.

  6. Change the values of the remaining fields, if any.

  7. Save and close the file.

  8. Move the DNS-controller override values file to a permanent location.

    You’ll need access to this file when installing or upgrading the DNS controller, and you should keep the file under version control.

Install the DNS controller#

  1. Change to the Aspen Mesh release directory.

  2. Install the DNS controller:

    $ helm install dns-controller manifests/charts/dns-controller \
    --namespace istio-system \
    --values dns-controller-override-values.yaml

Convert your Istio service entries to Aspen Mesh DNS static entries#

Follow these steps for each Istio service entry that you want to be managed by the DNS controller and that meets the requirements for original Istio service entries:

  1. Copy the manifest for the Istio service entry (to use as a manifest for an Aspen Mesh DNS static entry, which will replace the Istio service entry).

  2. Open the manifest for the Aspen Mesh DNS static entry.

  3. Change apiVersion from networking.istio.io/v1beta1 (or v1alpha1) to networking.aspenmesh.io/v1beta1.

  4. Change kind from ServiceEntry to DnsStaticEntry.

  5. In the .spec section, change hosts to host, and change the value of host from a list to a string.

  6. Delete the resolution and location fields.

  7. Save the manifest.

  8. Are you running Aspen Mesh 1.11.8-am4 or later?

    • Yes:

      • Create the Aspen Mesh DNS static entry:

        $ kubectl create -f <dnsStaticEntryManifestFilename>

      • Delete the original Istio service entry:

        $ kubectl delete serviceentry <serviceEntryName>

    • No:

      Important

      After you delete an original Istio service entry and until you create the corresponding Aspen Mesh DNS static entry, on-mesh services will be unable to connect to that service entry’s off-mesh service.

      • Delete the original Istio service entry:

        $ kubectl delete serviceentry <serviceEntryName>

      • Create the Aspen Mesh DNS static entry:

        $ kubectl create -f <dnsStaticEntryManifestFilename>

Example manifests#

These are examples of a manifest before and after converting it from an Istio service entry to an Aspen Mesh DNS static entry:

Istio service entry (before) Aspen Mesh DNS static entry (after) 

apiVersion: networking.istio.io/v1beta1
kind: ServiceEntry
metadata:
  name: google.com
  namespace: istio-system
spec:
  hosts:
    - www.google.com
  ports:
  - number: 443
    name: https
    protocol: TLS
  - number: 80
    name: http
    protocol: HTTP
  location: MESH_EXTERNAL
  resolution: DNS



apiVersion: networking.aspenmesh.io/v1beta1
kind: DnsStaticEntry
metadata:
  name: google.com
  namespace: istio-system
spec:
  host: www.google.com
  ports:
  - number: 443
    name: https
    protocol: TLS
  - number: 80
    name: http
    protocol: HTTP

Upgrade the DNS controller#

Upgrade the DNS controller#

  1. Change to the Aspen Mesh release directory.

  2. Compare the new DNS-controller values.yaml file with the old DNS-controller values.yaml file (for the currently installed version):

    $ diff manifests/charts/dns-controller/values.yaml <oldDnsControllerValuesFilename>

  3. Are there any new fields that are required or that you want to override?

    • Yes:

      • Copy those fields to your DNS-controller override values file and change their values.

      • Go to step 4.

    • No:

      • Go to step 4.

  4. Upgrade the DNS controller:

    $ helm upgrade dns-controller manifests/charts/dns-controller \
    --namespace istio-system \
    --values dns-controller-override-values.yaml

Stop using the DNS controller (1.11.8-am4 and later)#

Re-create your original Istio service entries#

Follow this step for each original Istio service entry:

  • Re-create the original, DNS-resolution Istio service entry:

    $ kubectl create -f <originalServiceEntryManifestFilename>

Uninstall the DNS controller#

  • Uninstall the DNS controller:

    $ helm uninstall dns-controller --namespace istio-system

    Helm uninstalls the DNS controller and deletes the DNS static entries, which causes Kubernetes to delete the managed, static-resolution Istio service entries.

Stop using the DNS controller (1.11.8-am3)#

Introduction#

In Aspen Mesh 1.11.8-am3, a managed Istio service entry has the same name as its original Istio service entry. Therefore, when you stop using the DNS controller, you must re-create the original Istio service entries only after you uninstall the DNS controller. Otherwise, the DNS controller will delete the re-created original Istio service entries.

Important

After you uninstall the DNS controller and until you re-create an original Istio service entry, on-mesh services will be unable to connect to that service entry’s off-mesh service.

Uninstall the DNS controller#

  • Uninstall the DNS controller:

    $ helm uninstall dns-controller --namespace istio-system

    Helm uninstalls the DNS controller and deletes the DNS static entries, which causes Kubernetes to delete the managed, static-resolution Istio service entries.

Re-create your original Istio service entries#

Follow this step for each original Istio service entry:

  • Re-create the original, DNS-resolution Istio service entry:

    $ kubectl create -f <originalServiceEntryManifestFilename>