Container Service for Kubernetes:Diagnose DNS resolution errors with ACK CoreDNS DNSTAP Analyser

Prerequisites

Before you begin, ensure that you have:

• An ACK Pro cluster.

• The cluster kubeconfig file and kubectl connectivity.

Background

dnstap is a log format for DNS messages. CoreDNS includes a built-in dnstap plugin that captures every DNS message. ACK CoreDNS DNSTAP Analyser receives these messages over TCP and aggregates them into per-session diagnostic records.

See dnstap for log format details.

Step 1: Install ACK CoreDNS DNSTAP Analyser

1. Log on to the ACK console. In the left-side navigation pane, click Clusters.

2. On the Clusters page, find the cluster and click its name. In the left-side navigation pane, choose Applications > Helm.

3. On the Helm page, click Deploy. In the Basic Information step, configure the following parameters. Select ack-coredns-dnstap-analyser and click Next.

   Parameter	Value
   Application Name	ack-coredns-dnstap-analyser
   Namespace	kube-system
   Source	Marketplace (default)
   Chart — Use Scenarios	All
   Chart — Supported Architecture	amd64
   Chart — Search box	ack-coredns-dnstap-analyser

4. In the Parameters step, configure the Chart Version and click OK.

Step 2: Configure the dnstap plugin in CoreDNS

CoreDNS includes the dnstap plugin. Enable it and point it at ACK CoreDNS DNSTAP Analyser to forward DNS messages automatically.

1. Get the cluster IP address of the DNSTAP Analyser service. Note this address for the next step.

   kubectl -n kube-system get svc dnstap-analyser

   In this example, the cluster IP address is 172.21.0.10.

2. Open the CoreDNS ConfigMap for editing.

   kubectl -n kube-system edit cm coredns -o yaml

3. Add the dnstap directive to the Corefile. Replace 172.21.0.10 with the cluster IP address from Step 1.

   Corefile: |
       .:53 {
           # ... other plugins ...
           ready
   
           # Add this line. The "full" flag includes the complete wire-format DNS
           # message in each record, which provides richer diagnostic data.
           dnstap tcp://172.21.0.10:6000 full
   
           kubernetes cluster.local in-addr.arpa ip6.arpa {
           # ... other settings ...
           }
           # ... other plugins ...
           reload
           loadbalance
       }

4. Verify that CoreDNS reloaded the configuration.

   1. List all CoreDNS Pods.

      kubectl -n kube-system get pod | grep coredns

      Expected output:

      coredns-7d56l         1/1     Running   0          30m
      coredns-s7m2t         1/1     Running   0          30m

   2. Tail the log of a CoreDNS Pod. Replace coredns-7d56l with a Pod name from the previous output.

      kubectl -n kube-system logs -f --tail=500 coredns-7d56l

      Wait up to one minute. A successful reload produces:

      [INFO] Reloading complete

Step 3: View the log of ACK CoreDNS DNSTAP Analyser

1. List all ACK CoreDNS DNSTAP Analyser Pods.

   kubectl -n kube-system get pod | grep dnstap-analyser

   Expected output:

   dnstap-analyser-bbdf879-g****         1/1     Running   0          30m

2. Stream the log. Replace dnstap-analyser-bbdf879-g**** with the Pod name from the previous output.

   kubectl -n kube-system logs -f dnstap-analyser-bbdf879-g****

Step 4: Analyze the log

Each log line represents one DNS session — a full request-response cycle between a client, CoreDNS, and the upstream DNS server.

How to read a session entry: Check Status to confirm success or failure. Check BitMap to identify which resolution stage failed. Inspect Messages for raw DNS payloads.

(Optional) Step 5: Uninstall ACK CoreDNS DNSTAP Analyser

After your investigation, remove the analyser to avoid unnecessary costs.

1. Remove the dnstap directive from the CoreDNS ConfigMap.

   1. Open the ConfigMap for editing.

      kubectl -n kube-system edit cm coredns -o yaml

   2. Delete the line containing dnstap.

      Corefile: |
          .:53 {
              # ... other plugins ...
              ready
      
              # Delete the following line.
              dnstap tcp://10.10.10.10:6000 full
      
              kubernetes cluster.local in-addr.arpa ip6.arpa {
              # ... other settings ...
              }
              # ... other plugins ...
              reload
              loadbalance
          }

   3. Verify that CoreDNS reloaded the configuration. List all CoreDNS Pods.

      kubectl -n kube-system get pod | grep coredns

      Expected output:

      coredns-7d56l         1/1     Running   0          30m
      coredns-s7m2t         1/1     Running   0          30m

   4. Tail the log of a CoreDNS Pod. Replace coredns-7d56l with a Pod name from the previous output.

      kubectl -n kube-system logs -f --tail=500 coredns-7d56l

      Wait up to one minute. A successful reload produces:

      [INFO] Reloading complete

2. Delete the ACK CoreDNS DNSTAP Analyser Helm release.

   1. Log on to the ACK console. In the left-side navigation pane, click Clusters.

   2. On the Clusters page, find the cluster and click its name. In the left-side navigation pane, choose Applications > Helm.

   3. On the Helm page, find ack-coredns-dnstap-analyser and click Delete in the Actions column.

Next steps

• DNS overview

• DNS policies and domain name resolution

• DNS troubleshooting