DNS
54 incident problems about DNS. Start with the reviewed ones.
Read first
When the ConfigMap changed but the Pod keeps using the old valuesAn InfraTree guide that lays out the first signals to check, the CLI verification order, common misdiagnoses, and a safe recovery path when values don't refresh after a ConfigMap update because of envFrom, subPath, volume projection, or rollout trigger differences.Kubernetes3 min readWhen CoreDNS is Running but only DNS lookups failAn InfraTree guide that lays out the first signals to check, the CLI verification order, common misdiagnoses, and a safe recovery path when the CoreDNS Pod looks healthy but failures occur in the kube-dns path, upstream, node-local-dns, or policy.Kubernetes3 min readWhat to check first when CrashLoopBackOff appearsAn InfraTree guide that lays out the first signals to check, the CLI verification order, common misdiagnoses, and a safe recovery path when a Pod restarts repeatedly and the real cause is left in the previous logs and events.Kubernetes3 min read
Recommended problems
Reviewed problems first, then problems with detailed scenarios.
All problems (54)
K8S-1612A CoreDNS pod is healthy and one namespace still resolves old namesOne namespace still resolves old names after a DNS suffix update.ReviewedKubernetesBeginner6 minFreeNETWORK-1604A pfSense VIP move is complete and one split-horizon answer still points at the old hostOne split-horizon answer still points at the old host after a VIP move.NetworkAdvanced9 minProNETWORK-1577An Unbound override is fixed and one resolver still answers the old zoneOne resolver still answers the old zone after Unbound override fixes.NetworkAdvanced9 minProNETWORK-1474A CARP failover restores sessions and branch DNS still breaksBranch traffic survives failover while local name overrides disappear until the primary returns.NetworkAdvanced11 minProK8S-1481A Cilium FQDN policy looks updated and pods still failPods stay blocked after an egress FQDN rule is tightened even though the updated policy is visible on the node.KubernetesAdvanced12 minProNETWORK-1476A DoH migration works for browsers and breaks one service meshMesh sidecars fail only during cold start after a DNS-over-HTTPS migration.NetworkAdvanced12 minProNETWORK-1458A recursive resolver over TLS stays healthy and validation still failsOne encrypted resolver path stops validating after an upstream key roll while ordinary DNS still works.NetworkAdvanced12 minProNETWORK-1466A split-horizon DNS design works for browsers and fails for one API clientOnly one API client type reports certificate mismatch after moving to DoH.NetworkAdvanced12 minProNETWORK-1405A branch office resolver sends a suffix zone to the wrong upstreamA branch office resolver sends a suffix zone to the wrong upstream focuses on dns and asks the reader to isolate the key signal in ubuntu. Resolver shortcuts can skip the one place where special-case validation behavior...NetworkAdvanced13 minProNETWORK-1415A branch resolver forwards a private suffix correctly and DNSSEC failures...A branch resolver forwards a private suffix correctly and DNSSEC failures... focuses on dns and asks the reader to isolate the key signal in ubuntu. Resolver simplification can remove local exceptions that were silently making a broken u...NetworkAdvanced13 minProNETWORK-1425A branch resolver forwards a private suffix correctly and DNSSEC failures...A branch resolver forwards a private suffix correctly and DNSSEC failures... focuses on dns and asks the reader to isolate the key signal in ubuntu. Resolver simplification can remove local exceptions that were masking upstream signature pr...NetworkAdvanced13 minProNETWORK-1435A branch resolver forwards a private suffix correctly and DNSSEC failures...A branch resolver forwards a private suffix correctly and DNSSEC failures... focuses on dns and asks the reader to isolate the key signal in ubuntu. Resolver simplification can remove local exception logic that was silently masking u...NetworkAdvanced13 minProK8S-1461A Cilium policy allows the namespace and still blocks node-local DNSPods on one node pool lose DNS right after node-local DNS and host firewall hardening are enabled together.KubernetesAdvanced13 minProNETWORK-1445A DNS split-horizon migration works in direct queries and fails in appsInternal service names resolve in diagnostics and fail only behind one validating resolver chain.NetworkAdvanced13 minProK8S-1594A cert-manager DNS01 cleanup finishes and one order still waitsOne cert-manager order still waits after DNS01 hosted zone cleanup.KubernetesIntermediate8 minProK8S-1604A cert-manager order is valid and one challenge still waitsOne DNS challenge still waits after a hosted zone migration.KubernetesIntermediate8 minProNETWORK-1603A Cloudflare Tunnel route is correct and one app still loopsOne app still loops after a Cloudflare Tunnel route fix.NetworkIntermediate8 minProNETWORK-1574A pfSense NAT reflection issue is solved and one host still loopsOne host still loops back after NAT reflection cleanup.NetworkIntermediate8 minProNETWORK-1584A pfSense NAT reflection rule is right and one host still loopsOne host still loops after pfSense NAT reflection cleanup.NetworkIntermediate8 minProNETWORK-1594A pfSense reflection rule is corrected and one subnet still loopsOne subnet still loops after a pfSense reflection fix.NetworkIntermediate8 minPro