Split zone between kubernetes and pihole #7110

carlosV2 · 2025-02-01T00:45:33Z

carlosV2
Feb 1, 2025

Hi,

I have a Kubernetes cluster with some services in it. In addition to this, I have a Pi-Hole installed on a different machine.

The idea is that any machine on the network resolves via the Pi-Hole but the pods in Kubernetes should resolve internally unless the hostname was not found in which case it should fallback to Pi-Hole.

I've attempted the following configuration:

.:53 {
    rewrite continue {
      name regex ^([^.]+)\.example\.com\.$ {1}.{1}.svc.cluster.local.
      answer name ^([^.]+)\.[^.]+\.svc\.cluster\.local\.$ {1}.example.com.
    }
    kubernetes cluster.local in-addr.arpa ip6.arpa {
      pods insecure
      fallthrough in-addr.arpa ip6.arpa
    }
    forward . <pihole ip>
}

Reading the documentation this should attempt to rewrite the request into a *.cluster.local one. If it finds a service, it should return its IP. Otherwise, the request should continue with the original query thus being forwarded to the Pi-Hole IP.

After running some tests, I can see that:

External hostnames are correctly resolved (say www.google.com)
Hostnames that do not match the rewrite rule are also being correctly resolved (say some.machine.example.com)
Domains that match the rewrite rule with an existing service also are being resolved correctly (say exists.example.com)
Domains that match the rewrite rule with no existing service but with an entry on my Pi-Hole are not being resolved (say other.example.com)

For the last scenario, I'm getting the following output with dig (I'm forwarding the port from the cluster):

; <<>> DiG 9.20.5 <<>> -p 5353 other.example.com @localhost +tcp
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 34069
;; flags: qr aa rd; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1
;; WARNING: recursion requested but not available

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
; COOKIE: 14a6b33084dd5f94 (echoed)
;; QUESTION SECTION:
;other.example.com.          IN      A

;; AUTHORITY SECTION:
cluster.local.          5       IN      SOA     ns.dns.cluster.local. hostmaster.cluster.local. 1738368940 7200 1800 86400 5

;; Query time: 26 msec
;; SERVER: ::1#5353(localhost) (TCP)
;; WHEN: Sat Feb 01 00:30:02 GMT 2025
;; MSG SIZE  rcvd: 154

Is there a way to do as I intend? I feel like I might be missing or missinterpreting something but I can't quite point my finger onto it. Many thanks.

Edit: I've also tried by having a rewrite between the kubernetes and the forward instructions undoing the initial rewrite but it just makes all the queries to be forwarded to the Pi-Hole.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Split zone between kubernetes and pihole #7110

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Replies: 0 comments

Select a reply

Uh oh!

Split zone between kubernetes and pihole #7110

Uh oh!

Uh oh!

carlosV2 Feb 1, 2025

Replies: 0 comments

carlosV2
Feb 1, 2025