Temporary failure in name resolution 해결: 호스트·Docker·K8s DNS 진단 런북

cat /etc/resolv.conf
ls -l /etc/resolv.conf

# This is /run/systemd/resolve/stub-resolv.conf
nameserver 127.0.0.53
options edns0 trust-ad
search ap-northeast-2.compute.internal

# 케이스 A: 아예 비어 있음 (출력 없음)
# 케이스 B: search만 있고 nameserver 줄이 없음
search example.internal
# 케이스 C: 심볼릭 링크가 깨짐
lrwxrwxrwx 1 root root 39 /etc/resolv.conf -> ../run/systemd/resolve/stub-resolv.conf
cat: /etc/resolv.conf: No such file or directory

# 임시 복구 (재부팅 시 사라짐)
echo "nameserver 1.1.1.1" | sudo tee /etc/resolv.conf

resolvectl status

Link 2 (eth0)
    Current Scopes: DNS
         Protocols: +DefaultRoute -LLMNR -mDNS -DNSOverTLS DNSSEC=no/unsupported
Current DNS Server: 10.0.0.2
       DNS Servers: 10.0.0.2
        DNS Domain: ap-northeast-2.compute.internal

Link 2 (eth0)
    Current Scopes: none          <- 업스트림 없음
       DNS Servers:               <- 비어 있음
         Protocols: ... DNSSEC=yes/supported   <- 사내 DNS에서 SERVFAIL 유발 가능

dig +short @8.8.8.8 example.com
dig +short example.com
curl -sS -o /dev/null -w '%{http_code}\n' https://example.com

getent hosts example.com      # NSS 경로를 그대로 타는 조회

sudo ss -lunp | grep :53

UNCONN 0 0 127.0.0.53%lo:53 0.0.0.0:* users:(("systemd-resolve",pid=612,fd=13))

systemctl status systemd-resolved
sudo systemctl enable --now systemd-resolved

nc -zvu 10.0.0.2 53          # UDP 53 도달성
dig +tcp @10.0.0.2 example.com   # TCP 53 도달성

sudo ln -sf /run/systemd/resolve/resolv.conf /etc/resolv.conf
resolvectl status | head -20

# /etc/netplan/01-netcfg.yaml
network:
  version: 2
  ethernets:
    eth0:
      dhcp4: true
      dhcp4-overrides:
        use-dns: false
      nameservers:
        addresses: [10.0.0.2, 1.1.1.1]
        search: [example.internal]

sudo chmod 600 /etc/netplan/01-netcfg.yaml
sudo netplan generate && sudo netplan apply
resolvectl status | grep -A2 'Link 2'

nmcli con show
sudo nmcli con mod "System eth0" ipv4.dns "10.0.0.2 1.1.1.1"
sudo nmcli con mod "System eth0" ipv4.dns-search "example.internal"
sudo nmcli con mod "System eth0" ipv4.ignore-auto-dns yes
sudo nmcli con up "System eth0"

# /etc/systemd/resolved.conf
[Resolve]
DNS=10.0.0.2 10.0.0.3
FallbackDNS=1.1.1.1
Domains=~.
DNSSEC=false
DNSStubListener=yes

sudo systemctl restart systemd-resolved
resolvectl status
resolvectl query example.com

dig +cd @10.0.0.2 internal.example.com   # 성공하면 DNSSEC 검증 실패가 원인

docker run --rm alpine cat /etc/resolv.conf
# 이상 신호: nameserver 8.8.8.8  (사내망인데 공인 DNS가 박혀 있음)
docker run --rm alpine nslookup registry.example.internal

{
  "dns": ["10.0.0.2", "10.0.0.3"],
  "dns-search": ["example.internal"],
  "dns-opts": ["ndots:1", "timeout:2", "attempts:2"]
}

sudo vi /etc/docker/daemon.json
sudo systemctl restart docker
docker run --rm alpine cat /etc/resolv.conf   # 10.0.0.2 가 보이면 성공

# docker-compose.yml
services:
  api:
    image: myorg/api:1.4.0
    dns:
      - 10.0.0.2
    dns_search:
      - example.internal

docker compose config | grep -A3 dns
docker compose up -d --force-recreate api

search default.svc.cluster.local svc.cluster.local cluster.local ap-northeast-2.compute.internal
nameserver 10.96.0.10
options ndots:5

apiVersion: apps/v1
kind: Deployment
metadata:
  name: api
spec:
  template:
    spec:
      dnsPolicy: ClusterFirst
      dnsConfig:
        options:
          - name: ndots
            value: "2"
          - name: timeout
            value: "2"
          - name: attempts
            value: "2"
      containers:
        - name: api
          image: myorg/api:1.4.0

kubectl apply -f deploy.yaml
kubectl exec -it deploy/api -- cat /etc/resolv.conf   # options ndots:2 확인

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-dns-egress
  namespace: prod
spec:
  podSelector: {}
  policyTypes:
    - Egress
  egress:
    - to:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: kube-system
          podSelector:
            matchLabels:
              k8s-app: kube-dns
      ports:
        - protocol: UDP
          port: 53
        - protocol: TCP
          port: 53

kubectl -n kube-system edit cm coredns

.:53 {
    log            # 이 줄 추가
    errors
    health
    kubernetes cluster.local in-addr.arpa ip6.arpa { pods insecure }
    forward . /etc/resolv.conf
    cache 30
}

kubectl -n kube-system rollout restart deploy/coredns
kubectl logs -n kube-system -l k8s-app=kube-dns -f | grep example.com

forward . 10.0.0.2 10.0.0.3 {
    max_concurrent 1000
}

kubectl run -it --rm dnsutils --image=registry.k8s.io/e2e-test-images/jessie-dnsutils:1.7 --restart=Never -- bash
# 안에서: dig +short kubernetes.default.svc.cluster.local ; dig +short api.example.com.

resolvectl flush-caches                     # systemd-resolved
sudo systemctl restart dnsmasq              # dnsmasq
sudo nscd -i hosts                          # nscd 사용 환경
kubectl -n kube-system rollout restart deploy/coredns   # CoreDNS

dig +noall +answer example.com
# example.com. 287 IN A 93.184.216.34   <- 287초 남음
dig +noall +answer @8.8.8.8 example.com   # 권威 경로 값과 대조

export no_proxy="localhost,127.0.0.1,.example.internal,10.0.0.0/8,.svc,.cluster.local"
export NO_PROXY="$no_proxy"

#!/usr/bin/env bash
# /usr/local/bin/dns-healthcheck.sh
set -u
TARGETS=("internal.example.internal" "example.com")
FAILED=()
for d in "${TARGETS[@]}"; do
  dig +short +time=2 +tries=1 "$d" | grep -qE '^[0-9]' || FAILED+=("$d")
done
[ ${#FAILED[@]} -eq 0 ] && exit 0
logger -t dns-healthcheck "DNS resolution failed: ${FAILED[*]}"
exit 1

sudo chmod +x /usr/local/bin/dns-healthcheck.sh
echo '*/5 * * * * root /usr/local/bin/dns-healthcheck.sh' | sudo tee /etc/cron.d/dns-healthcheck