domino_admin_toolkit.checks.test_service_dns module

domino_admin_toolkit.checks.test_service_dns.build_platform_dns_targets(platform_namespace, cluster_dns_suffix=None)

Build cluster-internal FQDNs for hand-picked platform DNS targets.

Return type:

list[str]

async domino_admin_toolkit.checks.test_service_dns.query_domain(resolver, domain_name, pod_name)
async domino_admin_toolkit.checks.test_service_dns.test_external_domain(k8s_client)
Description:

Resolves a small set of external domain names through in-cluster DNS (CoreDNS/kube-dns). Per-resolver fan-out mirrors data-plane variance for external connectivity.

Failure Conditions:

  • Some external domains resolve and others do not (partial egress/DNS forwarding issue)

  • In-cluster DNS endpoints cannot be discovered

Troubleshooting Steps:

  1. Exec into a platform pod and run nslookup/dig against the failing external hostnames

  2. Verify CoreDNS forward/upstream configuration and network policies for egress DNS

  3. Check corporate proxy or firewall rules blocking outbound DNS/HTTPS

  4. Compare with test_egress HTTP connectivity for the same hosts

Resolution Steps:

  1. For internet-connected deployments: fix forwarders, egress, or proxy configuration

  2. For air-gapped deployments: all-external failure is expected; use private mirrors instead

Required Permissions:

  • Read Services/Endpoints in kube-system (DNS service discovery)

See also:

  • test_egress.py — hand-picked external allowlist and air-gapped warning pattern

  • test_coredns_clusterrole.py — CoreDNS RBAC prerequisites (different layer)

async domino_admin_toolkit.checks.test_service_dns.test_service_domain(k8s_client, platform_namespace)
Description:

Verifies cluster DNS resolves hand-picked Domino platform service FQDNs the way workloads do: a single lookup per target against the kube-dns ClusterIP VIP (not per-CoreDNS-pod fan-out).

Failure Conditions:

  • One or more platform service FQDNs do not resolve to an A record

  • kube-dns Service is missing in kube-system (malformed cluster DNS setup)

Troubleshooting Steps:

  1. kubectl get svc kube-dns -n kube-system and confirm ClusterIP is assigned

  2. kubectl exec into a nucleus-frontend pod and nslookup key platform services

  3. Check CoreDNS/kube-dns pods and logs in kube-system

  4. Review Grafana CoreDNS dashboards/alerts for per-pod health (separate from this check)

Resolution Steps:

  1. Restore kube-dns/CoreDNS service and backing pods in kube-system

  2. Fix platform Service objects or Endpoints for failing targets

  3. Validate cluster DNS suffix matches CLUSTER_DNS_SUFFIX if using a non-default domain

Required Permissions:

  • Read Services in kube-system and platform namespace

See also:

  • test_coredns_clusterrole.py — CoreDNS RBAC sibling (permissions, not resolution)

  • test_egress.py — shape mirror for hand-picked allowlist pattern