domino_admin_toolkit.checks.test_service_dns module

async domino_admin_toolkit.checks.test_service_dns.query_domain(resolver, domain_name, pod_name)
async domino_admin_toolkit.checks.test_service_dns.test_external_domain(k8s_client)
Description:

Resolves a small set of external domain names through in-cluster DNS (CoreDNS/kube-dns). Per-resolver fan-out mirrors data-plane variance for external connectivity.

Failure Conditions:

  • Some external domains resolve and others do not (partial egress/DNS forwarding issue)

  • In-cluster DNS endpoints cannot be discovered

Troubleshooting Steps:

  1. Exec into a platform pod and run nslookup/dig against the failing external hostnames

  2. Verify CoreDNS forward/upstream configuration and network policies for egress DNS

  3. Check corporate proxy or firewall rules blocking outbound DNS/HTTPS

  4. Compare with test_egress HTTP connectivity for the same hosts

Resolution Steps:

  1. For internet-connected deployments: fix forwarders, egress, or proxy configuration

  2. For air-gapped deployments: all-external failure is expected; use private mirrors instead

Required Permissions:

  • Read Services/Endpoints in kube-system (DNS service discovery)

See also:

  • test_egress.py — hand-picked external allowlist and air-gapped warning pattern

  • test_coredns_clusterrole.py — CoreDNS RBAC prerequisites (different layer)

async domino_admin_toolkit.checks.test_service_dns.test_service_domain(k8s_client, platform_namespace)
Description:

Verifies cluster DNS resolves hand-picked Domino platform service FQDNs the way workloads do: a single lookup per target against the kube-dns ClusterIP VIP (not per-CoreDNS-pod fan-out).

Failure Conditions:

  • One or more platform service FQDNs do not resolve to an A record

  • kube-dns Service is missing in kube-system (malformed cluster DNS setup)

  • None of the allowlisted platform Services exist in the platform namespace (wrong namespace or empty install; list-Services RBAC denial errors earlier)

Troubleshooting Steps:

  1. kubectl get svc kube-dns -n kube-system and confirm ClusterIP is assigned

  2. kubectl get svc -n <platform_namespace> and confirm nucleus/auth/data Services exist

  3. kubectl exec into a nucleus-frontend pod and nslookup key platform services

  4. Check CoreDNS/kube-dns pods and logs in kube-system

  5. Review Grafana CoreDNS dashboards/alerts for per-pod health (separate from this check)

Resolution Steps:

  1. Restore kube-dns/CoreDNS service and backing pods in kube-system

  2. Confirm platform_namespace if zero allowlist targets were listed; 403 on list Services is a separate error

  3. Fix platform Service objects or Endpoints for failing targets

  4. Validate cluster DNS suffix matches CLUSTER_DNS_SUFFIX if using a non-default domain

Required Permissions:

  • Read Services in kube-system and platform namespace

See also:

  • test_coredns_clusterrole.py — CoreDNS RBAC sibling (permissions, not resolution)

  • test_egress.py — shape mirror for hand-picked allowlist pattern