Consul
Enable Consul DNS proxy for Kubernetes
This page describes the process to deploy a Consul DNS proxy in a Kubernetes Pod so that Services can resolve Consul DNS requests. For more information, refer to Consul DNS views for Kubernetes.
Prerequisites
You must meet the following minimum application versions to enable the Consul DNS proxy for Kubernetes:
- Consul v1.20.0 or higher
- Either Consul on Kubernetes or the Consul Helm chart, v1.6.0 or higher
Update Helm values
To enable the Consul DNS proxy, add the required Helm values to your Consul on Kubernetes deployment:
connectInject:
enabled: true
dns:
enabled: true
proxy: true
ACLs
We recommend you create a dedicated ACL token with DNS permissions for the Consul DNS proxy. The Consul DNS proxy requires the following ACL permissions:
node_prefix "" {
policy = "read"
}
service_prefix "" {
policy = "read"
}
You can manage ACL tokens with Consul on Kubernetes, or you can configure the DNS proxy to access a token stored in Kubernetes secret. To use a Kubernetes secret, add the following configuration to your Helm chart:
dns:
proxy:
aclToken:
secretName: <Consul-DNS-Token>
secretKey: <Token-Value>
Retrieve Consul DNS proxy's address
To look up the IP address for the Consul DNS proxy in the Kubernetes Pod, run the following command:
$ kubectl get services –-all-namespaces
NAMESPACE NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
consul consul-connect-injector ClusterIP 10.96.41.171 <none> 443/TCP 12m
consul consul-dns ClusterIP 10.96.148.46 <none> 53/TCP,53/UDP 12m
default kubernetes ClusterIP 10.96.0.1 <none> 443/TCP 21m
kube-system kube-dns ClusterIP 10.96.0.10 <none> 53/UDP,53/TCP,9153/TCP 21m
Note the CLUSTER-IP
for the consul-dns
service. Use this address when you update the ConfigMap resource.
Update Kubernetes ConfigMap
Create or update a ConfigMap object in the Kubernetes cluster so that Kubernetes forwards DNS requests with the .consul
domain to the IP address of the Consul DNS proxy.
The following example of a ConfigMap resource configures Kubernetes to forward Consul DNS requests in the cluster to the Consul DNS Proxy running on 10.150.0.1
.
apiVersion: v1
kind: ConfigMap
metadata:
name: coredns
namespace: kube-system
data:
Corefile: |
.:53 {
errors
health
kubernetes cluster.local in-addr.arpa ip6.arpa {
pods insecure
fallthrough in-addr.arpa ip6.arpa
}
prometheus :9153
forward . 172.16.0.1
cache 30
loop
reload
loadbalance
}
consul.local:53 {
errors
cache 30
forward . 10.150.0.1
}
For information about the other fields in this ConfigMap, refer to the Kubernetes documentation.
Next steps
After you enable the Consul DNS proxy, services in the Kubernetes cluster can resolve Consul DNS addresses.
- To learn more about Consul DNS for service discovery, refer to DNS usage overview.
- If your datacenter has ACLs enabled, create a Consul ACL token for the Consul DNS proxy and then restart the DNS proxy.
- To enable service discovery across admin partitions, export services between partitions.
- To use Consul DNS for service discovery with other runtimes, across cloud regions, or between cloud providers, establish a cluster peering connection.