dnsmasq on the infra node forwards queries to itself: resolv.conf lists admin_ip first and dnsmasq.conf has no no-resolv

Đang mở
  • Có gì không ổn?
#790 0 bình luận 0 reaction 0 người được giao Xem trên GitHub

Chưa có ai nhận issue này.

Đánh giá

Độ khó
4/5
Thời gian dự kiến
3-5 ngày
Mức phù hợp với người mới
55/100
Loại issue
Lỗi
Độ rõ ràng
Đặc tả rõ ràng
Mức độ hoạt động
Sôi nổi
Công nghệ
linux, ubuntu
Lĩnh vực
infrastructure, networking

Hướng nghiên cứu

Start with roles/node/tasks/dns.yml and roles/infra/templates/dns/dnsmasq.conf, then compare the generated resolv.conf and dnsmasq configuration on an infra node. Define the upstream-variable behavior described in the issue and verify that dnsmasq uses only the configured upstreams, internal names still resolve, and parallel uncached queries remain reliable.

Do mô hình lập chỉ mục viết ra từ nội dung của issue.

Mô tả

Summary

On the infra node, dnsmasq uses itself as an upstream server. node_dns_method: add writes admin_ip at the top of /etc/resolv.conf, and the generated dnsmasq.conf has no no-resolv, so dnsmasq reads that file and forwards to its own address. On Ubuntu, systemd-resolved picks up the same file and forwards back to dnsmasq, which closes a second loop.

A single query gets through. A burst of queries does not: every apt update on the node leaves dnsmasq unable to answer for about a minute, internal *.pigsty names included.

Environment
Pigsty v4.5.0 (template unchanged on main)
OS Ubuntu 24.04 LTS
dnsmasq 2.91
systemd 255 (systemd-resolved active)
Node DNS defaults: node_dns_method: add, node_dns_servers: ['${admin_ip}']
Root cause

roles/node/tasks/dns.yml renders, on the infra node itself:

options single-request-reopen timeout:1
nameserver 10.0.0.1        # admin_ip, i.e. this node's dnsmasq
nameserver 127.0.0.53      # systemd-resolved stub

roles/infra/templates/dns/dnsmasq.conf keeps no-resolv and server= commented out, so dnsmasq takes its upstreams from that file:

dnsmasq[846]: reading /etc/resolv.conf
dnsmasq[846]: using nameserver 10.0.0.1#53
dnsmasq[846]: using nameserver 127.0.0.53#53

dnsmasq normally ignores a nameserver that matches a local address. Here it does not, because the listen address sits on an interface that comes up after dnsmasq starts (the bind-dynamic case from #761).

Because /etc/resolv.conf is now a regular file and no longer the stub symlink, systemd-resolved reads it as foreign configuration and uses 10.0.0.1 as its global DNS server (resolvectl dns shows Global: 10.0.0.1). The result is two loops: dnsmasq to dnsmasq, and dnsmasq to resolved to dnsmasq.

Symptoms

Tracing one uncached query on port 53 shows it bouncing between 127.0.0.1, the node address and the stub before it leaves the host. It still resolves in about 13 ms, which is why nothing looks broken.

Under a burst it breaks. Every morning at the apt-daily run and at any other apt update, systemd-resolved logs:

systemd-resolved: Using degraded feature set UDP instead of UDP+EDNS0 for DNS server 10.0.0.1.

A probe querying dnsmasq directly (dig @127.0.0.1) gets no answer for about a minute, for internal names as well as external ones. It recovers on its own. dnsmasq never restarts, so no failed unit shows up.

Workaround we run

The template already declares conf-dir=/etc/dnsmasq.d, and no Pigsty role cleans that directory, so we add a file there instead of patching the template:

# /etc/dnsmasq.d/10-upstream.conf
no-resolv
server=<upstream 1>
server=<upstream 2>

server= alone is not enough. The dnsmasq man page says it "does not suppress reading of /etc/resolv.conf": that takes no-resolv. Pointing resolv-file= at /run/systemd/resolve/resolv.conf does not help either, since resolved lists the node address there too.

After a restart, dnsmasq logs only the two upstreams. Internal names answer on both listen addresses. apt-get update with a parallel dig loop loses no answer. A burst of 300 uncached names, 50 at a time, gets 300 answers, and an internal name still resolves in the middle of it. systemd-resolved no longer logs "degraded feature set".

Suggestion

An infra variable for dnsmasq upstreams would fix this without touching /etc/resolv.conf. When set, the template would render no-resolv and one server= per entry. For example, dns_upstreams: [] would keep today's behaviour, and a list such as dns_upstreams: [1.1.1.1, 8.8.8.8] would switch to explicit forwarding.

Another option: skip admin_ip in node_dns_servers when the node is itself an infra node. That removes the self reference but keeps the resolved loop, so the variable looks like the more complete fix.

Happy to test a patch on this setup.

Ngôn ngữ chính
Shell
Star
5.9k
Fork
396
Merge trung bình
4 ngày 15 giờ
Pull request đã merge (30 ngày)
3

Chuẩn bị môi trường

Bắt đầu từ đâu

  1. Đọc hết issue, rồi đọc hướng dẫn đóng góp của dự án.
  2. Bình luận trên issue rằng bạn sẽ nhận — tránh hai người làm cùng một việc.
  3. Fork repository và làm thay đổi trên một nhánh.
  4. Mở pull request có tham chiếu số hiệu của issue.

Issue khác của pgsty/pigsty

Tất cả issue của pgsty/pigsty

Issue tương tự

Thêm issue về Shell/Bash

Nhận issue mới trong hộp thư của bạn

Bản tóm tắt ngắn những issue GitHub phù hợp với người mới.