A high-performance, recursive DNS resolver server with DNSSEC support, focused on preserving privacy.
This project is maintained by semihalev
A high-performance, production-ready Kubernetes DNS middleware implementation for SDNS that provides full compatibility with Kubernetes DNS specifications.
service.namespace.svc.cluster.local → Service ClusterIPpod-ip.namespace.pod.cluster.local → Pod IP10-244-1-1.namespace.pod.cluster.local2001-db8--1.namespace.pod.cluster.localpod-name.service.namespace.svc.cluster.local_port._protocol.service.namespace.svc.cluster.local1.0.96.10.in-addr.arpa → service/pod domain1.0...0.2.ip6.arpa → service/pod domainWhen killer_mode is enabled in the [kubernetes] configuration section, the middleware activates advanced performance features:
┌─────────────────┐
│ SDNS Core │
└────────┬────────┘
│
┌────────▼────────────────────────────┐
│ Kubernetes Middleware │
│ ┌──────────────────────────────┐ │
│ │ Killer Mode Components │ │
│ │ • Zero-Alloc Cache │ │
│ │ • ML Predictor │ │
│ │ • Sharded Registry │ │
│ └──────────────────────────────┘ │
└────────┬────────────────────────────┘
│
┌────┴────┬──────────┬──────────┐
│ │ │ │
┌───▼───┐ ┌──▼───┐ ┌────▼────┐ ┌───▼────┐
│Resolver│ │Cache │ │Registry │ │K8s │
│ │ │ │ │ │ │Client │
└────────┘ └──────┘ └─────────┘ └────────┘
kubernetes.go - Main middleware implementation with killer mode logicresolver.go - DNS query resolution and response buildingclient.go - Kubernetes API client with watch handlerstypes.go - Service, Pod, and Endpoint data structureszero_alloc_cache.go - Wire-format caching implementationpredictor.go - Lock-free ML prediction enginesharded_registry.go - Concurrent sharded storageregistry.go - Standard registry implementationipv6_support.go - IPv6 query handling and response buildingipv6_utils.go - IPv6 address parsing and formattingcache.go - Standard TTL-based DNS cache*_test.go - Comprehensive test suite (80%+ coverage)test_helpers.go - Mock DNS writer and utilitiescoverage_test.go - Additional coverage testsfinal_coverage_test.go - Edge case testingAdd to your SDNS configuration:
# Kubernetes middleware configuration
[kubernetes]
# Enable Kubernetes DNS middleware
enabled = true
# Kubernetes cluster domain suffix
cluster_domain = "cluster.local" # Default: cluster.local
# Enable killer mode for maximum performance
killer_mode = true # Default: false
# Optional: specify kubeconfig path
# kubeconfig = "/path/to/kubeconfig" # Uses in-cluster config by default
The middleware automatically:
# Service lookup
dig @localhost service-name.namespace.svc.cluster.local
# Pod by IP
dig @localhost 10-244-1-1.namespace.pod.cluster.local
# SRV record
dig @localhost _http._tcp.service-name.namespace.svc.cluster.local SRV
# Reverse lookup
dig @localhost -x 10.96.0.1
# IPv6 service
dig @localhost service-name.namespace.svc.cluster.local AAAA
Current test coverage: 80.0%
All major Kubernetes DNS patterns are tested:
# Run all tests with race detection
make test
# Run specific test
go test -v -race -run TestName
# Check coverage
go test -cover -coverprofile=coverage.out
go tool cover -html=coverage.out
Contributions are welcome! Please:
This middleware is part of SDNS and follows the same license terms.
In standard mode, the middleware provides reliable Kubernetes DNS resolution with:
When killer_mode = true, the middleware switches to high-performance mode:
The middleware can operate in three modes:
enabled = false, the middleware returns nil (not loaded)kubeconfig is specified, it uses that configurationWhen running inside a Kubernetes cluster, SDNS needs the following permissions:
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: sdns-kubernetes-dns
rules:
- apiGroups: [""]
resources: ["services", "pods"]
verbs: ["get", "list", "watch"]
- apiGroups: ["discovery.k8s.io"]
resources: ["endpointslices"]
verbs: ["get", "list", "watch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: sdns-kubernetes-dns
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: sdns-kubernetes-dns
subjects:
- kind: ServiceAccount
name: sdns
namespace: sdns-system
apiVersion: v1
kind: Namespace
metadata:
name: sdns-system
---
apiVersion: v1
kind: ServiceAccount
metadata:
name: sdns
namespace: sdns-system
---
apiVersion: v1
kind: ConfigMap
metadata:
name: sdns-config
namespace: sdns-system
data:
sdns.toml: |
version = "1.6.0"
bind = ":53"
directory = "/var/lib/sdns"
[kubernetes]
enabled = true
cluster_domain = "cluster.local"
killer_mode = true
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: sdns
namespace: sdns-system
spec:
replicas: 1
selector:
matchLabels:
app: sdns
template:
metadata:
labels:
app: sdns
spec:
serviceAccountName: sdns
containers:
- name: sdns
image: ghcr.io/semihalev/sdns:latest
ports:
- containerPort: 53
protocol: UDP
name: dns-udp
- containerPort: 53
protocol: TCP
name: dns-tcp
volumeMounts:
- name: config
mountPath: /etc/sdns
- name: data
mountPath: /var/lib/sdns
args: ["-c", "/etc/sdns/sdns.toml"]
volumes:
- name: config
configMap:
name: sdns-config
- name: data
emptyDir: {}
enabled = true in the [kubernetes] sectionSDNS exposes Prometheus metrics that include DNS query statistics:
# Access Prometheus metrics endpoint
curl http://localhost:8080/metrics
The metrics include:
dns_queries_total - Total DNS queries by query type and response codeThe Kubernetes middleware maintains internal statistics accessible through the Stats() method:
These statistics are used internally and logged periodically when killer mode is enabled.
This implementation provides a blazing-fast, production-ready Kubernetes DNS middleware for SDNS. It handles all standard Kubernetes DNS patterns while offering an optional “killer mode” that leverages advanced techniques like zero-allocation caching, ML-based prediction, and lock-free data structures to achieve exceptional performance that makes CoreDNS look slow.
The middleware is designed to be a drop-in solution for Kubernetes DNS needs, with automatic fallback mechanisms ensuring it works in any environment - from production Kubernetes clusters to local development setups.