feat: force fqdn dns request for cloudwatch resolution by fluentbit TDE-1093 #499
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
paulfouquet
requested review from
l0b0,
blacha,
amfage,
MDavidson17 and
Wentao-Kuang
paulfouquet
commented
Mar 28, 2024
l0b0
approved these changes
Mar 28, 2024
l0b0
reviewed
Mar 28, 2024
amfage
approved these changes
Apr 2, 2024
l0b0
approved these changes
Apr 3, 2024
paulfouquet
deleted the
feat/fluentbit-use-fqdn-for-cloudwatch-endpoint-tde-1093
branch
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Motivation
Inside kubernetes, DNS resolution uses ndots: 5 this means any dns requests that has less than 5 dots will go through all the search domains before looking up the actual domain. AWS Cloudwatch
logs.ap-southeast-2.amazonaws.comhas 3 dots.Modification
Hardcode the Cloudwatch endpoint to
logs.ap-southeast-2.amazonaws.com.so DNS requests to Cloudwatch force the DNS lookup to be fully qualified.This has been tested on a non prod cluster and we've seen a reduction of the DNS queries to the
corednsChecklist