Remove the 'dns.podman' search domain from cluster nodes' resolv.conf#198
Merged
ggiguash merged 2 commits intomicroshift-io:mainfrom Feb 24, 2026
Merged
Conversation
|
Caution Review failedThe pull request is closed. ℹ️ Recent review infoConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughAdds a dns search option into the Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Suggested reviewers
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
kasturinarra
force-pushed
the
fix_issue_dns_cncf
branch
2 times, most recently
from
0fa9e00 to
5a6cbae
Compare
ggiguash
reviewed
Feb 11, 2026
kasturinarra
force-pushed
the
fix_issue_dns_cncf
branch
23 times, most recently
from
b877fac to
664a371
Compare
kasturinarra
changed the title
kasturinarra
force-pushed
the
fix_issue_dns_cncf
branch
3 times, most recently
from
aa67315 to
c0181c9
Compare
kasturinarra
changed the title
Author
|
successful run log with the fix https://github.com/kasturinarra/microshiftupstream/actions/runs/22141562154/job/64006884058 |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/cncf-conformance.yaml:
- Around line 105-108: The sed command in the microshift node loop can leave a
bare "search" line (invalid) when "search dns.podman" is the only entry; update
the sed expression used in the loop (the command executed inside the podman exec
for nodes microshift-okd-1 and microshift-okd-2) to also delete lines matching a
bare "search" (e.g., adding a `/^search[[:space:]]*$/d` clause) and ensure the
loop uses a per-node echo similar to the firewalld block so each node’s change
is logged; locate the loop that runs podman exec and the sed call and add the
deletion clause and per-node echo there.
c0181c9 to
d3161f5
Compare
ggiguash
changed the title
ggiguash
reviewed
Feb 18, 2026
ggiguash
reviewed
Feb 18, 2026
kasturinarra
force-pushed
the
fix_issue_dns_cncf
branch
2 times, most recently
from
4df89bd to
4c3e97a
Compare
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@src/cluster_manager.sh`:
- Line 129: The --dns-search option is being added unconditionally and breaks
isolated-network clusters because Podman forbids --dns-search with --network
none; update the node creation logic (where network_name is used, e.g., in
_add_node and callers like cluster_create) to only append the --dns-search
option when network_name != "none" (or when ISOLATED_NETWORK is not set), i.e.,
guard the DNS-related flags behind a conditional that skips adding --dns-search
for the "none" network.
Remove podman's 'dns.podman' search domain to fix DNS conformance tests. The extra search domain triggers a dig 9.9.5 TCP+search bug that causes 3 DNS tests to fail.
kasturinarra
force-pushed
the
fix_issue_dns_cncf
branch
from
4c3e97a to
9b3ceff
Compare
There was a problem hiding this comment.
🧹 Nitpick comments (1)
src/cluster_manager.sh (1)
113-120: Previous critical concern resolved; optional: guard onnetwork_nameinstead of env var.The
ISOLATED_NETWORK="0"guard correctly keepsdns_optsempty when--network noneis in use, fixing the past incompatibility. Works as-is today.Optionally, tying the guard directly to the
network_nameparameter (rather than the ambient env var) makes_add_nodemore self-contained and safe against future callers:♻️ Proposed refactor — guard on the local parameter
local network_opts="--network ${network_name}" local dns_opts="" if [ "${ISOLATED_NETWORK}" = "0" ]; then network_opts="${network_opts} --ip ${ip_address}" + fi + if [ "${network_name}" != "none" ]; then # Prevent podman from adding 'dns.podman' to the container's # /etc/resolv.conf search domains. The extra search domain # breaks CNCF DNS conformance tests with older dig versions. dns_opts="--dns-search=." fi🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@src/cluster_manager.sh` around lines 113 - 120, Change the ISOLATED_NETWORK check to use the local parameter so _add_node is self-contained: instead of testing ISOLATED_NETWORK, guard on network_name (the function parameter) — e.g., only append to network_opts and set dns_opts="--dns-search=." when network_name is not "none". Update the branch that currently references ISOLATED_NETWORK to use network_name, keeping the same updates to network_opts and dns_opts; leave behavior for the isolated/none network unchanged.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Nitpick comments:
In `@src/cluster_manager.sh`:
- Around line 113-120: Change the ISOLATED_NETWORK check to use the local
parameter so _add_node is self-contained: instead of testing ISOLATED_NETWORK,
guard on network_name (the function parameter) — e.g., only append to
network_opts and set dns_opts="--dns-search=." when network_name is not "none".
Update the branch that currently references ISOLATED_NETWORK to use
network_name, keeping the same updates to network_opts and dns_opts; leave
behavior for the isolated/none network unchanged.
Author
Since this works fine now and in the future, let me not modify any of the existing code ? |
ggiguash
reviewed
Feb 19, 2026
ggiguash
approved these changes
Feb 24, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #186
Podman adds 'dns.podman' to /etc/resolv.conf inside containers, creating a 4th search domain beyond the standard 3Kubernetes domains.This triggers a bug in dig 9.9.5 (from jessie-dnsutils:1.7, used by the CNCF e2e DNS conformance tests). The e2e tests run: dig +tcp +noall +answer +search With 4 search domains and ndots:5, dig iterates through all search domains over TCP (all return NXDOMAIN) but fails to fall back to the bare FQDN, producing empty output. The test only writes its result file when dig output is non-empty, so TCP DNS results are never recorded and 3 DNS conformance tests timeout after 10 minutes. Removing 'dns.podman' restores the standard 3-search-domain layout where dig's TCP+search fallback works correctly.
Summary by CodeRabbit
Bug Fixes
Chores