It Is Always DNS… Even at the Edge: Taming Proxy-Only Lookups Wi... Hector Monsalve & Thomas Gosteli

Why It Matters

It enables secure, uniform edge deployments across regulated sites without custom firewall changes, preserving application reliability and compliance.

Key Takeaways

• Edge Kubernetes clusters require proxy-aware DNS resolution for applications.
• Selium service mesh redirects traffic via network policies and Envoy.
• DNS over HTTPS used to bypass restrictive customer firewalls.
• CoreDNS lacks native support for forwarding DoH traffic.
• Caching mitigates latency introduced by cloud‑based DNS resolution.

Summary

The session details Rush’s internal platform team tackling edge‑centric Kubernetes deployments, focusing on a stubborn DNS problem that emerged when customer firewalls restrict egress and provide DNS servers that cannot resolve public domains. By leveraging Selium’s service‑mesh capabilities, the team routes all outbound traffic through a controlled HTTP proxy, ensuring compliance with strict firewall rules while keeping applications oblivious to the underlying network complexities. Key insights include the use of Selium network policies to capture traffic, redirect it to Envoy configurations, and tunnel DNS queries over HTTPS (DoH) when CoreDNS returns NXDOMAIN responses. Because CoreDNS cannot forward DoH natively, a custom DNS‑over‑HTTPS proxy forwards queries to Cloudflare, then the response is sent back through the same proxy chain, preserving a single 443‑port allowance. During the live demo, the team showed a three‑container lab: a Kind cluster with CoreDNS pointing to a non‑resolving upstream, an HTTP proxy, and a DoH proxy. When a pod queried rush.com, the initial NXDOMAIN triggered the fallback to the DoH proxy, which resolved the name via Cloudflare and returned it to the application, illustrating the end‑to‑end flow. The approach eliminates per‑customer network tweaks, maintains security postures, and demonstrates how service‑mesh‑driven traffic redirection can solve edge DNS challenges. Caching at the proxy layer mitigates added latency, making the solution viable for regulated healthcare environments.

Original Description

Connect with our current graduated, incubating, and sandbox projects as the community gathers to further the education and advancement of cloud native computing. Learn more at https://kubecon.io

It Is Always DNS… Even at the Edge: Taming Proxy-Only Lookups With Cilium and eBPF - Hector Monsalve, Roche & Thomas Gosteli, TactumMotum GmbH

Hoffmann-La Roche is leveraging the power of eBPF, Cilium, and Envoy to solve complex real-world DNS challenges in highly protected environments like laboratories and hospitals.

Going beyond basic connectivity, we'll dive into our most recent edge networking hurdle: customer DNS resolvers explicitly block public domain resolution, forcing all external lookups to occur exclusively through their HTTP forward proxies, and how we overcame this constraint by leveraging Cilium's advanced network policy traffic redirect capabilities, combined with some advanced CoreDNS filtering.

We will conclude with a live, high-wire demonstration. If the demo gods are on our side, you'll see these advanced Cilium features put into practice to instantly and reliably solve the DNS-over-Proxy challenge.