How CoreDNS and kubelet Configure /etc/resolv.conf in Kubernetes Pods

CoreDNS Overview

In a Kubernetes cluster, container workloads resolve domain names via the CoreDNS service. CoreDNS is built on the Caddy framework, running as a Go‑written HTTP/2 web server. It uses a plugin‑chain architecture configured through a ConfigMap, executing plugins in order and exposing DNS over TCP, UDP, gRPC, and HTTPS.

How kubelet modifies /etc/resolv.conf

CoreDNS communicates with the kube‑apiserver to obtain the mapping between Service names and their ClusterIP. CoreDNS itself is reachable at its ClusterIP (for example, 10.247.3.10). Since the operating system resolver reads the nameserver field from /etc/resolv.conf, kubelet injects the CoreDNS ClusterIP into each container’s /etc/resolv.conf.

The injection is performed by kubelet when it starts a pod; the --cluster-dns flag supplies the CoreDNS ClusterIP, and kubelet writes this value into the pod’s resolv.conf according to the pod’s dnsPolicy setting.

Effect of different dnsPolicy values

Default : The pod inherits the node’s /etc/resolv.conf nameserver entries.

# Node /etc/resolv.conf
nameserver X.X.X.X
nameserver X.X.X.Y
options ndots:5 timeout:2 single-request-reopen

ClusterFirst : The pod’s /etc/resolv.conf is populated with the CoreDNS service IP and a standard search list.

nameserver 10.247.3.10
search default.svc.cluster.local svc.cluster.local cluster.local
options ndots:5 timeout:2 single-request-reopen

ClusterFirstWithHostNet : For pods using hostNetwork, the DNS policy must be explicitly set to ClusterFirstWithHostNet; otherwise the combination behaves like Default.

nameserver 10.247.3.10
search default.svc.cluster.local svc.cluster.local cluster.local
options ndots:5 timeout:2 single-request-reopen

None : Allows full customisation of the pod’s /etc/resolv.conf via the dnsConfig field, bypassing Kubernetes defaults.

/etc/resolv.conf fields explained

nameserver: IP address of the DNS server used for name resolution.
search: List of domain suffixes appended during lookup, e.g., svcname.default.svc.cluster.local → svcname.svc.cluster.local → svcname.cluster.local.
options:
  - ndots:n   Treat a name as fully qualified if it contains at least n dots.
  - timeout:s   Seconds to wait for a DNS response before retrying.