Get Your CertCKAPlayCompete
‹ All CKA questions

CKA Practice Question 9: Cross Namespace DNS Resolution

Certified Kubernetes Administrator (CKA) · Test 1 · question 9 of 10

Cluster DNSmedium

An application Pod running in the web namespace fails to connect to a database using the hostname db. From a shell inside that same Pod, resolving db.prod.svc.cluster.local succeeds and returns the correct ClusterIP. The db Service exists in the prod namespace and has healthy endpoints, and the CoreDNS pods are Running and Ready.

What is the most likely explanation?

Select one answer
Show answer and explanation

Answer:

  • B. The Pod's DNS search list only covers its own namespace, so the short name db is never expanded to the Service in prod

Cluster DNS resolves short names using the search domains the kubelet writes into the Pod's /etc/resolv.conf. For a Pod in the web namespace those are web.svc.cluster.local, svc.cluster.local, and cluster.local. Looking up db therefore tries db.web.svc.cluster.local first and never db.prod.svc.cluster.local, so a Service of the same name in a different namespace is invisible to the short form. The fix is to use the qualified name db.prod or the full db.prod.svc.cluster.local, which is exactly why the stem says the FQDN already works.

Option A describes configuration that does not exist. The CoreDNS kubernetes plugin serves the whole cluster.local zone for every namespace; namespaces are never enumerated in the Corefile.

Option C misuses ExternalName, which aliases a name to an external DNS record and has no selector or endpoints. Ordinary ClusterIP Services are already resolvable from any namespace by their qualified name, and converting the Service would break the working FQDN lookup.

Option D contradicts the stem, which states the Service has healthy endpoints, and the successful FQDN resolution proves the DNS record exists. Cluster DNS does not apply different rules to short names; the expansion happens on the client side, before the query is ever sent.

Reference: DNS for Services and Pods

Practice Test 1 ›

Study guides for CKA

Docker interview questions: commands, scenarios, experiencedDocker interview questions with answers: Dockerfiles and builds, run and debug commands, networking, volumes, Compose, security, and Docker vs Kubernetes.
Kubernetes interview questions: scenarios for experiencedScenario-based Kubernetes interview questions for experienced engineers: CrashLoopBackOff, DNS, RBAC, drains and etcd, with the commands and fixes.
Best DevOps certification: AWS, Azure, Google or CKAThe best DevOps certification for your stack: AWS DOP-C02, Azure AZ-400, Google Cloud DevOps Engineer and CKA compared on cost, level and prerequisites.
CKA exam guide: price, voucher, booking and what it testsThe CKA exam explained: the $445 price, what the voucher includes, how to book it with PSI, the five domains and how to prepare for the hands-on tasks.
Best Kubernetes certification: CKA vs CKAD vs CKSWhich Kubernetes certification to take first - CKA, CKAD or CKS compared on format, cost, prerequisites and role, plus KCNA and KCSA for beginners.
Kubernetes NetworkPolicy, explained for CKA, CKAD and CKSHow NetworkPolicy isolation works, why policies only add allows, the namespaceSelector AND/OR trap, DNS egress, and what your CNI has to support.
Kubernetes Service types, Ingress and Gateway APIClusterIP, NodePort, LoadBalancer, ExternalName and headless Services, how selectors build endpoints, and how to debug a Service for CKA and CKAD.