From ec497069523cc19145382360b26f5f0a763287f7 Mon Sep 17 00:00:00 2001 From: Gabriel Radureau Date: Fri, 24 Jul 2026 10:13:41 +0200 Subject: [PATCH] =?UTF-8?q?fix(dns):=20import=20coredns=20custom=20*.serve?= =?UTF-8?q?r=20blocks=20at=20Corefile=20root=20=E2=80=94=20inside=20.:53?= =?UTF-8?q?=20it=20crashes=20CoreDNS?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The never-yet-applied k3s_dns.yml placed 'import /etc/coredns/custom/*.server' INSIDE the .:53 server block. *.server files hold full server blocks (arcodange.lab:53 {…}), which only parse at Corefile root — inside a block CoreDNS dies at startup with "Unknown directive 'arcodange.lab:53'" (CrashLoopBackOff, cluster DNS fully down; lived it on 2026-07-24 while restoring the expired *.arcodange.lab certificate). Also restores the stock 'loadbalance' plugin dropped by the playbook. Context: cluster CoreDNS forwarded to the node's resolv.conf, which lists the ISP box's IPv6 RDNSS next to the Pi-holes — NXDOMAIN roulette for *.lab names. That's what left step-issuer unable to reach ssl-ca.arcodange.lab:8443 and let the 24h wildcard cert expire this morning. The (fixed) playbook pins .lab resolution to the Pi-holes via the coredns-custom ConfigMap; applied live on 2026-07-24, wildcard renewed, strict TLS verified on gitea/argocd/grafana. Co-Authored-By: Claude Fable 5 --- ansible/arcodange/factory/playbooks/system/k3s_dns.yml | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/ansible/arcodange/factory/playbooks/system/k3s_dns.yml b/ansible/arcodange/factory/playbooks/system/k3s_dns.yml index 7053914..3dcd86e 100644 --- a/ansible/arcodange/factory/playbooks/system/k3s_dns.yml +++ b/ansible/arcodange/factory/playbooks/system/k3s_dns.yml @@ -54,7 +54,11 @@ cache 30 loop reload + loadbalance import /etc/coredns/custom/*.override - import /etc/coredns/custom/*.server forward . {{ pihole_ips | map('regex_replace', '^(.*)$', '\1:53') | join(' ') }} } + # Les fichiers *.server contiennent des BLOCS SERVEUR complets (ex: `arcodange.lab:53 {…}`) : + # leur import doit vivre au niveau racine du Corefile. À l'intérieur de `.:53 {}`, + # CoreDNS crashe au parse (« Unknown directive 'arcodange.lab:53' ») — vécu le 2026-07-24. + import /etc/coredns/custom/*.server -- 2.54.0