Free lesson · CKAD Prep Program · Module 6: Services and networking

Use DNS for Service Discovery

Hardcoded IPs rot; DNS names follow the Services. This lesson resolves every name shape, discovers peers headlessly, reads SRV records, and debugs the failures.

10 min reading

Objectives

Resolve short names, namespace names and FQDNs from inside pods
Discover peers through headless Services for stateful clients
Read SRV records for named ports without hardcoding numbers
Diagnose NXDOMAIN back to namespace versus CoreDNS causes

Why this matters

Service discovery is DNS plus conventions, and apps that resolve correctly survive rescheduling, scaling and namespace moves that kill hardcoded peers. The developer contract is small: use the right name shape, read the records that exist, and handle NXDOMAIN as configuration, not catastrophe.

Concepts

Inside a pod, api means this namespace's Service; api.billing crosses namespaces; api.billing.svc.cluster.local is the FQDN that works from anywhere including odd resolv.conf setups. Headless Services return A records per ready pod instead of one virtual IP: stateful clients iterate peers directly. SRV records (_http._tcp.api) publish named ports so clients discover numbers instead of assuming 80.

Environment variables (HOST plus PORT per Service) are the legacy alternative: static at pod start, blind to later Services. Prefer DNS, which stays current. NXDOMAIN splits cleanly: wrong namespace or typo (your bug, FQDN test proves it) versus CoreDNS down or misconfigured (platform bug, kube-system drill proves it).

Worked example

Billing peers discover each other headlessly, ports via SRV:

# headless service over the 3 billing pods
kubectl get endpoints billing-peers   # three pod addresses
kubectl exec -it app-xxx -- nslookup billing-peers
# Name: billing-peers.default.svc.cluster.local
# Addresses: 10.244.1.8, 10.244.2.5, 10.244.3.2
kubectl exec -it app-xxx -- nslookup -type=SRV _http._tcp.api
# api.default.svc.cluster.local port 8080: no hardcoded port in code
# cross-namespace from another team:
kubectl exec -it other-xxx -- nslookup api.billing

Each shape proven where it runs: short at home, dotted across, FQDN everywhere, SRV for ports. Code carries names; numbers come from records.

Exam notes

ndots:5 makes short names try local search domains first: multi-label externals resolve oddly unless trailing-dot FQDNs. Headless plus ClusterIP confusion inverts answers: virtual IP versus peer list is the whole distinction. And DNS caching in app runtimes (JVM especially) freezes discovery: short TTLs plus re-resolution belong in client config, not cluster tickets.

Quick check

A 4-question self-check. Your answers stay on your device, are never stored or sent. Only a passing score (for example 3 of 4) is saved, and only to unlock lesson progress: at least 3 correct is required before a lesson counts as complete. It never counts toward any certification assessment.

Lesson feedback

No published feedback yet.

Exercise

Resolve a fictional app's four dependencies (same-namespace service, cross-namespace service, headless peers, SRV port) from inside a pod with the exact commands plus expected outputs. Break one with a wrong namespace and show the NXDOMAIN proof plus fix.

Pass criteria

All four shapes resolved with correct commands and outputs; the breakage shows NXDOMAIN with the namespace fix, not a platform drill.