Resolvers

DNS resolvers are used by Talos to resolve domain names into IP addresses. By default, Talos will use DNS resolvers 8.8.8.8 and 1.1.1.1, and DNS servers might be provided via DHCP or cloud platform metadata.

Configuration

To configure custom DNS resolvers, create a ResolverConfig document like this:

apiVersion: v1alpha1
kind: ResolverConfig
nameservers:
    - address: 10.0.0.1
    - address: 2001:4860:4860::8888
searchDomains: # optional
    domains:
        - example.org
        - example.com
    disableDefault: false

The nameservers field is a list of DNS server IP addresses that Talos will use for DNS resolution. The searchDomains field allows you to specify search domains that will be appended to unqualified domain names during DNS resolution, the default search domains is to use the domain part of the machine’s hostname. The disableDefault field, when set to true, prevents Talos from using the default search domains derived from the machine’s hostname. See Host DNS for more information about DNS resolution in Talos.

Encrypted DNS (DoT and DoH)

Each nameserver can be queried over an encrypted transport instead of plain DNS, by setting the protocol and tlsServerName fields:

apiVersion: v1alpha1
kind: ResolverConfig
hostDNS:
    enabled: true
nameservers:
    - address: 1.1.1.1
      protocol: DoH
      tlsServerName: cloudflare-dns.com
    - address: 9.9.9.9
      protocol: DoT
      tlsServerName: dns.quad9.net

The protocol field accepts:

Do53 (the default): plain DNS over UDP/TCP port 53.
DoT: DNS over TLS over TCP port 853.
DoH: DNS over HTTPS over TCP port 443.

The tlsServerName field is required for DoT and DoH, and must be empty for Do53. The address field always stays an IP address: Talos connects to that address directly, and tlsServerName is only used as the TLS SNI and the name verified against the server certificate (and, for DoH, as the host part of the request URL https://<tlsServerName>/dns-query), so encrypted DNS never needs a bootstrap resolver. The protocol is configured per nameserver, so plain and encrypted nameservers can be mixed in a single ResolverConfig. Encrypted DNS is implemented by the host DNS caching resolver, so hostDNS.enabled must be true; a configuration which uses DoT or DoH without host DNS is rejected. See Host DNS for the way encrypted upstreams are used, and for the interaction with time synchronization.

Observing status

Use talosctl to get the current resolver configuration of a node:

talosctl get resolvers

NODE         NAMESPACE   TYPE             ID          VERSION   RESOLVERS        SEARCH DOMAINS
172.20.0.2   network     ResolverStatus   resolvers   4         ["172.20.0.1"]   []

The RESOLVERS column only lists the nameserver addresses; the protocol and TLS server name of each nameserver are visible in the full resource:

talosctl get resolvers -o yaml

# ...
spec:
    dnsServers:
        - 1.1.1.1
        - 9.9.9.9
    nameServers:
        - addr: 1.1.1.1
          protocol: DoH
          tlsServerName: cloudflare-dns.com
        - addr: 9.9.9.9
          protocol: DoT
          tlsServerName: dns.quad9.net
    searchDomains: []

To see all resolver configuration sources, use the following:

talosctl get resolverspec --namespace=network-config

NODE         NAMESPACE        TYPE           ID                       VERSION   LAYER      RESOLVERS               SEARCH DOMAINS
172.20.0.2   network-config   ResolverSpec   default/resolvers        1         default    ["1.1.1.1","8.8.8.8"]
172.20.0.2   network-config   ResolverSpec   dhcp4/enp0s2/resolvers   1         operator   ["172.20.0.1"]

⌘I

Overview

Getting Started

Platform specific installation

Deploying and managing workloads

Networking

Security

Build and extend Talos

Configure your Talos cluster

Advanced guides

Reference

Troubleshooting and support

Learn more

Configuration

Encrypted DNS (DoT and DoH)

Observing status

​Configuration

​Encrypted DNS (DoT and DoH)

​Observing status

Configuration

Encrypted DNS (DoT and DoH)

Observing status