From e3f5ecd8a6f227642f4a9298263e22a7bbbe9d07 Mon Sep 17 00:00:00 2001 From: vumast3r Date: Mon, 14 Sep 2026 20:54:25 -0600 Subject: [PATCH] fix: Q37/Q114 DNS checks were unpassable - busybox ignores search domains Both checks ran `nslookup kubernetes.default` inside a busybox:1.36 pod and required it to succeed. busybox's nslookup does not apply the pod's resolv.conf `search` list - it queries the name literally - so that lookup returns NXDOMAIN no matter how correctly CoreDNS is configured. Verified in-cluster: from a pod with a correct `search default.svc.cluster.local svc.cluster.local cluster.local` and a healthy Corefile, `kubernetes`, `kubernetes.default` and `kubernetes.default.svc` all return NXDOMAIN while the full `kubernetes.default.svc.cluster.local` resolves to 10.96.0.1. The result was a task that could never score more than 3/6: the local drill history shows this check failing on 4 of 4 attempts with the Corefile fully repaired. Use the FQDN in both checks, and say so in the task text so the candidate verifies the same way the grader does. Q216 in bank_sim_a already used an FQDN; these two were the outliers. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01Fqcio9TXkEXH35UHebTgoL --- tracks/cka/bank_extra.py | 7 ++++--- tracks/cka/bank_hard.py | 8 +++++--- 2 files changed, 9 insertions(+), 6 deletions(-) diff --git a/tracks/cka/bank_extra.py b/tracks/cka/bank_extra.py index ced4a24..6800475 100644 --- a/tracks/cka/bank_extra.py +++ b/tracks/cka/bank_extra.py @@ -580,8 +580,9 @@ $K -n %{ns} delete pvc old-claim >/dev/null "params": lambda r: {"bad": r.choice(["forward . 10.255.255.1", "forward . 192.0.2.53"])}, "task": """ Pods across the cluster can no longer resolve names (in-cluster or external). -Find the cause in CoreDNS and fix it. `nslookup kubernetes.default` from any pod must work -again, and CoreDNS must be healthy. +Find the cause in CoreDNS and fix it. `nslookup kubernetes.default.svc.cluster.local` and +`nslookup kubernetes.io` from any pod must work again, and CoreDNS must be healthy. +(Use the FQDN: busybox's nslookup does not apply the pod's `search` domains.) """, "setup": r""" $K -n kube-system get cm coredns -o jsonpath='{.data.Corefile}' > /tmp/Corefile.orig @@ -594,7 +595,7 @@ $K -n kube-system rollout restart deploy coredns >/dev/null C("CoreDNS pods available", 1, r"""[ "$(j -n kube-system deploy coredns '{.status.availableReplicas}')" -ge 1 ]"""), C("in-cluster and external names resolve from a pod", 3, r""" $K -n default delete pod dns-probe --ignore-not-found --wait=true >/dev/null 2>&1 -$K -n default run dns-probe --image=busybox:1.36 --restart=Never -- sh -c 'for i in 1 2 3 4 5 6; do nslookup kubernetes.default >/dev/null 2>&1 && nslookup kubernetes.io >/dev/null 2>&1 && echo OK && exit 0; sleep 5; done; exit 1' >/dev/null 2>&1 +$K -n default run dns-probe --image=busybox:1.36 --restart=Never -- sh -c 'for i in 1 2 3 4 5 6; do nslookup kubernetes.default.svc.cluster.local >/dev/null 2>&1 && nslookup kubernetes.io >/dev/null 2>&1 && echo OK && exit 0; sleep 5; done; exit 1' >/dev/null 2>&1 for i in $(seq 1 20); do ph=$(j -n default pod dns-probe '{.status.phase}'); [ "$ph" = Succeeded ] && { $K -n default delete pod dns-probe --wait=false >/dev/null; exit 0; }; [ "$ph" = Failed ] && break; sleep 3; done $K -n default delete pod dns-probe --wait=false >/dev/null; exit 1"""), ], diff --git a/tracks/cka/bank_hard.py b/tracks/cka/bank_hard.py index b348f5a..77c7b5f 100644 --- a/tracks/cka/bank_hard.py +++ b/tracks/cka/bank_hard.py @@ -470,8 +470,10 @@ sys.exit(0 if ok else 1)'"""), "params": lambda r: {"ctx": "k8s-c1-H"}, "task": CTX + """ Nothing in the cluster resolves DNS. Restore it. There is more than one cause. -When done, `nslookup kubernetes.default` and `nslookup kubernetes.io` must succeed from a pod -in `default`, CoreDNS must have 2 available replicas, and no NetworkPolicy may remain in `kube-system`. +When done, `nslookup kubernetes.default.svc.cluster.local` and `nslookup kubernetes.io` must +succeed from a pod in `default` (use the FQDN: busybox's nslookup does not apply the pod's +`search` domains), CoreDNS must have 2 available replicas, and no NetworkPolicy may remain in +`kube-system`. """, "setup": r""" $K -n kube-system get cm coredns -o jsonpath='{.data.Corefile}' > /tmp/Corefile.q114 @@ -491,7 +493,7 @@ EOF C("no NetworkPolicy in kube-system", 1, r"""[ "$($K -n kube-system get netpol --no-headers 2>/dev/null | wc -l)" = 0 ]"""), C("resolution works from a pod", 3, r""" $K -n default delete pod dns-probe --ignore-not-found --wait=true >/dev/null 2>&1 -$K -n default run dns-probe --image=busybox:1.36 --restart=Never -- sh -c 'for i in 1 2 3 4 5 6; do nslookup kubernetes.default >/dev/null 2>&1 && nslookup kubernetes.io >/dev/null 2>&1 && exit 0; sleep 5; done; exit 1' >/dev/null 2>&1 +$K -n default run dns-probe --image=busybox:1.36 --restart=Never -- sh -c 'for i in 1 2 3 4 5 6; do nslookup kubernetes.default.svc.cluster.local >/dev/null 2>&1 && nslookup kubernetes.io >/dev/null 2>&1 && exit 0; sleep 5; done; exit 1' >/dev/null 2>&1 for i in $(seq 1 20); do ph=$(j -n default pod dns-probe '{.status.phase}'); [ "$ph" = Succeeded ] && { $K -n default delete pod dns-probe --wait=false >/dev/null; exit 0; }; [ "$ph" = Failed ] && break; sleep 3; done $K -n default delete pod dns-probe --wait=false >/dev/null; exit 1"""), ],