Issues with Alpine and DNS in Kubernetes

[anton-johansson]

We've experienced some issues with Alpine and DNS-lookups in Kubernetes. I'm not sure exactly where the problem lies, but some DNS-lookups are really slow (and is a multiple of 2,5, indicating some sort of timeout that is being hit).

Some info can be found here:
gliderlabs/docker-alpine#255

As this seems to be a general problem for Alpine, it affects a lot of our containers. Dex is one of them. Is it possible to build Dex with another image as the base?

Or maybe someone knows a workaround that can be used?

We have a quite low refresh time (5 minute), so an LDAP call is called every 5 minutes when working with Kubernetes. This LDAP call is slow due to the slow DNS lookup.

[srenatus]

Is it possible to build Dex with another image as the base?

Which one would you prefer? Would, say, using this https://github.com/GoogleContainerTools/distroless/blob/master/base/README.md resolve the issue?

[anton-johansson]

I'm not sure actually, I'm still trying to grasp the actual problem. We'd still want a small image, of course.

The distroless looks interesting. Also, can it run from scratch? The fact that it uses Alpines DNS makes me think it cannot run from scratch? I'm not too good with these things yet, so I can't really say.

Looking at the Dockerfile, it looks like we need ca-certificates and openssl which seems hard to get with scratch.

The distroless static seems to have ca-certificates and the distroless base (which also contains all packages from static) has openssl, so it looks like a great candidate. I'll try to build it locally and see if it works.

[bonifaido]

If using scratch you need to copy the ca-certificate from the previous multi-stage build and create a static binary from Dex (if it is not static today) with CGO_ENABLED=0 so all libs will be linked statically.

We do it like this here: https://github.com/banzaicloud/pipeline/blob/master/Dockerfile#L39

[anton-johansson]

Okay, so I successfully built Dex with Google's distroless as its base. However, I'm still seeing issues with my DNS lookups. In other words, the issues I'm having is unrelated to the Alpine issue above, and there's probably an issue in my Kubernetes cluster.

I'm closing this for now, but let me know if you want me to publish a pull request for the distroless anyway. I think it has its benefits, even if it didn't solve my issue. :)