unkin/argocd-apps
3
0
Fork 0
Code Issues 7 Pull Requests 8 Actions Packages Projects Releases Wiki Activity

bind-resolvers: stop querying IPv6 nameservers #553

Merged
benvin merged 1 commits from benvin/bind-resolvers-v4-only into main 2026-10-16 22:34:48 +11:00
Conversation 1 Commits 1 Files Changed 1
+2
unkin-agent commented 2026-10-16 22:26:32 +11:00
Member
Copy Link
Copy Source

The in-cluster BIND resolvers have no IPv6 route but still try every AAAA nameserver. Each attempt fails with "network unreachable" yet counts toward the per-query recursion budget, so cold lookups of names with many dual-stack NS (registry.opentofu.org, cloudfront, crates.io, gcr.io) hit quota reached and SERVFAIL, surfacing as transient DNS errors in CI.

  • mark all IPv6 servers bogus in the openforwarder view so recursion is IPv4-only
The in-cluster BIND resolvers have no IPv6 route but still try every AAAA nameserver. Each attempt fails with "network unreachable" yet counts toward the per-query recursion budget, so cold lookups of names with many dual-stack NS (registry.opentofu.org, cloudfront, crates.io, gcr.io) hit `quota reached` and SERVFAIL, surfacing as transient DNS errors in CI. - mark all IPv6 servers bogus in the openforwarder view so recursion is IPv4-only
unkin-agent added 1 commit 2026-10-16 22:26:32 +11:00
bind-resolvers: stop querying IPv6 nameservers
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
ci/woodpecker/pr/kubeconform Pipeline was successful
Details
1c50c3317b
unkin-agent commented 2026-10-16 22:27:08 +11:00
Author
Member
Copy Link
Copy Source

No findings.

No findings.
benvin merged commit 9188ef9ac3 into main 2026-10-16 22:34:48 +11:00
benvin deleted branch benvin/bind-resolvers-v4-only 2026-10-16 22:34:49 +11:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
benvin (BenVincent) unkin-agent (Unkin Agent) unkinben (Ben Vincent)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unkin/argocd-apps#553
Delete Branch "benvin/bind-resolvers-v4-only"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?