{"action":"created","issue":{"url":"https://api.github.com/repos/linkerd/linkerd2/issues/1798","repository_url":"https://api.github.com/repos/linkerd/linkerd2","labels_url":"https://api.github.com/repos/linkerd/linkerd2/issues/1798/labels{/name}","comments_url":"https://api.github.com/repos/linkerd/linkerd2/issues/1798/comments","events_url":"https://api.github.com/repos/linkerd/linkerd2/issues/1798/events","html_url":"https://github.com/linkerd/linkerd2/issues/1798","id":373224693,"node_id":"MDU6SXNzdWUzNzMyMjQ2OTM=","number":1798,"title":"proxy: Canonicalize names through DNS","user":{"login":"olix0r","id":240738,"node_id":"MDQ6VXNlcjI0MDczOA==","avatar_url":"https://avatars3.githubusercontent.com/u/240738?v=4","gravatar_id":"","url":"https://api.github.com/users/olix0r","html_url":"https://github.com/olix0r","followers_url":"https://api.github.com/users/olix0r/followers","following_url":"https://api.github.com/users/olix0r/following{/other_user}","gists_url":"https://api.github.com/users/olix0r/gists{/gist_id}","starred_url":"https://api.github.com/users/olix0r/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/olix0r/subscriptions","organizations_url":"https://api.github.com/users/olix0r/orgs","repos_url":"https://api.github.com/users/olix0r/repos","events_url":"https://api.github.com/users/olix0r/events{/privacy}","received_events_url":"https://api.github.com/users/olix0r/received_events","type":"User","site_admin":false},"labels":[{"id":773709989,"node_id":"MDU6TGFiZWw3NzM3MDk5ODk=","url":"https://api.github.com/repos/linkerd/linkerd2/labels/area/proxy","name":"area/proxy","color":"0052CC","default":false}],"state":"open","locked":false,"assignee":{"login":"olix0r","id":240738,"node_id":"MDQ6VXNlcjI0MDczOA==","avatar_url":"https://avatars3.githubusercontent.com/u/240738?v=4","gravatar_id":"","url":"https://api.github.com/users/olix0r","html_url":"https://github.com/olix0r","followers_url":"https://api.github.com/users/olix0r/followers","following_url":"https://api.github.com/users/olix0r/following{/other_user}","gists_url":"https://api.github.com/users/olix0r/gists{/gist_id}","starred_url":"https://api.github.com/users/olix0r/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/olix0r/subscriptions","organizations_url":"https://api.github.com/users/olix0r/orgs","repos_url":"https://api.github.com/users/olix0r/repos","events_url":"https://api.github.com/users/olix0r/events{/privacy}","received_events_url":"https://api.github.com/users/olix0r/received_events","type":"User","site_admin":false},"assignees":[{"login":"olix0r","id":240738,"node_id":"MDQ6VXNlcjI0MDczOA==","avatar_url":"https://avatars3.githubusercontent.com/u/240738?v=4","gravatar_id":"","url":"https://api.github.com/users/olix0r","html_url":"https://github.com/olix0r","followers_url":"https://api.github.com/users/olix0r/followers","following_url":"https://api.github.com/users/olix0r/following{/other_user}","gists_url":"https://api.github.com/users/olix0r/gists{/gist_id}","starred_url":"https://api.github.com/users/olix0r/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/olix0r/subscriptions","organizations_url":"https://api.github.com/users/olix0r/orgs","repos_url":"https://api.github.com/users/olix0r/repos","events_url":"https://api.github.com/users/olix0r/events{/privacy}","received_events_url":"https://api.github.com/users/olix0r/received_events","type":"User","site_admin":false}],"milestone":null,"comments":1,"created_at":"2018-10-23T22:11:51Z","updated_at":"2018-11-02T17:53:46Z","closed_at":null,"author_association":"MEMBER","body":"## Background\r\n\r\nAs the proxy processes HTTP requests, it determines a destination Authority\r\nas follows:\r\n\r\n1. If the request is HTTP/2, its `:authority` is used;\r\n2. Or if the request is HTTP/1, the `Host` header is used (if present);\r\n3. Otherwise the `SO_ORIGINAL_DST` IP address is used.\r\n4. The `SO_ORIGINAL_DST`'s port is appended if it is not the protocol's default port (i.e., 80).\r\n\r\nThe host values obtained from request headers may likely be in a relative form. For instance, in Kubernetes, applications within the same namespace may refer to each other by their single-label service names. For example, a request may be sent to _voting:8080_, while the canonical form is\r\n_voting.emojivoto.svc.cluster.local:8080_.\r\n\r\nThe destination service cannot properly handle relative names (e.g. _voting:8080_), since it would need the proxy' pod's full DNS configuration to effectively replicate the client's behavior.\r\n\r\nCurrently, the proxy implements a Kubernetes-specific workaround that tries to coerce names into the form:\r\n\r\n    _service_ . _namespace_ . svc.cluster.local\r\n\r\nIf the proxy cannot normalize the name to a Kubernetes-form authority and resolve it via the Destination service, then the proxy resolves the name via DNS (as the application already did).\r\n\r\nThis logic is implemented in the proxy's controller client in such a way that the rest of the routing stack (including tap and metrics ) never knows how the name was resolved or what the canonical-form name is in either case.\r\n\r\n## Problems\r\n\r\n1. This logic is fragile and highly coupled to the default Kubernetes cluster configuration. It definitely will not work with the destination service in non-Kubernetes environments; and nor will it work in any cluster that uses a non-default DNS scheme.\r\n2. As the proxy begins to attach policy to destination names (via service profiles), it's important for us to establish clear, predictable rules for name normalization.\r\n\r\n## Proposal: Use DNS\r\n\r\nWe expect that, in order to establish a connection to a server, applications are already performing DNS resolution in the pod. That is, they are loading up /etc/resolv.conf and navigating the search path as dictated by the relevant RFCs. And, in fact, this is exactly what TrustDNS does for us in the proxy today when resolution falls back to DNS.\r\n\r\nI propose that the proxy _always_ perform DNS resolution to determine the canonical name for each relative host routed out of the proxy and that this value be added as `l5d-dst-authority` header so that the inbound router need not reverse-engineer this value on the inbound side, where DNS resolution may\r\nbe configured so that the name is not normalized as the client intended it.\r\n\r\nThis would be implemented as a new set of stack modules that, after routing by the non-normalized authority, performs DNS resolution to determine the normalized name, and then routes on this name. This actual addresses resolved can basically be discarded at this point.\r\n\r\nFurthermore, the proxy should be configured with a list of DNS name suffixes\r\nfor which the destination service should be consulted for resolution:\r\n\r\n- `LINKERD2_PROXY_DESTINATION_GET_SUFFIXES`\r\n- `LINKERD2_PROXY_DESTINATION_PROFILE_SUFFIXES`\r\n\r\nA value of `.` indicates that _all_ names should be considered; and an empty\r\nvalue indicates that _no_ names should be considered.\r\n\r\n### Later\r\n\r\nLater, we can intercept TCP/UDP 53 and implement our own DNS service so that\r\nwe can pre-load routing information on name resolution."},"comment":{"url":"https://api.github.com/repos/linkerd/linkerd2/issues/comments/435459592","html_url":"https://github.com/linkerd/linkerd2/issues/1798#issuecomment-435459592","issue_url":"https://api.github.com/repos/linkerd/linkerd2/issues/1798","id":435459592,"node_id":"MDEyOklzc3VlQ29tbWVudDQzNTQ1OTU5Mg==","user":{"login":"olix0r","id":240738,"node_id":"MDQ6VXNlcjI0MDczOA==","avatar_url":"https://avatars3.githubusercontent.com/u/240738?v=4","gravatar_id":"","url":"https://api.github.com/users/olix0r","html_url":"https://github.com/olix0r","followers_url":"https://api.github.com/users/olix0r/followers","following_url":"https://api.github.com/users/olix0r/following{/other_user}","gists_url":"https://api.github.com/users/olix0r/gists{/gist_id}","starred_url":"https://api.github.com/users/olix0r/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/olix0r/subscriptions","organizations_url":"https://api.github.com/users/olix0r/orgs","repos_url":"https://api.github.com/users/olix0r/repos","events_url":"https://api.github.com/users/olix0r/events{/privacy}","received_events_url":"https://api.github.com/users/olix0r/received_events","type":"User","site_admin":false},"created_at":"2018-11-02T17:53:46Z","updated_at":"2018-11-02T17:53:46Z","author_association":"MEMBER","body":"Related: https://github.com/bluejekyll/trust-dns/pull/601"}}
{"actor":{"display_login":"olix0r"}}