惯性聚合 高效追踪和阅读你感兴趣的博客、新闻、科技资讯
阅读原文 在惯性聚合中打开

推荐订阅源

C
Cybersecurity and Infrastructure Security Agency CISA
D
Darknet – Hacking Tools, Hacker News & Cyber Security
cs.CL updates on arXiv.org
cs.CL updates on arXiv.org
S
Schneier on Security
L
Lohrmann on Cybersecurity
S
Securelist
P
Palo Alto Networks Blog
SecWiki News
SecWiki News
T
Troy Hunt's Blog
H
Hacker News: Front Page
AWS News Blog
AWS News Blog
Latest news
Latest news
Hacker News - Newest:
Hacker News - Newest: "LLM"
NISL@THU
NISL@THU
The Hacker News
The Hacker News
F
Full Disclosure
让小产品的独立变现更简单 - ezindie.com
让小产品的独立变现更简单 - ezindie.com
大猫的无限游戏
大猫的无限游戏
O
OpenAI News
P
Proofpoint News Feed
Know Your Adversary
Know Your Adversary
G
GRAHAM CLULEY
博客园_首页
Attack and Defense Labs
Attack and Defense Labs
cs.CV updates on arXiv.org
cs.CV updates on arXiv.org
Security Latest
Security Latest
云风的 BLOG
云风的 BLOG
K
Kaspersky official blog
WordPress大学
WordPress大学
www.infosecurity-magazine.com
www.infosecurity-magazine.com
宝玉的分享
宝玉的分享
L
LINUX DO - 热门话题
博客园 - 叶小钗
L
LINUX DO - 最新话题
Martin Fowler
Martin Fowler
N
News | PayPal Newsroom
Project Zero
Project Zero
OSCHINA 社区最新新闻
OSCHINA 社区最新新闻
PCI Perspectives
PCI Perspectives
月光博客
月光博客
IT之家
IT之家
Recent Announcements
Recent Announcements
T
The Exploit Database - CXSecurity.com
D
DataBreaches.Net
J
Java Code Geeks
酷 壳 – CoolShell
酷 壳 – CoolShell
Last Week in AI
Last Week in AI
Google Online Security Blog
Google Online Security Blog
C
CXSECURITY Database RSS Feed - CXSecurity.com
钛媒体:引领未来商业与生活新知
钛媒体:引领未来商业与生活新知

Plugin on CoreDNS: DNS and Service Discovery

kubernetes log proxyproto rewrite forward clouddns errors grpc_server https https3 docker auto geoip multisocket nomad dnstap import ready etcd header bind grpc file prometheus quic kubeforward JSON gslb autopath dnssec root fanout k8s_cache bufsize k8s_external reload gathersrv meship meshname multicluster acl cache recursor health trace k8s_event redis route53 dns64 finalize kubenodes ebpf rrl secondary mysql warnlist loop minimal sign azure git local any cancel debug erratic metadata nsid pprof alternate k8s_dns_chaos records k8s_gateway hosts netbox mdns wgsd alias chaos whoami lighthouse ens idetcd gravwell amazondns kubernetai redisc unbound on dump pdsql ipin Logging with dnstap demo example When Should Plugins be External? Add External Plugins How Queries Are Processed in CoreDNS How to Add Plugins to CoreDNS Writing Plugins for CoreDNS
loadbalance
2025-09-10 · via Plugin on CoreDNS: DNS and Service Discovery

Description

The loadbalance will act as a round-robin DNS load balancer by randomizing the order of A, AAAA, and MX records in the answer.

See Wikipedia about the pros and cons of this setup. It will take care to sort any CNAMEs before any address records, because some stub resolver implementations (like glibc) are particular about that.

Syntax

loadbalance [round_robin | weighted WEIGHTFILE] {
			reload DURATION
			prefer CIDR [CIDR...]
}
  • round_robin policy randomizes the order of A, AAAA, and MX records applying a uniform probability distribution. This is the default load balancing policy.

  • weighted policy assigns weight values to IPs to control the relative likelihood of particular IPs to be returned as the first (top) A/AAAA record in the answer. Note that it does not shuffle all the records in the answer, it is only concerned about the first A/AAAA record returned in the answer.

Additionally, the plugin supports subnet-based ordering using the prefer directive, which reorders A/AAAA records so that IPs from preferred subnets appear first.

  • WEIGHTFILE is the file containing the weight values assigned to IPs for various domain names. If the path is relative, the path from the root plugin will be prepended to it. The format is explained below in the Weightfile section.

  • DURATION interval to reload WEIGHTFILE and update weight assignments if there are changes in the file. The default value is 30s. A value of 0s means to not scan for changes and reload.

Weightfile

The generic weight file syntax:

# Comment lines are ignored

domain-name1
ip11 weight11
ip12 weight12
ip13 weight13

domain-name2
ip21 weight21
ip22 weight22
# ... etc.

where ipXY is an IP address for domain-nameX and weightXY is the weight value associated with that IP. The weight values are in the range of [1,255].

The weighted policy selects one of the address record in the result list and moves it to the top (first) position in the list. The random selection takes into account the weight values assigned to the addresses in the weight file. If an address in the result list is associated with no weight value in the weight file then the default weight value “1” is assumed for it when the selection is performed.

Examples

Load balance replies coming back from Google Public DNS:

. {
    loadbalance round_robin
    forward . 8.8.8.8 8.8.4.4
}

Use the weighted strategy to load balance replies supplied by the file plugin. We assign weight vales 3, 1 and 2 to the IPs 100.64.1.1, 100.64.1.2 and 100.64.1.3, respectively. These IPs are addresses in A records for the domain name www.example.com defined in the ./db.example.com zone file. The ratio between the number of answers in which 100.64.1.1, 100.64.1.2 or 100.64.1.3 is in the top (first) A record should converge to 3 : 1 : 2. (E.g. there should be twice as many answers with 100.64.1.3 in the top A record than with 100.64.1.2). Corefile:

example.com {
        file ./db.example.com {
                reload 10s
        }
        loadbalance weighted ./db.example.com.weights {
                    reload 10s
        }
}

weight file ./db.example.com.weights:

www.example.com
100.64.1.1 3
100.64.1.2 1
100.64.1.3 2

Subnet Prioritization

Prioritize IPs from 10.9.20.0/24 and 192.168.1.0/24:

. {
    loadbalance round_robin {
        prefer 10.9.20.0/24 192.168.1.0/24
    }
    forward . 1.1.1.1
}

If the DNS response includes multiple A/AAAA records, the plugin will reorder them to place the ones matching preferred subnets first.