Project: Litmus (Observability and Analysis / Chaos Engineering)
File: pod-dns-spoof.md

Pod-dns-spoof injects chaos to spoof dns resolution in kubernetes pods. It causes dns resolution of target hostnames/domains to wrong IPs as specified by SPOOF_MAP in the engine config. !!! tip "Scenario: DNS spoof for the target pod" ??? info "View the uses of the experiment" coming soon ??? info "Verify the prerequisites" Ensure that Kubernetes Version > 1.16 Ensure that the Litmus Chaos Operator is running by executing <code>kubectl get pods</code> in operator namespace (typically, <code>litmus</code>).If not, install from <a href="https://v1-docs.litmuschaos.io/docs/getstarted/#install-litmus">here</a> Ensure that the <code>pod-dns-spoof</code> experiment resource is available in the cluster by executing <code>kubectl get chaosexperiments</code> in the desired namespace. If not, install from <a href="https://hub.litmuschaos.io/api/chaos/master?file=faults/kubernetes/pod-dns-spoof/fault.yaml">here</a> ??? info "View the default validations" The application pods should be in running state before and after chaos injection. !!! tip "NOTE" If you are using this experiment as part of a litmus workflow scheduled constructed & executed from chaos-center, then you may be making use of the RBAC, which is pre installed in the cluster as part of the agent setup. ??? note "View the Minimal RBAC permissions" ```yaml apiVersion: v1 kind: ServiceAccount metadata: name: pod-dns-spoof-sa namespace: default labels: name: pod-dns-spoof-sa app.kubernetes.io/part-of: litmus apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: name: pod-dns-spoof-sa namespace: default labels: name: pod-dns-spoof-sa app.kubernetes.io/part-of: litmus rules: apiGroups: [""] resources: ["pods"] verbs: ["create","delete","get","list","patch","update", "deletecollection"] apiGroups: [""] resources: ["events"] verbs: ["create","get","list","patch","update"] apiGroups: [""] resources: ["configmaps"] verbs: ["get","list",] apiGroups: [""] resources: ["pods/log"] verbs: ["get","list","watch"] apiGroups: [""] resources: ["pods/exec"] verbs: ["get","list","create"] apiGroups: ["apps"] resources: ["deployments","statefulsets","replicasets", "daemonsets"] verbs: ["list","get"] apiGroups: ["apps.openshift.io"] resources: ["deploymentconfigs"] verbs: ["list","get"] apiGroups: [""] resources: ["replicationcontrollers"] verbs: ["get","list"] apiGroups: ["argoproj.io"] resources: ["rollouts"] verbs: ["list","get"] apiGroups: ["batch"] resources: ["jobs"] verbs: ["create","list","get","delete","deletecollection"] apiGroups: ["litmuschaos.io"] resources: ["chaosengines","chaosexperiments","chaosresults"] verbs: ["create","list","get","patch","update","delete"] apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: name: pod-dns-spoof-sa namespace: default labels: name: pod-dns-spoof-sa app.kubernetes.io/part-of: litmus roleRef: apiGroup: rbac.authorization.k8s.io kind: Role name: pod-dns-spoof-sa subjects: kind: ServiceAccount name: pod-dns-spoof-sa namespace: default ``` Use this sample RBAC manifest to create a chaosServiceAccount in the desired (app) namespace. This example consists of the minimum necessary role permissions to execute the

??? info "check the experiment tunables" <h2>Optional Fields</h2> <table> <tr> <th> Variables </th> <th> Description </th> <th> Notes </th> </tr> <tr> <td> TARGET_CONTAINER </td> <td> Name of container which is subjected to dns spoof </td> <td> None </td> </tr> <tr> <td> TOTALCHAOSDURATION </td> <td> The time duration for chaos insertion (seconds) </td> <td> Default (60s) </td> </tr> <tr> <td> SPOOF_MAP </td> <td> Map of the target hostnames eg. '{"abc.com":"spoofabc.com"}' where key is the hostname that needs to be spoofed and value is the hostname where it will be spoofed/redirected to.</td> <td> If not provided, no hostnames/domains will be spoofed</td> </tr> <tr> <td> PODSAFFECTEDPERC </td> <td> The Percentage of total pods to target </td> <td> Defaults to 0 (corresponds to 1 replica), provide numeric value only </td> </tr> <tr> <td> CONTAINER_RUNTIME </td> <td> container runtime interface for the cluster</td> <td> Defaults to containerd, supported values: docker</td> </tr> <tr> <td> SOCKET_PATH </td> <td> Path of the docker socket file </td> <td> Defaults to <code>/run/containerd/containerd.sock</code> </td> </tr> <tr> <td> LIB </td> <td> The chaos lib used to inject the chaos </td> <td> Default value: litmus, supported values: litmus </td> </tr> <tr> <td> LIB_IMAGE </td> <td> Image used to run the netem command </td> <td> Defaults to <code>litmuschaos/go-runner:latest</code> </td> </tr> <tr> <td> RAMP_TIME </td> <td> Period to wait before and after injection of chaos in sec </td> <td> </td> </tr> <tr> <td> SEQUENCE </td> <td> It defines sequence of chaos execution for multiple target pods </td> <td> Default value: parallel. Supported: serial, parallel </td> </tr> </table> Refer the and to tune the common tunables for all experiments and pod specific tunables. It defines the map of the target hostnames eg. '{"abc.com":"spoofabc.com"}' where the key is the hostname that needs to be spoofed and value is the hostname where it will be spoofed/redirected to. It can be tuned via `SPOOF_MAP` ENV. Use the following example to tune this: ```yaml apiVersion: litmuschaos.io/v1alpha1 kind: ChaosEngine metadata: name: engine-nginx spec: engineState: "active" annotationCheck: "false" appinfo: appns: "default" applabel: "app=nginx" appkind: "deployment" chaosServiceAccount: pod-dns-spoof-sa experiments: name: pod-dns-spoof spec: components: env: name: SPOOF_MAP value: '{"abc.com":"spoofabc.com"}' name: TOTALCHAOSDURATION value: '60' ``` It defines the `CONTAINERRUNTIME` and `SOCKETPATH` ENV to set the container runtime and socket file path. `CONTAINER_RUNTIME`: It supports `docker` runtime only. `SOCKET_PATH`: It contains path of docker socket file by default(`/run/containerd/containerd.sock`). Use the following example to tune this: ```yaml apiVersion: litmuschaos.io/v1alpha1 kind: ChaosEngine metadata: name: engine-nginx spec: engineState: "active" annotationCheck: "false" appinfo: appns: "default" applabel: "app=nginx" appkind: "deployment" chaosServiceAccount: pod-dns-spoof-sa experiments: name: pod-dns-spoof spec: components: env: name: CONTAINER_RUNTIME value: 'containerd' name: SOCKET_PATH value: '/run/containerd/containerd.sock' name: SPOOF_MAP value: '{"abc.com":"spoofabc.com"}' name: TOTALCHAOSDURATION value: '60' ```