Project: Litmus (Observability and Analysis / Chaos Engineering)
File: pod-dns-error.md

Pod-dns-error injects chaos to disrupt dns resolution in kubernetes pods. It causes loss of access to services by blocking dns resolution of hostnames/domains !!! tip "Scenario: DNS error for the target pod" ??? info "View the uses of the experiment" coming soon ??? info "Verify the prerequisites" Ensure that Kubernetes Version > 1.16 Ensure that the Litmus Chaos Operator is running by executing <code>kubectl get pods</code> in operator namespace (typically, <code>litmus</code>).If not, install from <a href="https://v1-docs.litmuschaos.io/docs/getstarted/#install-litmus">here</a> Ensure that the <code>pod-dns-error</code> experiment resource is available in the cluster by executing <code>kubectl get chaosexperiments</code> in the desired namespace. If not, install from <a href="https://hub.litmuschaos.io/api/chaos/master?file=faults/kubernetes/pod-dns-error/fault.yaml">here</a> ??? info "View the default validations" The application pods should be in running state before and after chaos injection. !!! tip "NOTE" If you are using this experiment as part of a litmus workflow scheduled constructed & executed from chaos-center, then you may be making use of the RBAC, which is pre installed in the cluster as part of the agent setup. ??? note "View the Minimal RBAC permissions" ```yaml apiVersion: v1 kind: ServiceAccount metadata: name: pod-dns-error-sa namespace: default labels: name: pod-dns-error-sa app.kubernetes.io/part-of: litmus apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: name: pod-dns-error-sa namespace: default labels: name: pod-dns-error-sa app.kubernetes.io/part-of: litmus rules: apiGroups: [""] resources: ["pods"] verbs: ["create","delete","get","list","patch","update", "deletecollection"] apiGroups: [""] resources: ["events"] verbs: ["create","get","list","patch","update"] apiGroups: [""] resources: ["configmaps"] verbs: ["get","list",] apiGroups: [""] resources: ["pods/log"] verbs: ["get","list","watch"] apiGroups: [""] resources: ["pods/exec"] verbs: ["get","list","create"] apiGroups: ["apps"] resources: ["deployments","statefulsets","replicasets", "daemonsets"] verbs: ["list","get"] apiGroups: ["apps.openshift.io"] resources: ["deploymentconfigs"] verbs: ["list","get"] apiGroups: [""] resources: ["replicationcontrollers"] verbs: ["get","list"] apiGroups: ["argoproj.io"] resources: ["rollouts"] verbs: ["list","get"] apiGroups: ["batch"] resources: ["jobs"] verbs: ["create","list","get","delete","deletecollection"] apiGroups: ["litmuschaos.io"] resources: ["chaosengines","chaosexperiments","chaosresults"] verbs: ["create","list","get","patch","update","delete"] apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: name: pod-dns-error-sa namespace: default labels: name: pod-dns-error-sa app.kubernetes.io/part-of: litmus roleRef: apiGroup: rbac.authorization.k8s.io kind: Role name: pod-dns-error-sa subjects: kind: ServiceAccount name: pod-dns-error-sa namespace: default ``` Use this sample RBAC manifest to create a chaosServiceAccount in the desired (app) namespace. This example consists of the minimum necessary role permissions to execute the experiment. ??? info "check the experiment tunables" <h2>Optional Fields</h2> <table> <tr> <th> Variables </th> <th> Description </th> <th> Notes </th> </tr> <tr> <td> TARGET_CONTAINER </td> <td> Name of container which is subjected to dns-error </td> <td> None </td> </tr> <tr> <td> TOTALCHAOSDURATION </td> <td> The time duration for chaos insertion (seconds) </td> <td> Default (60s) </td> </tr> <tr> <td> TARGET_HOSTNAMES </td> <td> List of the target hostnames or keywords

'["litmuschaos"]'</td> <td> If not provided, all hostnames/domains will be targeted</td> </tr> <tr> <td> MATCH_SCHEME </td> <td> Determines whether the dns query has to match exactly with one of the targets or can have any of the targets as substring. Can be either <code>exact</code> or <code>substring</code> </td> <td> if not provided, it will be set as <code>exact</code></td> </tr> <tr> <td> PODSAFFECTEDPERC </td> <td> The Percentage of total pods to target </td> <td> Defaults to 0 (corresponds to 1 replica), provide numeric value only </td> </tr> <tr> <td> CONTAINER_RUNTIME </td> <td> container runtime interface for the cluster</td> <td> Defaults to containerd, supported values: docker</td> </tr> <tr> <td> SOCKET_PATH </td> <td> Path of the docker socket file </td> <td> Defaults to <code>/run/containerd/containerd.sock</code> </td> </tr> <tr> <td> LIB </td> <td> The chaos lib used to inject the chaos </td> <td> Default value: litmus, supported values: litmus </td> </tr> <tr> <td> LIB_IMAGE </td> <td> Image used to run the netem command </td> <td> Defaults to </code>litmuschaos/go-runner:latest</code> </td> </tr> <tr> <td> RAMP_TIME </td> <td> Period to wait before and after injection of chaos in sec </td> <td> </td> </tr> <tr> <td> SEQUENCE </td> <td> It defines sequence of chaos execution for multiple target pods </td> <td> Default value: parallel. Supported: serial, parallel </td> </tr> </table> Refer the and to tune the common tunables for all experiments and pod specific tunables. It defines the comma-separated name of the target hosts subjected to chaos. It can be tuned with the `TARGET_HOSTNAMES` ENV. If `TARGET_HOSTNAMES`not provided then all hostnames/domains will be targeted. Use the following example to tune this: ```yaml apiVersion: litmuschaos.io/v1alpha1 kind: ChaosEngine metadata: name: engine-nginx spec: engineState: "active" annotationCheck: "false" appinfo: appns: "default" applabel: "app=nginx" appkind: "deployment" chaosServiceAccount: pod-dns-error-sa experiments: name: pod-dns-error spec: components: env: name: TARGET_HOSTNAMES value: '["litmuschaos"]' name: TOTALCHAOSDURATION value: '60' ``` It determines whether the DNS query has to match exactly with one of the targets or can have any of the targets as a substring. It can be tuned with `MATCH_SCHEME` ENV. It supports `exact` or `substring` values. Use the following example to tune this: ```yaml apiVersion: litmuschaos.io/v1alpha1 kind: ChaosEngine metadata: name: engine-nginx spec: engineState: "active" annotationCheck: "false" appinfo: appns: "default" applabel: "app=nginx" appkind: "deployment" chaosServiceAccount: pod-dns-error-sa experiments: name: pod-dns-error spec: components: env: name: MATCH_SCHEME value: 'exact' name: TOTALCHAOSDURATION value: '60' ``` It defines the `CONTAINERRUNTIME` and `SOCKETPATH` ENV to set the container runtime and socket file path. `CONTAINER_RUNTIME`: It supports `docker` runtime only. `SOCKET_PATH`: It contains path of docker socket file by default(`/run/containerd/containerd.sock`). Use the following example to tune this: ```yaml apiVersion: litmuschaos.io/v1alpha1 kind: ChaosEngine metadata: name: engine-nginx spec: engineState: "active" annotationCheck: "false" appinfo: appns: "default" applabel: "app=nginx" appkind: "deployment" chaosServiceAccount: pod-dns-error-sa experiments: name: pod-dns-error spec: components: env: name: CONTAINER_RUNTIME value: 'containerd' name: SOCKET_PATH value: '/run/containerd/containerd.sock' name: TOTALCHAOSDURATION value: '60' ```