Skip to main content

Pod DNS Spoof

Introduction

  • Pod-dns-spoof injects chaos to spoof dns resolution in kubernetes pods.
  • It causes dns resolution of target hostnames/domains to wrong IPs as specified by SPOOF_MAP in the engine config.
Fault execution flow chart

Pod DNS Spoof

Uses

View the uses of the fault
Coming soon.

Prerequisites

info
  • Ensure that Kubernetes Version > 1.16.

Default Validations

note

The application pods should be in running state before and after chaos injection.

Fault Tunables

Check the Fault Tunables

Optional Fields

Variables Description Notes
TARGET_CONTAINER Name of container which is subjected to dns spoof None
TOTAL_CHAOS_DURATION The time duration for chaos insertion (seconds) Default (60s)
SPOOF_MAP Map of the target hostnames eg. '{"abc.com":"spoofabc.com"}' where key is the hostname that needs to be spoofed and value is the hostname where it will be spoofed/redirected to. If not provided, no hostnames/domains will be spoofed
PODS_AFFECTED_PERC The Percentage of total pods to target Defaults to 0 (corresponds to 1 replica), provide numeric value only
CONTAINER_RUNTIME container runtime interface for the cluster Defaults to docker, supported values: docker
SOCKET_PATH Path of the docker socket file Defaults to /var/run/docker.sock
LIB The chaos lib used to inject the chaos Default value: litmus, supported values: litmus
LIB_IMAGE Image used to run the netem command Defaults to litmuschaos/go-runner:latest
RAMP_TIME Period to wait before and after injection of chaos in sec Eg. 30
SEQUENCE It defines sequence of chaos execution for multiple target pods Default value: parallel. Supported: serial, parallel

Fault Examples

Common and Pod specific tunables

Refer the common attributes and Pod specific tunable to tune the common tunables for all fault and pod specific tunables.

Spoof Map

It defines the map of the target hostnames eg. '{"abc.com":"spoofabc.com"}' where the key is the hostname that needs to be spoofed and value is the hostname where it will be spoofed/redirected to. It can be tuned via SPOOF_MAP ENV.

Use the following example to tune this:

# contains the spoof map for the dns spoofing
apiVersion: litmuschaos.io/v1alpha1
kind: ChaosEngine
metadata:
name: engine-nginx
spec:
engineState: "active"
annotationCheck: "false"
appinfo:
appns: "default"
applabel: "app=nginx"
appkind: "deployment"
chaosServiceAccount: litmus-admin
experiments:
- name: pod-dns-spoof
spec:
components:
env:
# map of host names
- name: SPOOF_MAP
value: '{"abc.com":"spoofabc.com"}'
- name: TOTAL_CHAOS_DURATION
value: '60'

Container Runtime Socket Path

It defines the CONTAINER_RUNTIME and SOCKET_PATH ENV to set the container runtime and socket file path.

  • CONTAINER_RUNTIME: It supports docker runtime only.
  • SOCKET_PATH: It contains path of docker socket file by default(/var/run/docker.sock).

Use the following example to tune this:

## provide the container runtime and socket file path
apiVersion: litmuschaos.io/v1alpha1
kind: ChaosEngine
metadata:
name: engine-nginx
spec:
engineState: "active"
annotationCheck: "false"
appinfo:
appns: "default"
applabel: "app=nginx"
appkind: "deployment"
chaosServiceAccount: litmus-admin
experiments:
- name: pod-dns-spoof
spec:
components:
env:
# runtime for the container
# supports docker
- name: CONTAINER_RUNTIME
value: 'docker'
# path of the socket file
- name: SOCKET_PATH
value: '/var/run/docker.sock'
# map of host names
- name: SPOOF_MAP
value: '{"abc.com":"spoofabc.com"}'
- name: TOTAL_CHAOS_DURATION
VALUE: '60'