Pod DNS Spoof

Introduction

• Pod-dns-spoof injects chaos to spoof dns resolution in kubernetes pods.
• It causes dns resolution of target hostnames/domains to wrong IPs as specified by SPOOF_MAP in the engine config.

Fault execution flow chart

Uses

View the uses of the fault

Coming soon.

Prerequisites

info

• Ensure that Kubernetes Version > 1.16.

Default Validations

note

The application pods should be in running state before and after chaos injection.

Fault Tunables

Check the Fault Tunables

Optional Fields

Variables	Description	Notes
TARGET_CONTAINER	Name of container which is subjected to dns spoof	None
TOTAL_CHAOS_DURATION	The time duration for chaos insertion (seconds)	Default (60s)
SPOOF_MAP	Map of the target hostnames eg. '{"abc.com":"spoofabc.com"}' where key is the hostname that needs to be spoofed and value is the hostname where it will be spoofed/redirected to.	If not provided, no hostnames/domains will be spoofed
PODS_AFFECTED_PERC	The Percentage of total pods to target	Defaults to 0 (corresponds to 1 replica), provide numeric value only
CONTAINER_RUNTIME	container runtime interface for the cluster	Defaults to docker, supported values: docker
SOCKET_PATH	Path of the docker socket file	Defaults to /var/run/docker.sock
LIB	The chaos lib used to inject the chaos	Default value: litmus, supported values: litmus
LIB_IMAGE	Image used to run the netem command	Defaults to litmuschaos/go-runner:latest
RAMP_TIME	Period to wait before and after injection of chaos in sec	Eg. 30
SEQUENCE	It defines sequence of chaos execution for multiple target pods	Default value: parallel. Supported: serial, parallel

Fault Examples

Common and Pod specific tunables

Refer the common attributes and Pod specific tunable to tune the common tunables for all fault and pod specific tunables.

Spoof Map

It defines the map of the target hostnames eg. '{"abc.com":"spoofabc.com"}' where the key is the hostname that needs to be spoofed and value is the hostname where it will be spoofed/redirected to. It can be tuned via SPOOF_MAP ENV.

Use the following example to tune this:

# contains the spoof map for the dns spoofing
apiVersion: litmuschaos.io/v1alpha1
kind: ChaosEngine
metadata:
  name: engine-nginx
spec:
  engineState: "active"
  annotationCheck: "false"
  appinfo:
    appns: "default"
    applabel: "app=nginx"
    appkind: "deployment"
  chaosServiceAccount: litmus-admin
  experiments:
  - name: pod-dns-spoof
    spec:
      components:
        env:
        # map of host names
        - name: SPOOF_MAP
          value: '{"abc.com":"spoofabc.com"}'
        - name: TOTAL_CHAOS_DURATION
          value: '60'

Container Runtime Socket Path

It defines the CONTAINER_RUNTIME and SOCKET_PATH ENV to set the container runtime and socket file path.

• CONTAINER_RUNTIME: It supports docker runtime only.
• SOCKET_PATH: It contains path of docker socket file by default(/var/run/docker.sock).

Use the following example to tune this:

## provide the container runtime and socket file path
apiVersion: litmuschaos.io/v1alpha1
kind: ChaosEngine
metadata:
  name: engine-nginx
spec:
  engineState: "active"
  annotationCheck: "false"
  appinfo:
    appns: "default"
    applabel: "app=nginx"
    appkind: "deployment"
  chaosServiceAccount: litmus-admin
  experiments:
  - name: pod-dns-spoof
    spec:
      components:
        env:
        # runtime for the container
        # supports docker
        - name: CONTAINER_RUNTIME
          value: 'docker'
        # path of the socket file
        - name: SOCKET_PATH
          value: '/var/run/docker.sock'
        # map of host names
        - name: SPOOF_MAP
          value: '{"abc.com":"spoofabc.com"}'
        - name: TOTAL_CHAOS_DURATION
          VALUE: '60'