ISOC-IL’s engineering team presented a new approach to incorporating Kubernetes (K8s) and DevOps procedures into authoritative DNS systems at CENTR’s 25th R&D and 51st Tech Workshops in Frankfurt. Their research explored methods to implement authoritative NS instances as K8s pods, offering an alternative to traditional ANYCAST solutions. During the workshop, Meir Kraushar and Alexey Terentiev presented two distinct implementations that address the fundamental challenge of reconciling dynamic infrastructure with the traditionally conservative DNS structure.
Conservative Integration: Cloud-based Distribution Master
The first approach, implemented in Digital Ocean, represents a conservative cloud integration strategy. At its core, this implementation utilizes a cloud-based distribution master (DM) to receive zones from the master server. The system employs NFS shared volume to simultaneously share zone data with multiple pods, while sidecar containers actively monitor changes and trigger zone reloads when necessary. Ingress traffic is handled through a traditional load balancer service operating on UDP/TCP port 53, ensuring distribution of DNS queries across the pod network.
DevOps Integration – GitOps-based workflow
The second approach, implemented in AWS, embraces DevOps practices using git-ops and argoCD . This implementation completely reimagines traditional zone transfers by integrating with GitHub and establishing a comprehensive CI/CD pipeline for zone updates. The system automatically builds and deploys new container images whenever zones are updated, ensuring consistent distribution across the infrastructure. The multi-region deployment capability is achieved through AWS Global Accelerator, with current deployments spanning EU Central and US West Coast regions. This setup enables BGP-based routing, directing queries to the nearest DNS instance for optimal performance.
Comparative Advantages and Consideration for Future Implementation
Both approaches demonstrate a new possible alternative to the traditional ANYCAST implementation. While establishing your own anycast network is a complex and costly operation, this approach allows flexibility in deploying an alternative on your own: new clusters or regions, with the ability to scale horizontally at pod, node, cluster and even region levels. The architectures support seamless integration with existing “on-prem” infrastructure through hybrid models, while providing enhanced control over zone distribution and updates. The operational aspects benefit from dynamic resource allocation capabilities and additional monitoring tools, allowing organizations to respond quickly to changing demands while maintaining visibility into system performance.
While traditional anycast remains a solid, proven solution with affordable onboarding costs, this research demonstrates that Kubernetes-based DNS deployment in the cloud offers compelling advantages in terms of operational flexibility and management simplicity. The cost structure differs significantly from traditional implementations, with considerations including baseline cloud computing expenses, traffic volume charges, and substantial pricing variations between providers.
The research suggests that while cloud providers are yet to fully prove themselves in DNS production environments, their integration with modern DevOps practices and infrastructure-as-code principles opens new possibilities for organizations seeking greater control over their DNS infrastructure. Technical implementation requires careful attention to DDoS protection strategies. Cloud provider capabilities vary significantly in this regard. While AWS Global Accelerator offers comprehensive DNS traffic support, GCP’s global load balancer currently lacks UDP support, limiting its applicability for DNS implementations.
As the technology matures and cloud providers continue to develop their capabilities, this approach may become a viable alternative to traditional anycast implementations, particularly for organizations requiring flexible, self-managed DNS infrastructure across multiple geographic locations.
***
ISOC-IL takes pride in its engineering team’s dedicated efforts to ensure the smooth and secure operation of Israel’s domain registry and DNS, alongside its active participation in the learning, research, and development of these fields, both in Israel and internationally.