feat: add reload plugin to LocalDNS Corefile

[Saewon Kwak (saewoni)]

Change summary

Adds the CoreDNS reload plugin to generated LocalDNS Corefiles so CoreDNS can gracefully reload when the Corefile changes.

• Adds server-block level reload to the aks-node-controller LocalDNS Corefile template.
• Adds the same reload directive to the legacy pkg/agent LocalDNS Corefile template so both render paths stay consistent.
• Keeps the existing hosts plugin reload 5s directive unchanged; that reload belongs to the hosts plugin file watch, while this new reload plugin watches Corefile changes.
• Updates LocalDNS Corefile golden tests/assertions for both render paths.

The rendered directive is plain reload, using CoreDNS defaults: 30s interval and 15s jitter.

Testing

• cd aks-node-controller && go test ./parser ./pkg/nodeconfigutils
• go test ./pkg/agent ./pkg/agent/datamodel
• Standalone smoke test on LocalDNS-enabled cluster ldnsreload2243 from standalone run 176179054:
  • Verified localdns.service was active before testing.
  • Verified the bundled CoreDNS binary includes the reload plugin.
  • Patched the live /opt/azure/containers/localdns/updated.localdns.corefile to add server-block reload entries.
  • Restarted localdns.service and verified localdns_status=active.
  • Verified readiness on both listeners: 169.254.10.10:8181/ready = OK and 169.254.10.11:8181/ready = OK.
  • Verified DNS through the cluster listener: kubernetes.default.svc.cluster.local @169.254.10.11 resolved to 10.0.0.1.
  • Restored the original Corefile and confirmed localdns.service stayed active.
  • Evidence after restore: server_reload_count=0 and hosts_reload_count=2, confirming the temporary server-level reload entries were removed and the pre-existing hosts plugin reload 5s entries remained unchanged.
  • Smoke-test logs:
    • /home/sakwa/localdns-reload-standalone-176179054/reload-smoke-vmss.log
    • /home/sakwa/localdns-reload-standalone-176179054/reload-smoke-restore-check.log

Patched /opt/azure/containers/localdns/updated.localdns.corefile used in standalone smoke test

# ***********************************************************************************
# WARNING: Changes to this file will be overwritten and not persisted.
# ***********************************************************************************
# whoami (used for health check of DNS)
health-check.localdns.local:53 {
    bind 169.254.10.10 169.254.10.11
    whoami
}
# VnetDNS overrides apply to DNS traffic from pods with dnsPolicy:default or kubelet (referred to as VnetDNS traffic).
.:53 {
    errors
    bind 169.254.10.10
    # Check /etc/localdns/hosts first for critical AKS FQDNs (mcr.microsoft.com, packages.aks.azure.com, etc.)
    hosts /etc/localdns/hosts {
        ttl 5
        reload 5s
        fallthrough
    }
    forward . 168.63.129.16 {
        policy sequential
        max_concurrent 1000
    }
    reload
    ready 169.254.10.10:8181
    cache 3600 {
        success 9984
        denial 9984
        serve_stale 3600s immediate
        servfail 0
    }
    loop
    nsid localdns
    prometheus :9253
    template ANY ANY internal.cloudapp.net {
        match "^(?:[^.]+\.){4,}internal\.cloudapp\.net\.$"
        rcode NXDOMAIN
        fallthrough
    }
    template ANY ANY reddog.microsoft.com {
        rcode NXDOMAIN
    }
}
cluster.local:53 {
    errors
    bind 169.254.10.10
    forward . 10.0.0.10 {
        force_tcp
        policy sequential
        max_concurrent 1000
    }
    reload
    ready 169.254.10.10:8181
    cache 3600 {
        success 9984
        denial 9984
        serve_stale 3600s immediate
        servfail 0
    }
    loop
    nsid localdns
    prometheus :9253
}
# KubeDNS overrides apply to DNS traffic from pods with dnsPolicy:ClusterFirst (referred to as KubeDNS traffic).
.:53 {
    errors
    bind 169.254.10.11
    # Check /etc/localdns/hosts first for critical AKS FQDNs (mcr.microsoft.com, packages.aks.azure.com, etc.)
    hosts /etc/localdns/hosts {
        ttl 5
        reload 5s
        fallthrough
    }
    forward . 10.0.0.10 {
        policy sequential
        max_concurrent 1000
    }
    reload
    ready 169.254.10.11:8181
    cache 3600 {
        success 9984
        denial 9984
        serve_stale 3600s immediate
        servfail 0
    }
    loop
    nsid localdns-pod
    prometheus :9253
    template ANY ANY internal.cloudapp.net {
        match "^(?:[^.]+\.){4,}internal\.cloudapp\.net\.$"
        rcode NXDOMAIN
        fallthrough
    }
    template ANY ANY reddog.microsoft.com {
        rcode NXDOMAIN
    }
}
cluster.local:53 {
    errors
    bind 169.254.10.11
    forward . 10.0.0.10 {
        force_tcp
        policy sequential
        max_concurrent 1000
    }
    reload
    ready 169.254.10.11:8181
    cache 3600 {
        success 9984
        denial 9984
        serve_stale 3600s immediate
        servfail 0
    }
    loop
    nsid localdns-pod
    prometheus :9253
}

[github-actions]

Windows Unit Test Results

  3 files   12 suites   49s ⏱️
389 tests 389 ✅ 0 💤 0 ❌
392 runs  392 ✅ 0 💤 0 ❌

Results for commit e7562fd.

[Copilot]

Pull request overview

Adds the CoreDNS reload plugin directive to the generated LocalDNS Corefile so CoreDNS can gracefully reload when the Corefile changes, keeping the aks-node-controller and legacy pkg/agent render paths aligned.

Changes:

• Added server-block level reload directive to the LocalDNS Corefile templates in both render paths.
• Updated golden/expected Corefile outputs in Go tests for both implementations.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.

File	Description
pkg/agent/baker.go	Adds reload to the legacy LocalDNS Corefile Go template output.
pkg/agent/baker_test.go	Updates expected LocalDNS Corefile strings to include reload.
aks-node-controller/parser/templates/localdns.toml.gtpl	Adds reload to the aks-node-controller LocalDNS Corefile template.
aks-node-controller/parser/helper_test.go	Updates expected LocalDNS Corefile strings to include reload.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.