Issues with Cluster-Internal DNS Resolution from Within Rancher Desktop VM on macOS

[mmlanger]

Hello Rancher Desktop Community,

I've been encountering a challenging issue while using Rancher Desktop on macOS, specifically related to DNS resolution for cluster-internal services from within the Lima VM that hosts the Kubernetes cluster. I'd greatly appreciate any guidance or suggestions you might have.

Setup and Issue Description:

• Environment: Rancher Desktop on macOS (Silicon, M2), which utilizes Lima (with containerd) to virtualize a Linux environment where the Kubernetes cluster runs as far as I understood.
• Problem: I have a container registry deployed within my Kubernetes cluster (registry.ci.svc.cluster.local), which is perfectly reachable from within the cluster itself (Pods can access it using its cluster-internal DNS name). However, I'm unable to resolve this DNS name from within the Lima VM that Rancher Desktop uses. This issue hinders certain operations that require access to the cluster-internal services from the VM level (which acts as the node as far as I understand kubernetes). Also means that I can't utilize images in that (cluster internal) registry in Pods as the hostname can't be found.

Tested with this example pod:

apiVersion: v1
kind: Pod
metadata:
  name: test-pod
  namespace: ci
spec:
  containers:
    - name: test-container
      image: registry.ci.svc.cluster.local:5000/optics/phaseopt-tests:17a289ab47d03f814b42d1fa48ad607714cc90e7
      command: ["sh", "-c", "echo Hello Kubernetes! && sleep 3600"]

which results in

ErrImagePull (failed to pull and unpack image "registry.ci.svc.cluster.local:5000/optics/phaseopt-tests:17a289ab47d03f814b42d1fa48ad607714cc90e7": failed to resolve reference "registry.ci.svc.cluster.local:5000/optics/phaseopt-tests:17a289ab47d03f814b42d1fa48ad607714cc90e7": failed to do request: Head "https://registry.ci.svc.cluster.local:5000/v2/optics/phaseopt-tests/manifests/17a289ab47d03f814b42d1fa48ad607714cc90e7": dial tcp: lookup registry.ci.svc.cluster.local: no such host)

What I've Tried:

1. Direct IP Access: I can successfully ping and curl the registry using its ClusterIP from within the Lima VM, confirming network connectivity isn't the issue. The exact image is also available in the registry and can be pulled from a e.g. deployed Skopeo image from another Pod.
2. DNS Checks: Running ping or wget for registry.ci.svc.cluster.local from the Lima VM fails, indicating the DNS resolution problem seems isolated to the VM environment.

Questions:

1. Is there a recommended configuration or setup for ensuring cluster-internal DNS names can be resolved from within the Lima VM? I think this is supposed to work but I am not sure, I am new to kubernetes.
2. Has anyone else faced similar issues and found a solution that doesn't involve manual edits or workarounds that might not be sustainable in the long term?
3. Are there specific settings within Rancher Desktop or Lima that I should look into to address this DNS resolution challenge?

I'm keen on finding a way to seamlessly work with services deployed within the Kubernetes cluster managed by Rancher Desktop without compromising on the development experience or having to resort to specific hacks.

Thank you in advance for any insights or advice you can share. I'm looking forward to contributing to and learning from this community.