Version v1.8 of the documentation is for the Talos version being developed. For the latest stable version of Talos, see the latest version.

Host DNS

How to configure Talos host DNS caching server.

Talos Linux starting with 1.7.0 provides a caching DNS resolver for host workloads (including host networking pods). Host DNS resolver is enabled by default for clusters created with Talos 1.7, and it can be enabled manually on upgrade.

Enabling Host DNS

Use the following machine configuration patch to enable host DNS resolver:

      enabled: true

Host DNS can be disabled by setting enabled: false as well.


When enabled, Talos Linux starts a DNS caching server on the host, listening on address (both TCP and UDP protocols). The host /etc/resolv.conf file is rewritten to point to the host DNS server:

$ talosctl read /etc/resolv.conf

All host-based workloads will use the host DNS server for name resolution. Host DNS server forwards requests to the upstream DNS servers, which are either acquired automatically (DHCP, platform sources, kernel args), or specified in the machine configuration.

The upstream DNS servers can be observed with:

$ talosctl get resolvers
NODE         NAMESPACE   TYPE             ID          VERSION   RESOLVERS   network     ResolverStatus   resolvers   2         ["",""]

Logs of the host DNS resolver can be queried with:

talosctl logs dns-resolve-cache

Upstream server status can be observed with:

$ talosctl get dnsupstream
NODE         NAMESPACE   TYPE          ID        VERSION   HEALTHY   ADDRESS   network     DNSUpstream   1         true   network     DNSUpstream   1         true

Forwarding kube-dns to Host DNS

When host DNS is enabled, by default, kube-dns service (CoreDNS in Kubernetes) uses upstream DNS servers to resolve external names. But Talos allows forwarding kube-dns to the host DNS resolver, so that the cache is shared between the host and kube-dns:

      enabled: true
      forwardKubeDNSToHost: true

This configuration should be applied to all nodes in the cluster, if enabled after cluster creation, restart coredns pods in Kubernetes to pick up changes.

When forwardKubeDNSToHost is enabled, Talos Linux allocates 9th IP address in the serviceSubnet range for host DNS server, and kube-dns service is configured to use this IP address as the upstream DNS server:

$ kubectl get services -n kube-system host-dns
host-dns   ClusterIP    <none>        53/UDP,53/TCP   27s
$ talosctl read /system/resolved/resolv.conf

With this configuration, kube-dns service forwards all DNS requests to the host DNS server, and the cache is shared between the host and kube-dns.

Resolving Talos Cluster Member Names

Host DNS can be configured to resolve Talos cluster member names to IP addresses, so that the host can communicate with the cluster members by name. Sometimes machine hostnames are already resolvable by the upstream DNS, but this might not always be the case.

Enabling the feature:

      enabled: true
      resolveMemberNames: true

When enabled, Talos Linux uses discovery data to resolve Talos cluster member names to IP addresses:

$ talosctl get members
NODE         NAMESPACE   TYPE     ID                             VERSION   HOSTNAME                       MACHINE TYPE   OS                        ADDRESSES   cluster     Member   talos-default-controlplane-1   1         talos-default-controlplane-1   controlplane   Talos (v1.8.0-alpha.0)   [""]   cluster     Member   talos-default-worker-1         1         talos-default-worker-1         worker         Talos (v1.8.0-alpha.0)   [""]

With the example output above, talos-default-worker-1 name will resolve to

Example usage:

talosctl -n talos-default-worker-1 version

When combined with forwardKubeDNSToHost, kube-dns service will also resolve Talos cluster member names to IP addresses.