coredns-ui

A world‑class, self‑contained observability & management console for CoreDNS on Kubernetes.

100 features across 21 pages, shipped as a single ~40 MB Go binary with the React SPA embedded — no external Grafana/Prometheus required (though it integrates with Prometheus if you have one). Runs against CoreDNS 1.8.6 unchanged — no version upgrade needed.

No blur / backdrop-filter anywhere (zero GPU dependency); charts are hand‑rolled and theme‑aware.

---

✨ Highlights

• Deep per‑query DNS tracing — switchable source: dnstap (full fidelity: cache vs forward vs local + answer counts) or the log plugin (zero hostPath/patch, multi‑node). See who asked (resolved to pod / namespace), where it went, and the hop‑by‑hop search‑path walk.
• Search‑path efficiency analytics — avg attempts per lookup, wasted ndots search‑domain lookups, unresolved count, and AAAA (IPv6) overhead — the "why is DNS noisy" answer that aggregate Prometheus counters can't give.
• Prometheus integration — built‑in per‑pod scraper and an optional real Prometheus connection, metric reconciliation, and a PromQL explorer with saved queries.
• Corefile management — live editor with validation, versioned history + one‑click rollback, revision diff, a best‑practice doctor, snippet insertion, and a portable config export.
• Policy & health — Blocklist/RPZ (sinkhole to NXDOMAIN), tunable alert rules, latency heatmaps, per‑upstream forwarder health.
• Operations — pod scaling & rolling restart, per‑pod drilldown (live metrics, scrape health, logs), NodeLocal DNSCache awareness, resolver config for CoreDNS and the Linux host.
• UX — dark/light, resizable split panes, ⌘K command palette, ? shortcut help, CSV/JSON export, production‑safe polling with server‑side caching (safe at 100k+ services).

Full list: FEATURES.md.

---

🚀 Quick start

The console runs inside your cluster (it talks to the Kubernetes API and scrapes CoreDNS).

# namespace + RBAC + deployment + service + ingress
kubectl apply -f deploy/00-namespace.yaml
kubectl apply -f deploy/10-rbac.yaml
kubectl apply -f deploy/20-deployment.yaml
kubectl apply -f deploy/40-ingress.yaml

To pull the published image instead of building locally, point the Deployment at a registry and flip the pull policy:

kubectl -n coredns-ui set image deploy/coredns-ui \
  coredns-ui=ghcr.io/beztebya666/coredns-ui:latest
kubectl -n coredns-ui patch deploy/coredns-ui --type=json \
  -p='[{"op":"replace","path":"/spec/template/spec/containers/0/imagePullPolicy","value":"IfNotPresent"}]'

Optional extras:

kubectl apply -f deploy/monitoring/prometheus.yaml   # in-cluster Prometheus
kubectl apply -f deploy/traefik/traefik.yaml          # Traefik ingress controller
kubectl apply -f deploy/demo/dns-demo.yaml            # realistic search-path traffic

TLS + basic‑auth ingress manifests live under deploy/security/ as an opt‑in capability — they are not applied by default.

---

🐳 Container images

linux/amd64:

Registry	Image
GitHub Container Registry	ghcr.io/beztebya666/coredns-ui:latest · :1.0.0
Docker Hub	beztebya666/coredns-ui:latest · :1.0.0

---

🧩 DNS tracing on CoreDNS 1.8.6

CoreDNS 1.8.6's dnstap has no tcp:// transport (added in 1.9). coredns‑ui therefore streams dnstap over a unix socket on a shared hostPath (/var/lib/coredns-dnstap/dnstap.sock): coredns‑ui listens, and the coredns Deployment mounts the same path. For multi‑node clusters (or to avoid any hostPath/patch), switch the tracing source to log plugin mode in the UI — it parses CoreDNS pod stdout and needs only the log directive.

Switching source rewrites the Corefile (with a backup) and triggers one rolling restart of CoreDNS.

---

🏗️ Architecture

• Backend (app/, Go): scrapes each CoreDNS pod :9153/metrics into an in‑memory ring, talks to the Kubernetes API (client‑go) for ConfigMap/Deployment/pods/logs/events, runs DNS queries (miekg/dns), aggregates dnstap (dnstap/golang-dnstap), and serves a REST API + the embedded SPA. Packages: internal/{promparse,collector,corefile,dnsq,k8s,dnstap,logtap,api}.
• Frontend (app/web/): React 18 + TypeScript + Vite + Tailwind + Radix UI + Recharts + TanStack Query + zustand + cmdk. Built to web/dist and embedded via //go:embed.
• Deploy (deploy/): namespace, RBAC, Deployment, Service, Ingress, Traefik, optional Prometheus, demo workload, and opt‑in TLS/auth.
• Cluster (cluster/): the kubeadm provisioning scripts used to build the reference k8s-worker node (RHEL 7 / kernel 3.10, Calico, containerd).

Build from source

docker build -t coredns-ui:1.0 app/

The multi‑stage app/Dockerfile builds the SPA (node:20-slim → Vite), compiles the Go binary (embedding web/dist), and ships a tiny alpine runtime. deploy/build-and-deploy.sh is the reference one‑shot that builds, imports the image into containerd, applies manifests, and (if dnstap is enabled) bounces CoreDNS to reconnect the socket.

---

📜 License

MIT © beztebya666