Bypass DNS with curl --resolve

Pin host to a specific IP to test backend while keeping SNI/Host header

curl -sv --resolve <host>:443:<ip> https://<host>/healthz
tool
troubleshooting32 commands
tags
troubleshootingnetworkdnsdebug

More troubleshooting commands

  • In-cluster DNS smoke test
    kubectl run dnsutils --image=tutum/dnsutils -it --rm --restart=Never -- nslookup kubernetes.default

    Throwaway pod to resolve in-cluster names; verifies CoreDNS + kube-dns svc

  • Query CoreDNS directly
    dig +short @$(kubectl -n kube-system get svc kube-dns -o jsonpath='{.spec.clusterIP}') <name>.<ns>.svc.cluster.local

    Hit CoreDNS clusterIP straight; note: ndots:5 makes short names spam queries

  • Inspect CoreDNS config and logs
    kubectl -n kube-system get cm coredns -o yaml; kubectl -n kube-system logs deploy/coredns --tail=50

    Review Corefile (forward/cache) and tail logs for SERVFAIL/upstream errors

  • TLS cipher and protocol enum
    nmap --script ssl-enum-ciphers -p 443 <host>

    Grade supported TLS versions/ciphers; flags weak/deprecated suites per port

  • Verify full TLS chain and SNI
    openssl s_client -connect <host>:443 -servername <host> -showcerts 2>/dev/null | grep -E 'Verify|s:|i:'

    Show full chain with correct SNI; Verify line catches missing intermediates

all 32 troubleshooting commands