[Yandex Cloud documentation](../../index.md) > [Tutorials](../index.md) > [Container infrastructure](index.md) > Managed Service for Kubernetes > Working with DNS > Integration with a corporate DNS zone

# Integrating Yandex Managed Service for Kubernetes with a corporate DNS zone

# Integration with a corporate DNS zone


To integrate a [Managed Service for Kubernetes cluster](../../managed-kubernetes/concepts/index.md#kubernetes-cluster) with a private corporate DNS [zone](../../dns/concepts/dns-zone.md):

1. [Configure the DNS server](#setup-dns).
1. [Specify the corporate DNS zone](#setup-zone).
1. [Create a dns-utils pod](#create-pod).
1. [Check DNS integration](#verify-dns).

If you no longer need the resources you created, [delete them](#clear-out).


## Required paid resources {#paid-resources}

The support cost for this solution includes:

* Fee for using the master and outgoing traffic in a Managed Service for Kubernetes cluster (see [Managed Service for Kubernetes pricing](../../managed-kubernetes/pricing.md)).
* Fee for each VM (Managed Service for Kubernetes cluster nodes, DNS server, management VMs without public access) that covers the use of computing resources, operating system, and storage (see [Compute Cloud pricing](../../compute/pricing.md)).
* Fee for VM public IP addresses (see [Virtual Private Cloud pricing](../../vpc/pricing.md#prices-public-ip)).
* Fee for a DNS zone and DNS requests (see [Cloud DNS pricing](../../dns/pricing.md)).


## Getting started {#before-you-begin}

1. Create Managed Service for Kubernetes resources:

   {% list tabs group=instructions %}

   - Manually {#manual}

     1. [Create security groups](../../managed-kubernetes/operations/connect/security-groups.md) for the Managed Service for Kubernetes cluster and its node groups.

        {% note warning %}
        
        The configuration of security groups determines performance and availability of the cluster and the services and applications running in it.
        
        {% endnote %}

     1. [Create a Managed Service for Kubernetes cluster](../../managed-kubernetes/operations/kubernetes-cluster/kubernetes-cluster-create.md). When creating a cluster, specify the preconfigured security groups.
        
        For Yandex Cloud internal network usage, your cluster does not need a public IP address. To enable internet access to your cluster, assign it a public IP address.

     1. [Create a node group](../../managed-kubernetes/operations/node-group/node-group-create.md). To enable internet access for your node group (e.g., for Docker image pulls), assign it a public IP address. Specify the preconfigured security groups.

   - Terraform {#tf}

     1. If you do not have Terraform yet, [install it](../infrastructure-management/terraform-quickstart.md#install-terraform).
     1. [Get the authentication credentials](../infrastructure-management/terraform-quickstart.md#get-credentials). You can add them to environment variables or specify them later in the provider configuration file.
     1. [Configure and initialize a provider](../infrastructure-management/terraform-quickstart.md#configure-provider). There is no need to create a provider configuration file manually, you can [download it](https://github.com/yandex-cloud-examples/yc-terraform-provider-settings/blob/main/provider.tf).
     1. Place the configuration file in a separate working directory and [specify the parameter values](../infrastructure-management/terraform-quickstart.md#configure-provider). If you did not add the authentication credentials to environment variables, specify them in the configuration file.

     1. Download the [k8s-cluster.tf](https://github.com/yandex-cloud-examples/yc-mk8s-cluster-infrastructure/blob/main/k8s-cluster.tf) configuration file for the Managed Service for Kubernetes cluster to the same working directory. This file describes:
        * [Network](../../vpc/concepts/network.md#network).
        * [Subnet](../../vpc/concepts/network.md#subnet).
        * Managed Service for Kubernetes cluster.
        * Managed Service for Kubernetes node group.
        * [Service account](../../iam/concepts/users/service-accounts.md) required to create the Managed Service for Kubernetes cluster and node group.
        * [Security groups](../../vpc/concepts/security-groups.md) which contain [rules](../../managed-kubernetes/operations/connect/security-groups.md) required for the Managed Service for Kubernetes cluster and its node groups.

            {% note warning %}
            
            The configuration of security groups determines performance and availability of the cluster and the services and applications running in it.
            
            {% endnote %}

     1. Specify the [folder ID](../../resource-manager/operations/folder/get-id.md) in the configuration file.
     1. Make sure the Terraform configuration files are correct using this command:

        ```bash
        terraform validate
        ```

        Terraform will show any errors found in your configuration files.
     1. Create the required infrastructure:

        1. Run this command to view the planned changes:
        
           ```bash
           terraform plan
           ```
        
           If you described the configuration correctly, the terminal will display a list of the resources to update and their parameters. This is a verification step that does not apply changes to your resources.
        
        1. If everything looks correct, apply the changes:
           1. Run this command:
        
              ```bash
              terraform apply
              ```
        
           1. Confirm updating the resources.
           1. Wait for the operation to complete.

        All the required resources will be created in the specified folder. You can check resource availability and their settings in the [management console](https://console.yandex.cloud).

   {% endlist %}

1. [Install kubect](https://kubernetes.io/docs/tasks/tools/install-kubectl) and [configure it to work with the new cluster](../../managed-kubernetes/operations/connect/index.md#kubectl-connect).

   If your cluster has no public IP address assigned and `kubectl` is configured via the cluster's private IP address, run `kubectl` commands on a Yandex Cloud VM residing in the same network as the cluster.

## Configure the DNS server {#setup-dns}

It is crucial to ensure IP connectivity between the Managed Service for Kubernetes cluster nodes and the DNS servers. The DNS servers can either reside in [Yandex Virtual Private Cloud](../../vpc/index.md) or be accessible via VPN or [Yandex Cloud Interconnect](../../interconnect/index.md). This example shows the `ns.example.com` DNS server at `10.129.0.3` serving the `example.com` zone.

## Specify the corporate DNS zone {#setup-zone}

1. Create the `custom-zone.yaml` file with the following content:

   ```yaml
   kind: ConfigMap
   apiVersion: v1
   metadata:
     name: coredns-user
     namespace: kube-system
     labels:
       addonmanager.kubernetes.io/mode: EnsureExists
   data:
     Corefile: |
       # User can put their additional configurations here, for example:
       example.com {
         errors
         cache 30
         forward . 10.129.0.3
       }
   ```

1. Run this command:

   ```bash
   kubectl replace -f custom-zone.yaml
   ```

   Result:

   ```text
   configmap/coredns-user replaced
   ```

## Create a dns-util pod {#create-pod}

1. Create a [pod](../../managed-kubernetes/concepts/index.md#pod):

   ```bash
   kubectl run jessie-dnsutils \
     --image=registry.k8s.io/jessie-dnsutils \
     --restart=Never \
     --command sleep infinity
   ```

   Result:

   ```text
   pod/jessie-dnsutils created
   ```

1. View the information about the new pod:

   ```bash
   kubectl describe pod jessie-dnsutils
   ```

   Result:

   ```text
   ...
   Status:  Running
   ...
   ```

## Check DNS integration {#verify-dns}

Run the `nslookup` command in the running container:

```bash
kubectl exec jessie-dnsutils -- nslookup ns.example.com
```

Result:

```text
Server:   10.96.128.2
Address:  10.96.128.2#53
Name:     ns.example.com
Address:  10.129.0.3
```

{% note info %}

If the corporate DNS zone is unavailable, [make sure](../../managed-kubernetes/operations/connect/security-groups.md) the security groups for the Managed Service for Kubernetes cluster and its node groups are configured correctly. If a rule is missing, [add it](../../vpc/operations/security-group-add-rule.md). The rules must allow access to resources from the cluster.

{% endnote %}

## Delete the resources you created {#clear-out}

Some resources are not free of charge. Delete the resources you no longer need to avoid paying for them:
1. Delete the Managed Service for Kubernetes cluster:

   {% list tabs group=instructions %}

   - Manually {#manual}

     [Delete the Managed Service for Kubernetes cluster](../../managed-kubernetes/operations/kubernetes-cluster/kubernetes-cluster-delete.md).

   - Terraform {#tf}

     1. In the terminal window, go to the directory containing the infrastructure plan.
     
         {% note warning %}
     
         Make sure the directory has no Terraform manifests with the resources you want to keep. Terraform deletes all resources that were created using the manifests in the current directory.
     
         {% endnote %}
     
     1. Delete resources:
     
         1. Run this command:
     
             ```bash
             terraform destroy
             ```
     
         1. Confirm deleting the resources and wait for the operation to complete.
     
         All the resources described in the Terraform manifests will be deleted.

    {% endlist %}

1. [Delete the VM](../../compute/operations/vm-control/vm-delete.md) with the DNS server.
1. [Delete the DNS zone](../../dns/operations/zone-delete.md).