The cluster's upstream DNS servers, and how far they have converged.
curl --request GET \ --url https://stratum.example.com/v1/admin/network/dns/upstream-servers \ --header 'Authorization: Bearer <token>'The resolvers every VPC’s recursor forwards the names the cloud
does not serve to, and how far the cluster has got to them: every
per-VPC recursor’s . forward zone, and each node’s recursor netns
routes as its host helper applied them.
Three states, told apart by set:
- never set (
set: false,source: environment): each control plane uses its ownSTRATUM_NETWORK_DEFAULT_DNS_SERVERS, andserversis this control plane’s. The env seeds the setting once, at control-plane start, when it names servers. - set (
set: true): every control plane usesservers; the env is ignored. - set to empty (
set: true,servers: []): no forwarding; the recursors resolve from the root servers. Never re-seeded from the env.
fallback says what a recursor does when every server
fails: off (the default) fails the query; on resolves it from the root
servers. health says whether each server answers the recursors, asked
directly from inside every recursor’s netns; the
dns-upstreams-unreachable alarm fires when one answers none of a
node’s recursors, with the fallback on or off.
Install-scope; gates on network:GetDNSUpstreamServers.
Authorizations
Section titled “Authorizations”Responses
Section titled “Responses”The servers and their status.
The cluster’s upstream DNS servers (where every VPC’s recursor forwards the names the cloud does not serve) and how far the cluster has converged on them.
object
What every consumer acts on: the setting, or this control plane’s env while it was never set. Empty means no forwarding.
When every server fails, the recursors resolve from the root servers instead of failing the query. Off by default: the fallback hides a dead server from tenants and sends names only your own resolvers serve out to public resolution. No effect without servers.
False while the setting was never set: each control plane then uses its own STRATUM_NETWORK_DEFAULT_DNS_SERVERS, and servers is this one’s.
Environment: never set; seed: from a control plane’s env at its first start; operator: set through this API.
Moves on every change of servers or fallback; 0 while never set.
The most servers the list takes (4).
How far the cluster has converged on the upstream DNS servers, judged from what the consumers produced: the stored . forward zones the recursors render, and each node’s report of what its host helper applied.
object
Converged when every per-VPC recursor forwards to servers (or has no . zone, for an empty list) and every node recursors are placed on has routes to them applied; converging otherwise.
Per-VPC recursors.
Ready nodes recursors are placed on.
One node’s part of the upstream DNS status: what its recursor sweep stamped into its recursors’ netns intents, and how many of them its host helper has applied.
object
A ready node recursors are placed on. A node that is not is listed when it has reported and does not hold the phase back.
False for an expected node whose sweep has not reported.
The setting generation the sweep read; 0 = never set.
The servers the sweep routed.
Recursors this node runs.
Of them, how many carry the routes in the host helper’s applied state.
A report under 5 minutes old, the same servers, every recursor applied.
The first thing not at the list, and why.
Whether each server answers the VPC resolvers, over every recursor in the cluster, in the list’s order. Empty with no servers.
Whether one upstream DNS server answers the VPC resolvers. The host helper on each node asks it a recursive query directly from inside every recursor’s netns every 30 s; this judges every replica verdict newer than two minutes.
object
The server’s IPv4 address.
Answering: every replica that asked got an answer. not-answering: at least one did not. unknown: no recent verdict asked it yet.
True when state is answering.
Replicas with a recent verdict on this server.
Of those, how many got an answer.
A failing replica’s error, naming its node and VPC.
The newest verdict on this server.
Example
{ "source": "environment", "status": { "phase": "converged" }, "health": [ { "state": "answering" } ]}Authenticated but not authorized.
object
The findings of a rejected IAM policy document (custom and resource policies).
One finding of a rejected IAM policy document. A rejection lists every finding, so the author fixes the document in one round trip.
object
The finding, e.g. INVALID_DOCUMENT, UNKNOWN_ACTION, ACTION_NOT_APPLICABLE.
Index of the statement at fault; -1 for the document as a whole.
The offending action, where one is at fault (ACTION_NOT_APPLICABLE).
Field errors, for codes that carry them: each problem at its field
(see FieldError). Documented on the responses that set it, e.g.
approveNodeJoin’s INVALID_INPUT and JOIN_APPROVAL_REFUSED.
Absent otherwise.
One field’s problem, the stage-2 installer API’s shape.
field is the field’s path, message what is wrong with it.
object
The field’s path, e.g. links[0].interface, disks[1].confirm,
mgmt.address or role; empty for the whole request.
Structured facts about the refusal, for codes that carry them. The
shape is fixed per code and documented on the response that answers
it, e.g. IMAGE_POOL_MISMATCH (see ImagePoolMismatchDetails) and
IMAGE_IN_USE. Absent for codes that carry none.
object
Example
{ "issues": [ { "code": "ACTION_NOT_APPLICABLE", "action": "compute:CreateVpc" } ]}Upstream temporarily unavailable (driver / scheduler / dependency).
object
The findings of a rejected IAM policy document (custom and resource policies).
One finding of a rejected IAM policy document. A rejection lists every finding, so the author fixes the document in one round trip.
object
The finding, e.g. INVALID_DOCUMENT, UNKNOWN_ACTION, ACTION_NOT_APPLICABLE.
Index of the statement at fault; -1 for the document as a whole.
The offending action, where one is at fault (ACTION_NOT_APPLICABLE).
Field errors, for codes that carry them: each problem at its field
(see FieldError). Documented on the responses that set it, e.g.
approveNodeJoin’s INVALID_INPUT and JOIN_APPROVAL_REFUSED.
Absent otherwise.
One field’s problem, the stage-2 installer API’s shape.
field is the field’s path, message what is wrong with it.
object
The field’s path, e.g. links[0].interface, disks[1].confirm,
mgmt.address or role; empty for the whole request.
Structured facts about the refusal, for codes that carry them. The
shape is fixed per code and documented on the response that answers
it, e.g. IMAGE_POOL_MISMATCH (see ImagePoolMismatchDetails) and
IMAGE_IN_USE. Absent for codes that carry none.
object
Example
{ "issues": [ { "code": "ACTION_NOT_APPLICABLE", "action": "compute:CreateVpc" } ]}