Support running a nodelocal dns cache

This change includes the yaml files and gce startup script changes
to run this addon. It is disabled by default, can be enabled by setting
KUBE_ENABLE_NODELOCAL_DNS=true
An ip address is required for the cache instance to listen for
requests on, default is a link local ip address of value 169.254.25.10

addressed review comments, updated image location
Picked a different prometheus port so stats port is not same as the
coredns deployment

Removed the nodelocaldns-ready label.
Set memory limit to 30Mi

cluster/addons/dns/nodelocaldns/Makefile

@@ -0,0 +1,34 @@
+# Copyright 2018 The Kubernetes Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Makefile for the kubedns underscore templates to Salt/Pillar and other formats.
+
+# If you update the *.base templates, please run this Makefile before pushing.
+#
+# Usage:
+#    make
+
+all: transform
+
+# .base -> .in pattern rule
+%.in: %.base
+	sed -f transforms2salt.sed $< | sed s/__SOURCE_FILENAME__/$</g > $@
+
+# .base -> .sed pattern rule
+%.sed: %.base
+	sed -f transforms2sed.sed $<  | sed s/__SOURCE_FILENAME__/$</g > $@
+
+transform: nodelocaldns.yaml.in nodelocaldns.yaml.sed
+
+.PHONY: transform

cluster/addons/dns/nodelocaldns/nodelocaldns.yaml.base

@@ -0,0 +1,150 @@
+# Copyright 2018 The Kubernetes Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# __MACHINE_GENERATED_WARNING__
+
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: nodelocaldns
+  namespace: kube-system
+  labels:
+    kubernetes.io/cluster-service: "true"
+    addonmanager.kubernetes.io/mode: Reconcile
+---
+
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: nodelocaldns
+  namespace: kube-system
+  labels:
+    addonmanager.kubernetes.io/mode: EnsureExists
+
+data:
+  Corefile: |
+    __PILLAR__DNS__DOMAIN__:53 {
+        errors
+        cache 30
+        reload
+        loop
+        bind __PILLAR__LOCAL__DNS__
+        forward . __PILLAR__DNS__SERVER__ {
+                force_tcp
+        }
+        prometheus :9253
+        health __PILLAR__LOCAL__DNS__:8080
+        }
+    in-addr.arpa:53 {
+        errors
+        cache 30
+        reload
+        loop
+        bind __PILLAR__LOCAL__DNS__
+        forward . __PILLAR__DNS__SERVER__ {
+                force_tcp
+        }
+        prometheus :9253
+        }
+    ip6.arpa:53 {
+        errors
+        cache 30
+        reload
+        loop
+        bind __PILLAR__LOCAL__DNS__
+        forward . __PILLAR__DNS__SERVER__ {
+                force_tcp
+        }
+        prometheus :9253
+        }
+    .:53 {
+        errors
+        cache 30
+        reload
+        loop
+        bind __PILLAR__LOCAL__DNS__
+        forward . /etc/resolv.conf {
+                force_tcp
+        }
+        prometheus :9253
+        }
+---
+apiVersion: apps/v1
+kind: DaemonSet
+metadata:
+  name: nodelocaldns
+  namespace: kube-system
+  labels:
+    k8s-app: kube-dns
+    kubernetes.io/cluster-service: "true"
+    addonmanager.kubernetes.io/mode: Reconcile
+spec:
+  selector:
+    matchLabels:
+      k8s-app: nodelocaldns
+  template:
+    metadata:
+       labels:
+          k8s-app: nodelocaldns
+    spec:
+      priorityClassName: system-node-critical
+      serviceAccountName: nodelocaldns
+      hostNetwork: true
+      dnsPolicy: Default  # Don't use cluster DNS.
+      tolerations:
+      - key: "CriticalAddonsOnly"
+        operator: "Exists"
+      containers:
+      - name: node-cache
+        image: k8s.gcr.io/k8s-dns-node-cache:1.15.0
+        resources:
+          limits:
+            memory: 30Mi
+          requests:
+            cpu: 25m
+            memory: 5Mi
+        args: [ "-localip", "__PILLAR__LOCAL__DNS__", "-conf", "/etc/coredns/Corefile" ]
+        securityContext:
+                privileged: true
+        ports:
+        - containerPort: 53
+          name: dns
+          protocol: UDP
+        - containerPort: 53
+          name: dns-tcp
+          protocol: TCP
+        - containerPort: 9253
+          name: metrics
+          protocol: TCP
+        livenessProbe:
+          httpGet:
+            host: __PILLAR__LOCAL__DNS__
+            path: /health
+            port: 8080
+            scheme: HTTP
+          initialDelaySeconds: 60
+          timeoutSeconds: 5
+          successThreshold: 1
+          failureThreshold: 3
+        volumeMounts:
+        - name: config-volume
+          mountPath: /etc/coredns
+      volumes:
+        - name: config-volume
+          configMap:
+            name: nodelocaldns
+            items:
+            - key: Corefile
+              path: Corefile
+      terminationGracePeriodSeconds: 30

cluster/addons/dns/nodelocaldns/nodelocaldns.yaml.in

@@ -0,0 +1,150 @@
+# Copyright 2018 The Kubernetes Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# Warning: This is a file generated from the base underscore template file: nodelocaldns.yaml.base
+
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: nodelocaldns
+  namespace: kube-system
+  labels:
+    kubernetes.io/cluster-service: "true"
+    addonmanager.kubernetes.io/mode: Reconcile
+---
+
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: nodelocaldns
+  namespace: kube-system
+  labels:
+    addonmanager.kubernetes.io/mode: EnsureExists
+
+data:
+  Corefile: |
+    {{ pillar['dns_domain'] }}:53 {
+        errors
+        cache 30
+        reload
+        loop
+        bind {{ pillar['local_dns_ip'] }}
+        forward . {{ pillar['dns_server'] }} {
+                force_tcp
+        }
+        prometheus :9253
+        health {{ pillar['local_dns_ip'] }}:8080
+        }
+    in-addr.arpa:53 {
+        errors
+        cache 30
+        reload
+        loop
+        bind {{ pillar['local_dns_ip'] }}
+        forward . {{ pillar['dns_server'] }} {
+                force_tcp
+        }
+        prometheus :9253
+        }
+    ip6.arpa:53 {
+        errors
+        cache 30
+        reload
+        loop
+        bind {{ pillar['local_dns_ip'] }}
+        forward . {{ pillar['dns_server'] }} {
+                force_tcp
+        }
+        prometheus :9253
+        }
+    .:53 {
+        errors
+        cache 30
+        reload
+        loop
+        bind {{ pillar['local_dns_ip'] }}
+        forward . /etc/resolv.conf {
+                force_tcp
+        }
+        prometheus :9253
+        }
+---
+apiVersion: apps/v1
+kind: DaemonSet
+metadata:
+  name: nodelocaldns
+  namespace: kube-system
+  labels:
+    k8s-app: kube-dns
+    kubernetes.io/cluster-service: "true"
+    addonmanager.kubernetes.io/mode: Reconcile
+spec:
+  selector:
+    matchLabels:
+      k8s-app: nodelocaldns
+  template:
+    metadata:
+       labels:
+          k8s-app: nodelocaldns
+    spec:
+      priorityClassName: system-node-critical
+      serviceAccountName: nodelocaldns
+      hostNetwork: true
+      dnsPolicy: Default  # Don't use cluster DNS.
+      tolerations:
+      - key: "CriticalAddonsOnly"
+        operator: "Exists"
+      containers:
+      - name: node-cache
+        image: k8s.gcr.io/k8s-dns-node-cache:1.15.0
+        resources:
+          limits:
+            memory: 30Mi
+          requests:
+            cpu: 25m
+            memory: 5Mi
+        args: [ "-localip", "{{ pillar['local_dns_ip'] }}", "-conf", "/etc/coredns/Corefile" ]
+        securityContext:
+                privileged: true
+        ports:
+        - containerPort: 53
+          name: dns
+          protocol: UDP
+        - containerPort: 53
+          name: dns-tcp
+          protocol: TCP
+        - containerPort: 9253
+          name: metrics
+          protocol: TCP
+        livenessProbe:
+          httpGet:
+            host: {{ pillar['local_dns_ip'] }}
+            path: /health
+            port: 8080
+            scheme: HTTP
+          initialDelaySeconds: 60
+          timeoutSeconds: 5
+          successThreshold: 1
+          failureThreshold: 3
+        volumeMounts:
+        - name: config-volume
+          mountPath: /etc/coredns
+      volumes:
+        - name: config-volume
+          configMap:
+            name: nodelocaldns
+            items:
+            - key: Corefile
+              path: Corefile
+      terminationGracePeriodSeconds: 30

cluster/addons/dns/nodelocaldns/nodelocaldns.yaml.sed

@@ -0,0 +1,150 @@
+# Copyright 2018 The Kubernetes Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# Warning: This is a file generated from the base underscore template file: nodelocaldns.yaml.base
+
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: nodelocaldns
+  namespace: kube-system
+  labels:
+    kubernetes.io/cluster-service: "true"
+    addonmanager.kubernetes.io/mode: Reconcile
+---
+
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: nodelocaldns
+  namespace: kube-system
+  labels:
+    addonmanager.kubernetes.io/mode: EnsureExists
+
+data:
+  Corefile: |
+    $DNS_DOMAIN:53 {
+        errors
+        cache 30
+        reload
+        loop
+        bind $LOCAL_DNS_IP
+        forward . $DNS_SERVER_IP {
+                force_tcp
+        }
+        prometheus :9253
+        health $LOCAL_DNS_IP:8080
+        }
+    in-addr.arpa:53 {
+        errors
+        cache 30
+        reload
+        loop
+        bind $LOCAL_DNS_IP
+        forward . $DNS_SERVER_IP {
+                force_tcp
+        }
+        prometheus :9253
+        }
+    ip6.arpa:53 {
+        errors
+        cache 30
+        reload
+        loop
+        bind $LOCAL_DNS_IP
+        forward . $DNS_SERVER_IP {
+                force_tcp
+        }
+        prometheus :9253
+        }
+    .:53 {
+        errors
+        cache 30
+        reload
+        loop
+        bind $LOCAL_DNS_IP
+        forward . /etc/resolv.conf {
+                force_tcp
+        }
+        prometheus :9253
+        }
+---
+apiVersion: apps/v1
+kind: DaemonSet
+metadata:
+  name: nodelocaldns
+  namespace: kube-system
+  labels:
+    k8s-app: kube-dns
+    kubernetes.io/cluster-service: "true"
+    addonmanager.kubernetes.io/mode: Reconcile
+spec:
+  selector:
+    matchLabels:
+      k8s-app: nodelocaldns
+  template:
+    metadata:
+       labels:
+          k8s-app: nodelocaldns
+    spec:
+      priorityClassName: system-node-critical
+      serviceAccountName: nodelocaldns
+      hostNetwork: true
+      dnsPolicy: Default  # Don't use cluster DNS.
+      tolerations:
+      - key: "CriticalAddonsOnly"
+        operator: "Exists"
+      containers:
+      - name: node-cache
+        image: k8s.gcr.io/k8s-dns-node-cache:1.15.0
+        resources:
+          limits:
+            memory: 30Mi
+          requests:
+            cpu: 25m
+            memory: 5Mi
+        args: [ "-localip", "$LOCAL_DNS_IP", "-conf", "/etc/coredns/Corefile" ]
+        securityContext:
+                privileged: true
+        ports:
+        - containerPort: 53
+          name: dns
+          protocol: UDP
+        - containerPort: 53
+          name: dns-tcp
+          protocol: TCP
+        - containerPort: 9253
+          name: metrics
+          protocol: TCP
+        livenessProbe:
+          httpGet:
+            host: $LOCAL_DNS_IP
+            path: /health
+            port: 8080
+            scheme: HTTP
+          initialDelaySeconds: 60
+          timeoutSeconds: 5
+          successThreshold: 1
+          failureThreshold: 3
+        volumeMounts:
+        - name: config-volume
+          mountPath: /etc/coredns
+      volumes:
+        - name: config-volume
+          configMap:
+            name: nodelocaldns
+            items:
+            - key: Corefile
+              path: Corefile
+      terminationGracePeriodSeconds: 30

cluster/addons/dns/nodelocaldns/transforms2salt.sed

@@ -0,0 +1,4 @@
+s/__PILLAR__DNS__SERVER__/{{ pillar['dns_server'] }}/g
+s/__PILLAR__DNS__DOMAIN__/{{ pillar['dns_domain'] }}/g
+s/__PILLAR__LOCAL__DNS__/{{ pillar['local_dns_ip'] }}/g
+s/__MACHINE_GENERATED_WARNING__/Warning: This is a file generated from the base underscore template file: __SOURCE_FILENAME__/g

cluster/addons/dns/nodelocaldns/transforms2sed.sed

@@ -0,0 +1,4 @@
+s/__PILLAR__DNS__SERVER__/$DNS_SERVER_IP/g
+s/__PILLAR__DNS__DOMAIN__/$DNS_DOMAIN/g
+s/__PILLAR__LOCAL__DNS__/$LOCAL_DNS_IP/g
+s/__MACHINE_GENERATED_WARNING__/Warning: This is a file generated from the base underscore template file: __SOURCE_FILENAME__/g

cluster/centos/config-default.sh

@@ -108,8 +108,10 @@ export SERVICE_CLUSTER_IP_RANGE=${SERVICE_CLUSTER_IP_RANGE:-"192.168.3.0/24"}
 
 # Optional: Install cluster DNS.
 ENABLE_CLUSTER_DNS="${KUBE_ENABLE_CLUSTER_DNS:-true}"
+ENABLE_NODELOCAL_DNS="${KUBE_ENABLE_NODELOCAL_DNS:-false}"
 # DNS_SERVER_IP must be a IP in SERVICE_CLUSTER_IP_RANGE
 DNS_SERVER_IP=${DNS_SERVER_IP:-"192.168.3.100"}
+LOCAL_DNS_IP=${LOCAL_DNS_IP:-"169.254.20.10"}
 DNS_DOMAIN=${DNS_DOMAIN:-"cluster.local"}
 
 # Optional: Install Kubernetes UI

cluster/centos/deployAddons.sh

@@ -44,6 +44,28 @@ function deploy_dns {
   echo
 }
 
+function deploy_nodelocaldns {
+  echo "Deploying NodeLocalDNS on Kubernetes"
+  cp "${KUBE_ROOT}/cluster/addons/dns/nodelocaldns/nodelocaldns.yaml.sed" nodelocaldns.yaml
+  sed -i -e "s/\\\$DNS_DOMAIN/${DNS_DOMAIN}/g" nodelocaldns.yaml
+  sed -i -e "s/\\\$DNS_SERVER_IP/${DNS_SERVER_IP}/g" nodelocaldns.yaml
+  sed -i -e "s/\\\$LOCAL_DNS_IP/${LOCAL_DNS_IP}/g" nodelocaldns.yaml
+
+  NODELOCALDNS=$(${KUBECTL} get pods --namespace=kube-system -o jsonpath='{.items[*].metadata.name}' \
+    | tr ' ' "\n" | grep "nodelocaldns")
+
+  if [[ -z "${NODELOCALDNS}" ]]; then
+    # use kubectl to create nodelocaldns addon
+    ${KUBECTL} --namespace=kube-system create -f nodelocaldns.yaml
+
+    echo "NodeLocalDNS addon is successfully deployed."
+  else
+    echo "NodeLocalDNS addon is already deployed. Skipping."
+  fi
+
+  echo
+}
+
 function deploy_dashboard {
   echo "Deploying Kubernetes Dashboard"
 
@@ -57,11 +79,14 @@ function deploy_dashboard {
 }
 
 
-if [ "${ENABLE_CLUSTER_DNS}" == true ]; then
+if [[ "${ENABLE_CLUSTER_DNS}" == "true" ]]; then
   deploy_dns
 fi
 
-if [ "${ENABLE_CLUSTER_UI}" == true ]; then
+if [[ "${ENABLE_NODELOCAL_DNS}" == "true" ]]; then
+  deploy_nodelocaldns
+fi
+if [[ "${ENABLE_CLUSTER_UI}" == "true" ]]; then
   deploy_dashboard
 fi
 

cluster/centos/util.sh

@@ -302,11 +302,16 @@ function post-provision-master() {
 #   DOCKER_OPTS
 #   DNS_SERVER_IP
 #   DNS_DOMAIN
+#   ENABLE_NODELOCAL_DNS
+#   LOCAL_DNS_IP
 function provision-node() {
   echo "[INFO] Provision node on $1"
   local node=$1
   local node_ip=${node#*@}
   local dns_ip=${DNS_SERVER_IP#*@}
+  if [ "${ENABLE_NODELOCAL_DNS}" == true ]; then
+    dns_ip=${LOCAL_DNS_IP}
+  fi
   local dns_domain=${DNS_DOMAIN#*@}
   ensure-setup-dir ${node}
 

cluster/gce/config-default.sh

@@ -198,6 +198,9 @@ if [[ ${ENABLE_NETD:-} == "true" ]]; then
 	NON_MASTER_NODE_LABELS="${NON_MASTER_NODE_LABELS:+${NON_MASTER_NODE_LABELS},}cloud.google.com/gke-netd-ready=true"
 fi
 
+ENABLE_NODELOCAL_DNS="${KUBE_ENABLE_NODELOCAL_DNS:-false}"
+LOCAL_DNS_IP="${KUBE_LOCAL_DNS_IP:-169.254.20.10}"
+
 # Enable metadata concealment by firewalling pod traffic to the metadata server
 # and run a proxy daemonset on nodes.
 #

cluster/gce/config-test.sh

@@ -230,6 +230,8 @@ if [[ ${ENABLE_NETD:-} == "true" ]]; then
 	NON_MASTER_NODE_LABELS="${NON_MASTER_NODE_LABELS:+${NON_MASTER_NODE_LABELS},}cloud.google.com/gke-netd-ready=true"
 fi
 
+ENABLE_NODELOCAL_DNS="${KUBE_ENABLE_NODELOCAL_DNS:-false}"
+
 # To avoid running Calico on a node that is not configured appropriately,
 # label each Node so that the DaemonSet can run the Pods only on ready Nodes.
 if [[ ${NETWORK_POLICY_PROVIDER:-} == "calico" ]]; then
@@ -272,6 +274,7 @@ fi
 CLUSTER_DNS_CORE_DNS="${CLUSTER_DNS_CORE_DNS:-true}"
 ENABLE_CLUSTER_DNS="${KUBE_ENABLE_CLUSTER_DNS:-true}"
 DNS_SERVER_IP="10.0.0.10"
+LOCAL_DNS_IP="${KUBE_LOCAL_DNS_IP:-169.254.20.10}"
 DNS_DOMAIN="cluster.local"
 
 # Optional: Enable DNS horizontal autoscaler

cluster/gce/gci/configure-helper.sh

@@ -2349,6 +2349,16 @@ EOF
   fi
 }
 
+# Sets up the manifests of local dns cache agent for k8s addons.
+function setup-nodelocaldns-manifest {
+  local -r localdns_file="${dst_dir}/dns/nodelocaldns/nodelocaldns.yaml"
+  mv "${dst_dir}/dns/nodelocaldns/nodelocaldns.yaml.in" "${localdns_file}"
+  # Replace the salt configurations with variable values.
+  sed -i -e "s@{{ *pillar\['dns_domain'\] *}}@${DNS_DOMAIN}@g" "${localdns_file}"
+  sed -i -e "s@{{ *pillar\['dns_server'\] *}}@${DNS_SERVER_IP}@g" "${localdns_file}"
+  sed -i -e "s@{{ *pillar\['local_dns_ip'\] *}}@${LOCAL_DNS_IP}@g" "${localdns_file}"
+}
+
 # Sets up the manifests of netd for k8s addons.
 function setup-netd-manifest {
   local -r netd_file="${dst_dir}/netd/netd.yaml"
@@ -2520,6 +2530,10 @@ EOF
       setup-addon-manifests "addons" "dns/kube-dns"
       setup-kube-dns-manifest
     fi
+    if [[ "${ENABLE_NODELOCAL_DNS:-}" == "true" ]]; then
+      setup-addon-manifests "addons" "dns/nodelocaldns"
+      setup-nodelocaldns-manifest
+    fi
   fi
   if [[ "${ENABLE_NETD:-}" == "true" ]]; then
     setup-netd-manifest

cluster/gce/util.sh

@@ -708,6 +708,9 @@ function build-kubelet-config {
     declare quoted_dns_server_ip
     declare quoted_dns_domain
     quoted_dns_server_ip=$(yaml-quote "${DNS_SERVER_IP}")
+    if [[ "${ENABLE_NODELOCAL_DNS:-}" == "true" ]]; then
+      quoted_dns_server_ip=$(yaml-quote "${LOCAL_DNS_IP}")
+    fi
     quoted_dns_domain=$(yaml-quote "${DNS_DOMAIN}")
     cat <<EOF
 kind: KubeletConfiguration
@@ -848,7 +851,9 @@ LOGGING_DESTINATION: $(yaml-quote ${LOGGING_DESTINATION:-})
 ELASTICSEARCH_LOGGING_REPLICAS: $(yaml-quote ${ELASTICSEARCH_LOGGING_REPLICAS:-})
 ENABLE_CLUSTER_DNS: $(yaml-quote ${ENABLE_CLUSTER_DNS:-false})
 CLUSTER_DNS_CORE_DNS: $(yaml-quote ${CLUSTER_DNS_CORE_DNS:-true})
+ENABLE_NODELOCAL_DNS: $(yaml-quote ${ENABLE_NODELOCAL_DNS:-false})
 DNS_SERVER_IP: $(yaml-quote ${DNS_SERVER_IP:-})
+LOCAL_DNS_IP: $(yaml-quote ${LOCAL_DNS_IP:-})
 DNS_DOMAIN: $(yaml-quote ${DNS_DOMAIN:-})
 ENABLE_DNS_HORIZONTAL_AUTOSCALER: $(yaml-quote ${ENABLE_DNS_HORIZONTAL_AUTOSCALER:-false})
 KUBE_PROXY_DAEMONSET: $(yaml-quote ${KUBE_PROXY_DAEMONSET:-false})

hack/local-up-cluster.sh

@@ -63,7 +63,9 @@ EVICTION_PRESSURE_TRANSITION_PERIOD=${EVICTION_PRESSURE_TRANSITION_PERIOD:-"1m"}
 # Note also that you need API_HOST (defined above) for correct DNS.
 KUBE_PROXY_MODE=${KUBE_PROXY_MODE:-""}
 ENABLE_CLUSTER_DNS=${KUBE_ENABLE_CLUSTER_DNS:-true}
+ENABLE_NODELOCAL_DNS=${KUBE_ENABLE_NODELOCAL_DNS:-false}
 DNS_SERVER_IP=${KUBE_DNS_SERVER_IP:-10.0.0.10}
+LOCAL_DNS_IP=${KUBE_LOCAL_DNS_IP:-169.254.20.10}
 DNS_DOMAIN=${KUBE_DNS_NAME:-"cluster.local"}
 KUBECTL=${KUBECTL:-"${KUBE_ROOT}/cluster/kubectl.sh"}
 WAIT_FOR_URL_API_SERVER=${WAIT_FOR_URL_API_SERVER:-60}
@@ -704,7 +706,11 @@ function start_kubelet {
     mkdir -p "/var/lib/kubelet" &>/dev/null || sudo mkdir -p "/var/lib/kubelet"
     # Enable dns
     if [[ "${ENABLE_CLUSTER_DNS}" = true ]]; then
-      dns_args="--cluster-dns=${DNS_SERVER_IP} --cluster-domain=${DNS_DOMAIN}"
+      if [[ "${ENABLE_NODELOCAL_DNS}" = true ]]; then
+        dns_args="--cluster-dns=${LOCAL_DNS_IP} --cluster-domain=${DNS_DOMAIN}"
+      else
+        dns_args="--cluster-dns=${DNS_SERVER_IP} --cluster-domain=${DNS_DOMAIN}"
+      fi
     else
       # To start a private DNS server set ENABLE_CLUSTER_DNS and
       # DNS_SERVER_IP/DOMAIN. This will at least provide a working
@@ -908,6 +914,25 @@ function start_kubedns {
     fi
 }
 
+function start_nodelocaldns {
+    if [[ "${ENABLE_NODELOCAL_DNS}" = true ]]; then
+        cp "${KUBE_ROOT}/cluster/addons/dns/nodelocaldns/localdns.yaml.in" nodelocaldns.yaml
+        sed -i -e "s/{{ pillar\['dns_domain'\] }}/${DNS_DOMAIN}/g" nodelocaldns.yaml
+        sed -i -e "s/{{ pillar\['dns_server'\] }}/${DNS_SERVER_IP}/g" nodelocaldns.yaml
+        sed -i -e "s/{{ pillar\['local_dns_ip'\] }}/${LOCAL_DNS_IP}/g" nodelocaldns.yaml
+        if [[ -n "${CLUSTER_IP_RANGE:-}" ]]; then
+            sed -i -e "s@{{ *pillar\['service_cluster_ip_range'\] *}}@${CLUSTER_IP_RANGE}@g" nodelocaldns.yaml
+        else
+            sed -i -e "s@{{ *pillar\['service_cluster_ip_range'\] *}}@0.0.0.0@g" nodelocaldns.yaml
+        fi
+        # TODO update to dns role once we have one.
+        # use kubectl to create nodelocaldns addon
+        ${KUBECTL} --kubeconfig="${CERT_DIR}/admin.kubeconfig" --namespace=kube-system create -f nodelocaldns.yaml
+        echo "NodeLocalDNS addon successfully deployed."
+        rm nodelocaldns.yaml
+    fi
+}
+
 function start_kubedashboard {
     if [[ "${ENABLE_CLUSTER_DASHBOARD}" = true ]]; then
         echo "Creating kubernetes-dashboard"
@@ -1056,6 +1081,7 @@ if [[ "${START_MODE}" != "kubeletonly" ]]; then
   fi
   start_kubeproxy
   start_kubedns
+  start_nodelocaldns
   start_kubedashboard
 fi