Building-permits pods report failures talking to an internal API. One symptom is NXDOMAIN from dig; another is connection refused after a name resolves to the Service ClusterIP. What distinction should the admin draw?
Select an answer to reveal the explanation.
Short Explanation
Think of looking up a restaurant: NXDOMAIN is “that place isn’t in the phone book,” while connection refused is “you found the address but nobody opened the door.” DNS success only proves the name maps to an IP—usually the Service ClusterIP—not that a Pod is listening on the port. Fix the wrong layer: missing Service/DNS name versus empty endpoints or a crashed container.
Full Explanation
Building-permits pods that report NXDOMAIN from dig in one case and connection refused after a name resolves to the Service ClusterIP in another illustrate two different layers. NXDOMAIN means DNS never found the name—often a wrong Service name, namespace, or search domain—so no IP was returned. Connection refused after a successful A/AAAA answer means DNS worked but nothing accepted TCP on that IP and port—commonly empty Endpoints, a crashed container, or a wrong port. Phone-book miss versus nobody opening the door must not be conflated.
Both symptoms do not prove the CoreDNS ConfigMap lost its kubernetes plugin; connection refused especially points downstream of DNS. Connection refused does not always mean NetworkPolicy dropped the packet before it left the node—policy drops frequently look like timeouts, while refused indicates an active rejection with no listener. NXDOMAIN does not occur only when the Service type is NodePort instead of ClusterIP.
Exam caveat: capture dig output before changing CoreDNS. A valid ClusterIP with no ready Endpoints is a classic CKA pattern for “name works, connect fails.” Fix the failing layer only.
Operational check: dig the internal API name from a client Pod; on NXDOMAIN, correct naming or CoreDNS. On an IP answer, curl the ClusterIP and port, then inspect EndpointSlices and container readiness/ports to explain refused connections. Keep a short runbook snippet that maps each error string to the layer to inspect first.