/**
 * [DNS over HTTPS implementation][doh_spec].
 *
 * > A DNS API client encodes a single DNS query into an HTTP request
 * > using either the HTTP GET or POST method and the other requirements
 * > of this section.  The DNS API server defines the URI used by the
 * > request through the use of a URI Template.
 *
 * [doh_spec]: https://tools.ietf.org/html/draft-ietf-doh-dns-over-https-13
 */

	}
	if err == nil && dnsURL != "" {
		bootstrapTraceMsg("initialize remote bucket DNS store")
		globalDNSConfig, err = dns.NewOperatorDNS(dnsURL,
			dns.Authentication(dnsUser, dnsPass),
			dns.RootCAs(globalRootCAs))
		if err != nil {
			configLogIf(ctx, fmt.Errorf("Unable to initialize remote webhook DNS config %w", err))
		}
	}

      panels.timeSeries.bytesRate('Bytes Transmitted', queries.bytes, 'Bytes sent and received per instance'),
      panels.timeSeries.dns('DNS Request', queries.dns, 'DNS queries received per instance'),
    ]),
    row.new('Operations')
    + row.withPanels([
      panels.timeSeries.base(
        'XDS Connections', queries.ztunnelXdsConnections, |||

///

### DNS

Now let's focus on all the actual HTTPS parts.

First, the browser would check with the **DNS servers** what is the **IP for the domain**, in this case, `someapp.example.com`.

The DNS servers would tell the browser to use some specific **IP address**. That would be the public IP address used by your server, that you configured in the DNS servers.

<img src="/img/deployment/https/https01.svg">

		cancel()
		if err != nil {
			return err
		}
	}
	return nil
}

// String stringer name for this implementation of dns.Store
func (c *CoreDNS) String() string {
	return "etcdDNS"
}

// CoreDNS - represents dns config for coredns server.
type CoreDNS struct {
	domainNames []string
	domainIPs   set.StringSet
	domainPort  string
	prefixPath  string

{
  "cniVersion": "0.3.1",
  "name": "k8s-pod-network",
  "plugins": [
    {
      "bridge": "cni0",
      "dns": {
        "nameservers": [
          "10.1.0.1"
        ]
      },
      "ipam": {
        "gateway": "10.1.0.1",
        "subnet": "10.1.0.0/16",
        "type": "host-local"
      },
      "name": "dbnet",
      "type": "bridge"
    },
    {
      "ambient_enabled": false,

// along with this program.  If not, see <http://www.gnu.org/licenses/>.

package dns

import (
	"path"
	"strings"

	"github.com/miekg/dns"
)

// msgPath converts a domainname to an etcd path. If s looks like service.staging.skydns.local.,
// the resulting key will be /skydns/local/skydns/staging/service .
func msgPath(s, prefix string) string {
	l := dns.SplitDomainName(s)
	for i, j := 0, len(l)-1; i < j; i, j = i+1, j-1 {

```
KEY:
etcd  federate multiple clusters for IAM and Bucket DNS

ARGS:
endpoints*       (csv)       comma separated list of etcd endpoints e.g. "http://localhost:2379"
path_prefix      (path)      namespace prefix to isolate tenants e.g. "customer1/"
coredns_path     (path)      shared bucket DNS records, default is "/skydns"
client_cert      (path)      client cert for mTLS authentication

{
  "cniVersion": "0.4.0",
  "name": "dbnet",
  "plugins": [
    {
      "args": {
        "labels": {
          "appVersion": "1.0"
        }
      },
      "bridge": "cni0",
      "dns": {
        "nameservers": [
          "10.1.0.1"
        ]
      },
      "ipam": {
        "gateway": "10.1.0.1",
        "subnet": "10.1.0.0/16",
        "type": "host-local"
      },
      "type": "bridge"
    },
    {

{
  "cniVersion": "0.4.0",
  "name": "dbnet",
  "plugins": [
    {
      "args": {
        "labels": {
          "appVersion": "1.0"
        }
      },
      "bridge": "cni0",
      "dns": {
        "nameservers": [
          "10.1.0.1"
        ]
      },
      "ipam": {
        "gateway": "10.1.0.1",
        "subnet": "10.1.0.0/16",
        "type": "host-local"
      },
      "type": "bridge"
    },
    {