Support configuring node DNS resolver via NodeConfig

[stevo-f3]

What would you like to be added: Make it possible to pass DNS server IPs via NodeConfig to be used by the EKS node / EC2 instance instead of VPC+2;

Ideally it would be possible also to limit interfaces node local resolver is listening on, so that k8s cluster's coredns can run on the host network, that coredns can forward queries to node local resolver and not clash with it.

Why is this needed: To be able to use custom DNS firewall at least temporarily (to support migration from AL2 -> AL2023 first, before migrating to Route 53 Resolver DNS Firewall)

Please correct me if wrong, but I don't see in the docs that this feature is currently supported.

[ndbaker1]

instance DNS could be an interesting part of the NodeConfig api, but not sure how much of it is useful in the normal path.

How tightly coupled is this request to your current infra on AL2? Do you already have a work around today? you can add dns nameservers to systemd-resolved today using either drop-in configs or one of systemd-resolve/resolvectl (which are also specific to interfaces). the build of systemd in AL23 today also notably has the stub resolver disabled

[stevo-f3]

Need to use and enforce use of ideally custom DNS firewall. Custom DNS firewall is more capable, observable and cheaper.

Before with customized AL2 AMI, could configure iptables and use dnsmasq to forward requests from instance to custom firewall and it only, disallow VPC+2 use.

For the moment workaround is to block :53 on the instances, and use VPC+2 and Route 53 Resolver DNS Firewall.