> ## Documentation Index > Fetch the complete documentation index at: https://docs.celum.io/llms.txt > Use this file to discover all available pages before exploring further. # Get node DNS > Node DNS — Networking → DNS (node_dns.go). **Authorisation:** `cilium:GetState` on `krn:celum:supervisor:{name}:cilium:*`. **Assistant tool:** `get_node_dns` ## OpenAPI ````yaml /openapi.json get /api/supervisors/{name}/networking/dns openapi: 3.0.3 info: description: >- The HTTP surface of the Celum backend, generated from its own router and authorisation map — so this list cannot drift from the server that serves it. **Every operation states the IAM action and resource it is authorised against.** That pairing is the part worth reading: a policy naming the right action against the wrong resource matches nothing, and fails silently. Request and response bodies come from the Go types the handlers send and decode. Where those types do not determine the shape (an interface, a map[string]any, an unknown custom encoding), the operation says so in `x-celum-schema-gap` instead of carrying a guessed schema. title: Celum API version: 1.0.0 servers: - description: Your Celum deployment url: https://{host} variables: host: default: celum.example.com description: The host your Celum backend is served from security: - sessionCookie: [] - bearerToken: [] tags: - description: AI assistant & MCP name: ai-assistant - description: Clusters & CAPI lifecycle name: capi - description: Certificates & external secrets name: certs - description: GitOps & apps name: gitops - description: IAM, audit & auth name: iam - description: Image library name: images - description: Infrastructure & supervisors name: infrastructure - description: Networking name: networking - description: Observability & platform health name: observability - description: Platform onboarding & settings name: platform-settings - description: Projects name: projects - description: Registries & mirroring name: registries - description: Security & flows name: security - description: Storage name: storage - description: Templates & addons name: templates - description: Virtualization platform (KubeVirt/CDI) name: virt - description: Virtual machines name: vms - description: Workloads & topology name: workloads paths: /api/supervisors/{name}/networking/dns: get: tags: - networking summary: Get node DNS description: >- Node DNS — Networking → DNS (node_dns.go). **Authorisation:** `cilium:GetState` on `krn:celum:supervisor:{name}:cilium:*`. **Assistant tool:** `get_node_dns` operationId: get_supervisors_byName_networking_dns parameters: - description: >- The supervisor's name, as registered under Administration → Supervisors. in: path name: name required: true schema: type: string responses: '200': content: application/json: schema: $ref: '#/components/schemas/api.nodeDNSResponse' description: Success. '401': description: Not authenticated — no valid session cookie or API token. '403': description: >- Authenticated, but no policy allows this action on this resource. The body carries the action and resource that were evaluated. '502': content: application/json: schema: $ref: '#/components/schemas/api.ErrorBody' description: Bad Gateway. components: schemas: api.nodeDNSResponse: properties: global: $ref: '#/components/schemas/api.nodeDNSInherited' ownedHere: type: boolean owner: type: string settings: $ref: '#/components/schemas/k8s.NodeDNS' status: $ref: '#/components/schemas/api.nodeDNSStatus' required: - global - ownedHere - settings - status type: object x-go-type: backend/internal/api.nodeDNSResponse api.ErrorBody: properties: error: type: string required: - error type: object api.nodeDNSInherited: properties: error: type: string honeypot: type: boolean revision: type: string rules: items: $ref: '#/components/schemas/api.inheritedRule' nullable: true type: array sinkholeIpv4: type: string sinkholeIpv6: type: string threatBlock: type: boolean updatedAt: format: date-time type: string updatedBy: type: string upstreams: items: type: string nullable: true type: array upstreamsInherited: type: boolean required: - rules - threatBlock - upstreams - upstreamsInherited type: object x-go-type: backend/internal/api.nodeDNSInherited k8s.NodeDNS: properties: cacheSeconds: format: int64 type: integer capture: type: boolean enabled: type: boolean enforce: type: boolean honeypot: type: string queryLog: type: boolean redirect: type: boolean rules: items: $ref: '#/components/schemas/k8s.NodeDNSRule' nullable: true type: array sinkholeIpv4: type: string sinkholeIpv6: type: string upstreams: items: type: string nullable: true type: array required: - cacheSeconds - capture - enabled - enforce - honeypot - queryLog - redirect - rules - sinkholeIpv4 - sinkholeIpv6 - upstreams type: object x-go-type: backend/internal/k8s.NodeDNS api.nodeDNSStatus: properties: agentInstalled: type: boolean allowPolicy: type: boolean capture: $ref: '#/components/schemas/api.nodeDNSCaptureStatus' central: $ref: '#/components/schemas/api.nodeDNSCentralStatus' ciliumLocalRedirect: type: boolean clusterDomain: type: string corednsImage: type: string desired: format: int64 type: integer encryptedDns: $ref: '#/components/schemas/api.nodeDNSEncryptedStatus' enforcePolicy: type: boolean globalRevision: type: string image: type: string messages: items: type: string type: array nodes: items: $ref: '#/components/schemas/api.nodeDNSNodeStatus' nullable: true type: array queryLogReceiver: type: boolean ready: format: int64 type: integer redirected: type: boolean rulesApplied: items: type: string nullable: true type: array running: type: boolean socketLBHostNamespaceOnly: type: boolean threats: $ref: '#/components/schemas/api.nodeDNSThreatStatus' updated: format: int64 type: integer upstreamIp: type: string required: - agentInstalled - allowPolicy - capture - central - ciliumLocalRedirect - clusterDomain - desired - encryptedDns - enforcePolicy - nodes - queryLogReceiver - ready - redirected - rulesApplied - running - socketLBHostNamespaceOnly - threats - updated type: object x-go-type: backend/internal/api.nodeDNSStatus api.inheritedRule: properties: action: type: string answers: items: type: string type: array comment: type: string name: type: string pattern: type: string reason: type: string servers: items: type: string type: array state: type: string ttl: format: int64 type: integer types: items: type: string type: array zone: type: string required: - action - state type: object x-go-type: backend/internal/api.inheritedRule k8s.NodeDNSRule: properties: action: type: string answers: items: type: string type: array comment: type: string name: type: string pattern: type: string servers: items: type: string type: array ttl: format: int64 type: integer types: items: type: string type: array zone: type: string required: - action type: object x-go-type: backend/internal/k8s.NodeDNSRule api.nodeDNSCaptureStatus: properties: bridgedDns: items: $ref: '#/components/schemas/api.bridgedVMDNS' type: array enabled: type: boolean nodes: items: $ref: '#/components/schemas/api.nodeDNSCaptureNode' nullable: true type: array target: type: string required: - enabled - nodes type: object x-go-type: backend/internal/api.nodeDNSCaptureStatus api.nodeDNSCentralStatus: properties: desired: format: int64 type: integer filterReady: format: int64 type: integer ready: format: int64 type: integer running: type: boolean serviceIp: type: string required: - desired - filterReady - ready - running type: object x-go-type: backend/internal/api.nodeDNSCentralStatus api.nodeDNSEncryptedStatus: properties: block: type: boolean error: type: string filterRevision: type: string names: format: int64 type: integer required: - block - names type: object x-go-type: backend/internal/api.nodeDNSEncryptedStatus api.nodeDNSNodeStatus: properties: node: type: string pod: type: string ready: type: boolean required: - node - pod - ready type: object x-go-type: backend/internal/api.nodeDNSNodeStatus api.nodeDNSThreatStatus: properties: allowed: format: int64 type: integer block: type: boolean capped: format: int64 type: integer error: type: string honeypot: $ref: '#/components/schemas/api.dnsHoneypotStatus' inCluster: format: int64 type: integer names: format: int64 type: integer own: format: int64 type: integer shards: format: int64 type: integer sinkholeFrom: type: string sinkholeIpv4: type: string sinkholeIpv6: type: string required: - allowed - block - capped - inCluster - names - own - shards type: object x-go-type: backend/internal/api.nodeDNSThreatStatus api.bridgedVMDNS: properties: machine: type: string nameservers: items: type: string nullable: true type: array throughSupervisor: type: boolean unknown: type: string vm: type: string required: - nameservers - throughSupervisor - vm type: object x-go-type: backend/internal/api.bridgedVMDNS api.nodeDNSCaptureNode: properties: bridged: items: type: string nullable: true type: array captured: format: int64 type: integer dnatTo: type: string eligible: format: int64 type: integer error: type: string failed: items: type: string nullable: true type: array node: type: string pending: format: int64 type: integer target: type: string required: - bridged - captured - eligible - failed - node - pending type: object x-go-type: backend/internal/api.nodeDNSCaptureNode api.dnsHoneypotStatus: properties: address: type: string allPorts: type: boolean image: type: string message: type: string podAddress: type: string ready: type: boolean required: - allPorts - ready type: object x-go-type: backend/internal/api.dnsHoneypotStatus securitySchemes: sessionCookie: description: >- The session cookie issued by the OIDC sign-in flow. This is what a browser uses. in: cookie name: k8s-gate-session type: apiKey bearerToken: description: >- An API token, minted from your own identity page. A token carries the IAM groups you held **when it was minted**, and cannot bypass deletion approval — except for guest clusters inside a project that same token created. scheme: bearer type: http ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.