Continuous DNS Queries to pypi.org on vCenter 9.1

Products

• VMware vCenter Server

Issue/Introduction

• vCenter 9.1.0.0300 appliances generates continuous DNS queries (A and AAAA records) for the external domain pypi.org.
  
  
• Queries originate locally from 127.0.0.1 via the appliance's local dnsmasq process and the behavior consistently recurs across all newly deployed vCenter appliances.

•  /var/log/vmware/dnsmasq.log in vCenter server appliance reports,
  
  dnsmasq[###]: query[A] pypi.org from 127.0.0.1
dnsmasq[###]: cached pypi.org is #####
dnsmasq[###]: query[AAAA] pypi.org from 127.0.0.1
dnsmasq[###]: cached pypi.org is NODATA-IPv6

Environment

VMware vCenter Server 9.1

Cause

The behavior results from two interacting components in the vCenter appliance:

• Salt/Pip Version Check: During provisioning or package installation, the embedded Salt interpreter runs pip install. Even with local wheels, pip queries pypi.org to check for self-version updates.

• Envoy Proxy Resident Cluster: This outbound query causes vmware-envoy-system-proxy to create an ephemeral cluster for pypi.org that stays active for the process's lifetime. Due to Fastly CDN’s short TTL, Envoy continuously re-resolves the domain name (~every 5 seconds) to maintain cluster state, even without active connections.

Resolution

Broadcom is aware of this issue. A permanent fix is planned for a future release.

Workaround

To stop the continuous DNS queries, restart the Envoy system proxy service to clear the ephemeral pypi.org cluster:

1. Log in to the vCenter Server Appliance via SSH.
   
   
2. Restart the Envoy system proxy service by running the following command: 
   service-control --restart vmware-envoy-system-proxy