kubernetes配置自定義域名記錄

 問題背景

        客戶業務pod運行在內網，無法訪問外網，對於一些應用，需要訪問企業微信，淘寶等外部api接口時，采用代理的方式，即配置pod要訪問的外部域名解析為內部代理服務器的ip，如配置api.weixin.qq.com,pod請求訪問此域名時，dns解析為內部代理服務器ip-10.xxx.xx.xx,即需要自定義域名解析，經調研，有如下方式：

 

1.客戶存在內網dns，且該內網dns可以解析用戶需要的域名。這種情況只需要確保coredns所在的宿主機的/etc/resolv.conf中配了該dns即可。

2.使用kubernetes原生的hostalias功能，對於每個pod額外配置dns記錄（https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases/）

apiVersion: v1

kind: Pod

metadata:

  name: hostaliases-pod

spec:

  restartPolicy: Never

  hostAliases:

  - ip: "127.0.0.1"

    hostnames:

    - "foo.local"

    - "bar.local"

  - ip: "10.1.2.3"

    hostnames:

    - "foo.remote"

    - "bar.remote"

  containers:

  - name: cat-hosts

    image: busybox

    command:

    - cat

    args:

    - "/etc/hosts"

 

3使用coredns來做集群內全局的記錄增加

3.1用file插件（單獨配置a記錄用，也可以做轉發但配置不直觀，這里不寫了）

 

首先修改coredns的configmap，kubectl -n kube-system edit cm coredns
默認情況下如下

apiVersion: v1

data:

  Corefile: |

    .:53 {

        errors

        health

        kubernetes cluster.local in-addr.arpa ip6.arpa {

           pods insecure

           upstream

           fallthrough in-addr.arpa ip6.arpa

        }

        prometheus :9153

        proxy . /etc/resolv.conf

        cache 30

        loop

        reload

        loadbalance

    }

kind: ConfigMap

metadata:

  creationTimestamp: "2019-06-18T08:10:05Z"

  name: coredns

  namespace: kube-system

  resourceVersion: "181"

  selfLink: /api/v1/namespaces/kube-system/configmaps/coredns

  uid: 7abf504f-91a0-11e9-8570-52540089b1e0

我們將其修改為

apiVersion: v1

data:

  Corefile: |

    .:53 {

        errors

        health

        kubernetes cluster.local in-addr.arpa ip6.arpa {

           pods insecure

           upstream

           fallthrough in-addr.arpa ip6.arpa

        }

        prometheus :9153

        file /etc/coredns/example.db example.org //使用中將example.org換為根域名

        proxy . /etc/resolv.conf

        cache 30

        loop

        reload

        loadbalance

    }

  example.db: |

    example.org.            IN      SOA     sns.dns.icann.org. noc.dns.icann.org. 2019062541 7200 3600 1209600 3600 // 修改example.org.換為對應的，不要漏了.

    xxx.example.org.            IN      A       1.1.1.1 // 對應a記錄在這里添加,用戶想加幾個域名就仿照這行格式在下面增加

kind: ConfigMap

metadata:

  creationTimestamp: "2019-06-18T08:10:05Z"

  name: coredns

  namespace: kube-system

  resourceVersion: "181"

  selfLink: /api/v1/namespaces/kube-system/configmaps/coredns

  uid: 7abf504f-91a0-11e9-8570-52540089b1e0

修改后保存即可。
之后修改coredns的deployment，將example.db掛載進去 kubectl -n kube-system edit deploy coredns
找到volumes

volumes:

- configMap:

    defaultMode: 420

    items:

    - key: Corefile

      path: Corefile

    name: coredns

  name: config-volume

將其改為

volumes:

 - name: config-volume

   configMap:

     name: coredns

     items:

     - key: Corefile

       path: Corefile

     - key: example.db

       path: example.db

然后保存退出即可。

 

3.2用hosts插件(單獨配置a記錄用）https://coredns.io/plugins/hosts/

 

首先修改coredns的configmap，kubectl -n kube-system edit cm coredns
默認情況下如下

apiVersion: v1

data:

  Corefile: |

    .:53 {

        errors

        health

        kubernetes cluster.local in-addr.arpa ip6.arpa {

           pods insecure

           upstream

           fallthrough in-addr.arpa ip6.arpa

        }

        prometheus :9153

        proxy . /etc/resolv.conf

        cache 30

        loop

        reload

        loadbalance

    }

kind: ConfigMap

metadata:

  creationTimestamp: "2019-06-18T08:10:05Z"

  name: coredns

  namespace: kube-system

  resourceVersion: "181"

  selfLink: /api/v1/namespaces/kube-system/configmaps/coredns

  uid: 7abf504f-91a0-11e9-8570-52540089b1e0

我們將其修改為

apiVersion: v1

data:

  Corefile: |

    .:53 {

        errors

        health

        kubernetes cluster.local in-addr.arpa ip6.arpa {

           pods insecure

           upstream

           fallthrough in-addr.arpa ip6.arpa

        }

        prometheus :9153

        hosts example.org { //修改這里，example.org為根域名

            10.0.0.1 bbb.example.org //這里就跟本地配host格式一樣

            fallthrough

        }

        // 這里如果宿主機配了hosts，也可以直接寫hosts，不用上面的寫法

        proxy . /etc/resolv.conf

        cache 30

        loop

        reload

        loadbalance

    }

kind: ConfigMap

metadata:

  creationTimestamp: "2019-06-18T08:10:05Z"

  name: coredns

  namespace: kube-system

  resourceVersion: "181"

  selfLink: /api/v1/namespaces/kube-system/configmaps/coredns

  uid: 7abf504f-91a0-11e9-8570-52540089b1e0

修改后保存即可。然后重建下coredns的pod就行

 

3.3用fowrad插件（做解析轉發用）https://coredns.io/plugins/forward/

 

首先修改coredns的configmap，kubectl -n kube-system edit cm coredns
默認情況下如下

apiVersion: v1

data:

  Corefile: |

    .:53 {

        errors

        health

        kubernetes cluster.local in-addr.arpa ip6.arpa {

           pods insecure

           upstream

           fallthrough in-addr.arpa ip6.arpa

        }

        prometheus :9153

        proxy . /etc/resolv.conf

        cache 30

        loop

        reload

        loadbalance

    }

kind: ConfigMap

metadata:

  creationTimestamp: "2019-06-18T08:10:05Z"

  name: coredns

  namespace: kube-system

  resourceVersion: "181"

  selfLink: /api/v1/namespaces/kube-system/configmaps/coredns

  uid: 7abf504f-91a0-11e9-8570-52540089b1e0

我們將其修改為

apiVersion: v1

data:

  Corefile: |

    .:53 {

        errors

        health

        kubernetes cluster.local in-addr.arpa ip6.arpa {

           pods insecure

           upstream

           fallthrough in-addr.arpa ip6.arpa

        }

        prometheus :9153

        forward example.org. 127.0.0.1:9005 127.0.0.1:9006 // 這里example.org.是根域名，后面是客戶的dns服務器地址，可以寫多個

        proxy . /etc/resolv.conf

        cache 30

        loop

        reload

        loadbalance

    }

kind: ConfigMap

metadata:

  creationTimestamp: "2019-06-18T08:10:05Z"

  name: coredns

  namespace: kube-system

  resourceVersion: "181"

  selfLink: /api/v1/namespaces/kube-system/configmaps/coredns

  uid: 7abf504f-91a0-11e9-8570-52540089b1e0

修改后保存即可。然后重建下coredns的pod就行