kubernetes內部是有dns的，可以解析集群內部service，應用之間可以通過service名稱連接調用。但是節點本身不能直接解析service名稱，只能聯通service或者pod的ip。
# kubectl get svc -n kube-system NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE kube-dns ClusterIP 10.96.0.10 <none> 53/UDP,53/TCP,9153/TCP 30d # nslookup kube-dns.kube-system.svc.cluster.local Server: 114.114.114.114 Address: 114.114.114.114#53 ** server can't find kube-dns.kube-system.svc.cluster.local: NXDOMAIN
節點是可以直接和集群中的ip互通的
# ping 10.96.0.10 PING 10.96.0.10 (10.96.0.10) 56(84) bytes of data. 64 bytes from 10.96.0.10: icmp_seq=1 ttl=64 time=0.188 ms 64 bytes from 10.96.0.10: icmp_seq=2 ttl=64 time=0.081 ms # telnet 10.96.0.10 53 Trying 10.96.0.10... Connected to 10.96.0.10. Escape character is '^]'.
可以在kubernetes集群內部再部署一個DNS，將集群內部是service名稱的解析指向集群中coreDNS。
# dig @10.96.0.10 -p 53 kube-dns.kube-system.svc.cluster.local
; <<>> DiG 9.11.4-P2-RedHat-9.11.4-26.P2.el8 <<>> @10.96.0.10 -p 53 kube-dns.kube-system.svc.cluster.local
; (1 server found)
;; global options: +cmd
;; Got answer:
;; WARNING: .local is reserved for Multicast DNS
;; You are currently testing what happens when an mDNS query is leaked to DNS
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 24191
;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
;; WARNING: recursion requested but not available
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
; COOKIE: af23a208ee4cfce3 (echoed)
;; QUESTION SECTION:
;kube-dns.kube-system.svc.cluster.local. IN A
;; ANSWER SECTION:
kube-dns.kube-system.svc.cluster.local. 5 IN A 10.96.0.10
;; Query time: 3 msec
;; SERVER: 10.96.0.10#53(10.96.0.10)
;; WHEN: Thu Nov 12 15:47:35 CST 2020
;; MSG SIZE rcvd: 133
-
10.96.0.10：集群內部coreDNS的servcie_ip
下載一個coreDNS
# wget https://github.com/coredns/coredns/releases/download/v1.8.0/coredns_1.8.0_linux_amd64.tgz # tar -zxvf coredns_1.8.0_linux_amd64.tgz
創建一個Corefile
cluster.local {
forward . 10.96.0.10
log
}
.:53 {
forward . 114.114.114.114
log
errors
cache
}
-
當請求cluster.local這個域名的解析請求時，coredns就會轉發到kubernetes集群內部的
10.96.0.10 -
其他請求還是走
114.114.114.114
coredns.service
/usr/lib/systemd/system/coredns.service
[Unit] Description=CoreDNS DNS server Documentation=https://coredns.io After=network.target [Service] PermissionsStartOnly=true LimitNOFILE=1048576 LimitNPROC=512 CapabilityBoundingSet=CAP_NET_BIND_SERVICE AmbientCapabilities=CAP_NET_BIND_SERVICE NoNewPrivileges=true User=coredns WorkingDirectory=~ ExecStart=/usr/local/bin/coredns -conf /data/coredns/Corefile ExecReload=/bin/kill -SIGUSR1 $MAINPID Restart=on-failure [Install] WantedBy=multi-user.target
groupadd coredns useradd -g coredns coredns
systemctl daemon-reload systemctl start coredns systemctl enable coredns
驗證
在集群集群節點中測試是否能解析集群中的service名稱
# dig @192.168.10.243 -p 53 kube-dns.kube-system.svc.cluster.local ; <<>> DiG 9.11.13-RedHat-9.11.13-6.el8_2.1 <<>> @192.168.10.243 -p 53 kube-dns.kube-system.svc.cluster.local ; (1 server found) ;; global options: +cmd ;; Got answer: ;; WARNING: .local is reserved for Multicast DNS ;; You are currently testing what happens when an mDNS query is leaked to DNS ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 56392 ;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1 ;; WARNING: recursion requested but not available ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 4096 ; COOKIE: 555ea5fc88fd299c (echoed) ;; QUESTION SECTION: ;kube-dns.kube-system.svc.cluster.local. IN A ;; ANSWER SECTION: kube-dns.kube-system.svc.cluster.local. 5 IN A 10.96.0.10 ;; Query time: 131 msec ;; SERVER: 192.168.10.243#53(192.168.10.243) ;; WHEN: Thu Nov 12 16:11:14 CST 2020 ;; MSG SIZE rcvd: 133
可以看到節點能直接解析集群內部的service名稱了，修改節點服務器的dns，就能直接聯通service
# ping kube-dns.kube-system.svc.cluster.local PING kube-dns.kube-system.svc.cluster.local (10.96.0.10) 56(84) bytes of data. 64 bytes from node01 (10.96.0.10): icmp_seq=1 ttl=64 time=0.106 ms 64 bytes from node01 (10.96.0.10): icmp_seq=2 ttl=64 time=0.062 ms 64 bytes from node01 (10.96.0.10): icmp_seq=3 ttl=64 time=0.064 ms 64 bytes from node01 (10.96.0.10): icmp_seq=4 ttl=64 time=0.087 ms
二、集群外部調整
調整外部機器的dns，將dns地址改為剛才部署的coredns的ip，這樣本機就能解析集群內部service名稱（windows）
C:\Windows\system32>nslookup kube-dns.kube-system.svc.cluster.local 服務器: UnKnown Address: 192.168.10.243 名稱: kube-dns.kube-system.svc.cluster.local Address: 10.96.0.10
此時還是ping不通service，因為集群外部沒有到service的路由，這需要添加到service的路由
查看kubernetes集群的service網段
/usr/lib/systemd/system/kube-apiserver.service service-cluster-ip-range=10.96.0.0/12 添加路由 route ADD 10.96.0.0/12 192.168.10.243 -p 查看 route PRINT
-
-p：參數，永久靜態路由
測試互通
C:\Windows\system32>ping kube-dns.kube-system.svc.cluster.local 正在 Ping kube-dns.kube-system.svc.cluster.local [10.96.0.10] 具有 32 字節的數據: 來自 10.96.0.10 的回復: 字節=32 時間<1ms TTL=64 來自 10.96.0.10 的回復: 字節=32 時間<1ms TTL=64 來自 10.96.0.10 的回復: 字節=32 時間<1ms TTL=64
訪問應用
grafana.monitoring.svc.cluster.local
