DNS 组件历史版本有skydns、kube-dns和coredns三个,k8s1.3版本之前使用skydns,之后的版本到1.17及之间的版本使用kube-dns,目前主要使用coredns,DNS组件用于解析k8s集群中service name 所对应的ip地址 官方文档: coreDNS官方文档 获取官方包和yaml文件: 官方包和yaml文件地址
github搜索kubernetes,找到相应的k8s版本,点击changelog 需要下载这几个包: client: server: node: 下载之后上传到master并解压,解压之后的目录结构如下图: 相关yaml文件和插件目录,如dns,dashboard等 相关二进制文件: coredns一般用coredns.yaml.base 修改
官方yaml文件:
# __MACHINE_GENERATED_WARNING__ apiVersion: v1 kind: ServiceAccount metadata: name: coredns namespace: kube-system labels: kubernetes.io/cluster-service: "true" addonmanager.kubernetes.io/mode: Reconcile --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: labels: kubernetes.io/bootstrapping: rbac-defaults addonmanager.kubernetes.io/mode: Reconcile name: system:coredns rules: - apiGroups: - "" resources: - endpoints - services - pods - namespaces verbs: - list - watch - apiGroups: - "" resources: - nodes verbs: - get - apiGroups: - discovery.k8s.io resources: - endpointslices verbs: - list - watch --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: annotations: rbac.authorization.kubernetes.io/autoupdate: "true" labels: kubernetes.io/bootstrapping: rbac-defaults addonmanager.kubernetes.io/mode: EnsureExists name: system:coredns roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: system:coredns subjects: - kind: ServiceAccount name: coredns namespace: kube-system --- apiVersion: v1 kind: ConfigMap metadata: name: coredns namespace: kube-system labels: addonmanager.kubernetes.io/mode: EnsureExists data: Corefile: | .:53 { #errors:错误信息标准输出 errors #心跳检测,检测服务是否存活,在CoreDNS的http://localhost:8080/health端口提供CoreDNS服务的健康报告 health { lameduck 5s } #监听8181端口,当coredns的插件已经就绪时,访问该接口会返回200 OK ready #需要修改的地方(__DNS__DOMAIN__),这个是在创建k8s集群时在/etc/kubeasz/clusters/k8s-cluster/hosts中指定的CLUSTER_DNS_DOMAIN="clusterdujie.local" kubernetes kubernetes clusterdujie.local in-addr.arpa ip6.arpa { pods insecure fallthrough in-addr.arpa ip6.arpa ttl 30 } prometheus :9153 #forward就表示coredns解析不了的dns域名往哪里转发。可以指向公司内部dns地址 forward . 223.6.6.6 { max_concurrent 1000 } #dns缓存,如果第一次请求,先去etcd查询再用coredns缓存30s,如果30s内再有请求访问直接通过缓存返回 cache 30 #检测域名解析是否有死循环,如coredns转发给内网DNS服务器,而内网服务器又转发给coredns,如果发现解析时死循环,则强制终止coredns进程(kubernetes会重建),如果不加该参数可能会导致coredns资源利用率非常高甚至卡死 loop #检测corefile是否更改,再重新编辑configmap配置后,默认2分钟会优雅的自动加载新的配置 reload #轮询DNS域名解析,如果一个域名存在多个记录则轮询解析 loadbalance } #把myserver。online的请求转发到下面的地址 myserver.online { forward . 192.168.17.131:53 } --- apiVersion: apps/v1 kind: Deployment metadata: name: coredns namespace: kube-system labels: k8s-app: kube-dns kubernetes.io/cluster-service: "true" addonmanager.kubernetes.io/mode: Reconcile kubernetes.io/name: "CoreDNS" spec: # replicas: not specified here: # 1. In order to make Addon Manager do not reconcile this replicas parameter. # 2. Default is 1. # 3. Will be tuned in real time if DNS horizontal auto-scaling is turned on. strategy: type: RollingUpdate rollingUpdate: maxUnavailable: 1 selector: matchLabels: k8s-app: kube-dns template: metadata: labels: k8s-app: kube-dns spec: securityContext: seccompProfile: type: RuntimeDefault priorityClassName: system-cluster-critical serviceAccountName: coredns affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: - weight: 100 podAffinityTerm: labelSelector: matchExpressions: - key: k8s-app operator: In values: ["kube-dns"] topologyKey: kubernetes.io/hostname tolerations: - key: "CriticalAddonsOnly" operator: "Exists" nodeSelector: kubernetes.io/os: linux containers: - name: coredns #镜像地址默认是谷歌的,需要更换成国内镜像源或者官方hub仓库源,下面可以看图 image: coredns/coredns:1.8.6 imagePullPolicy: IfNotPresent resources: #限制coredns可以使用多少资源 limits: memory: 200Mi #200毫核 ,一般生产会写2000Mi 或者直接写2 requests: cpu: 100m memory: 70Mi args: [ "-conf", "/etc/coredns/Corefile" ] volumeMounts: - name: config-volume mountPath: /etc/coredns readOnly: true ports: - containerPort: 53 name: dns protocol: UDP - containerPort: 53 name: dns-tcp protocol: TCP - containerPort: 9153 name: metrics protocol: TCP livenessProbe: httpGet: path: /health port: 8080 scheme: HTTP initialDelaySeconds: 60 timeoutSeconds: 5 successThreshold: 1 failureThreshold: 5 readinessProbe: httpGet: path: /ready port: 8181 scheme: HTTP securityContext: allowPrivilegeEscalation: false capabilities: add: - NET_BIND_SERVICE drop: - all readOnlyRootFilesystem: true dnsPolicy: Default volumes: - name: config-volume configMap: name: coredns items: - key: Corefile path: Corefile --- apiVersion: v1 kind: Service metadata: name: kube-dns namespace: kube-system annotations: prometheus.io/port: "9153" prometheus.io/scrape: "true" labels: k8s-app: kube-dns kubernetes.io/cluster-service: "true" addonmanager.kubernetes.io/mode: Reconcile kubernetes.io/name: "CoreDNS" spec: selector: k8s-app: kube-dns #clusterIP:dns地址,这个地址可以创建一个pod然后查看pod的/etc/resolv.conf的namespaces查看,如下面 clusterIP: 10.100.0.2 ports: - name: dns port: 53 protocol: UDP - name: dns-tcp port: 53 protocol: TCP - name: metrics port: 9153 protocol: TCP
查看coredns的svc地址,上面的10.100.0.1是kubernetes的api的地址,k8s内部会将第一个地址分配给apiserver 镜像更换:
修改完成后apply -f coredns.yaml,启动成功后进入pod查看是否能够进行域名解析测试 nslookup测试该域名是否可以解析 一般会将coredns多副本,保证业务解析正常,会以轮询的方式请求,或者修改limit占用资源。一般cpu为2核,内存为3个Gi就够了,如果不够就多副本 k8s域名固定格式: ping kube-dns.kube-system.svc.clusterdujie.local 名称.namespace.svc.域名后缀 coredns性能优化: 1、(pod级别缓存)在pod中添加dnsmasq缓存,优缺点:pod自己缓存自己的,缓存不共享是隔离的,每个容器中都需要添加域名解析记录 2、(node级别缓存)缓存放在node上,localdns,pod第一次宿主机请求的时候,宿主机向coredns请求解析,获取解析后缓存到node,下次pod再请求直接通过node节点的localdns直接返回给pod
[root@master01 ~]# vim /etc/kubeasz/clusters/k8s-cluster/config.yml 3、(coredns级别缓存)在coredns容器里,修改缓存时间,默认30s,可以调成180s,不过需要coredns内存比较大,,缓存时间设置不要太长也不要太短