当前位置：网站首页>剖析kubernetes集群内部DNS解析原理
剖析kubernetes集群内部DNS解析原理
2022-07-25 05:34:00 【傻啦猫@[email protected]】
引言
说到DNS域名解析，大家想到最多的可能就是/etc/hosts文件，并没有什么错，但是/etc/hosts只能做到本机域名解析，如果跨机器的解析就有点捉襟见肘了。
在服务器中还有一个配置值得大家注意，/etc/resolv.conf，这个文件用于配置DNS服务器，使域名解析可以扩展到本机以外。
kubernetes集群使用到的就是这种机制。
原理
当kubernetes初始化完成后，在kube-system名称空间下会出现kube-dns的service服务与coredns的pod。
[[email protected] etc]# kubectl get svc -n kube-system
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
kube-dns ClusterIP 10.96.0.10 <none> 53/UDP,53/TCP,9153/TCP 14d
[[email protected] etc]# kubectl get pod -n kube-system -o wide| grep coredns
coredns-5897cd56c4-7ps2n 1/1 Running 9 14d 192.168.235.220 k8s-master <none> <none>
coredns-5897cd56c4-j7psj 1/1 Running 9 14d 192.168.235.221 k8s-master <none> <none>
[[email protected] etc]#
CoreDNS是一个DNS解析的组件，作为集群内的DNS服务器，为集群内部提供域名解析服务。比如说一个前端pod要通过service name访问后端pod，前端pod会先通过自身的dns文件(/etc/resolv.conf)指向dns服务器，由dns服务器做域名解析转换成对用的ip，然后通过ip访问到后端pod。
配置策略
在yaml中，通过dnsPolicy字段配置DNS策略，共有4种策略：
ClusterFirst：默认策略，表示使用集群内部的CoreDNS来做域名解析。
Default：Pod直接继承集群node节点的域名解析配置，也就是，Pod会直接使用宿主机上的/etc/resolv.conf文件内容。
None：忽略k8s集群环境中的DNS设置，Pod会使用其dnsConfig字段所提供的DNS配置。
ClusterFirstWithHostNet：宿主机与 Kubernetes 共存，这种情况下的POD，既能用宿主机的DNS服务，又能使用kube-dns的Dns服务，注意的是需要将hostNetwork打开。
部署验证
ClusterFirst
# deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
labels:
app: nginx-deploy
name: nginx-deploy
spec:
replicas: 2
selector:
matchLabels:
app: nginx-deploy
template:
metadata:
labels:
app: nginx-deploy
spec:
restartPolicy: Always
containers:
- name: mynginx
image: nginx
imagePullPolicy: IfNotPresent
dnsPolicy: ClusterFirst
[[email protected] test]# kubectl apply -f deployment.yaml
deployment.apps/nginx-deploy created
[[email protected] test]# kubectl get pod
NAME READY STATUS RESTARTS AGE
nginx-deploy-6d79d74f76-qp8pr 1/1 Running 0 77s
nginx-deploy-6d79d74f76-tjcxt 1/1 Running 0 77s
[[email protected] test]#
# 进入到容器内部
[[email protected] test]# kubectl exec -it nginx-deploy-6d79d74f76-qp8pr -c mynginx -- /bin/bash
[email protected]:/# cat /etc/resolv.conf
nameserver 10.96.0.10
search default.svc.cluster.local svc.cluster.local cluster.local pek3.qingcloud.com
options ndots:5
[email protected]:/#
# 访问service成功
[email protected]:/# curl nginx-deploy.default.svc:8000
<!DOCTYPE html>
<html>
...
<body>
<h1>Welcome to nginx!</h1>
...
</body>
</html>
[email protected]:/#
可以发现NDS服务器为10.96.0.10，这个地址我们在上面原理部分获取到的kube-dns的地址一致。说明ClusterFirst的策略使用集群内部的CoreDNS来做域名解析，并且成功解析的service域名。
Default
将yaml中的dnsPolicy: ClusterFirst修改为dnsPolicy: Default。
[[email protected] test]# kubectl apply -f deployment.yaml
deployment.apps/nginx-deploy created
[[email protected] test]# kubectl get pod
NAME READY STATUS RESTARTS AGE
nginx-deploy-85bd9d5f4c-js6fv 1/1 Running 0 5s
nginx-deploy-85bd9d5f4c-q8pxb 1/1 Running 0 5s
[[email protected] test]#
# 进入到容器内部
[[email protected] test]# kubectl exec -it nginx-deploy-85bd9d5f4c-js6fv -c mynginx -- /bin/bash
[email protected]:/# cat /etc/resolv.conf
nameserver 100.64.9.5
search pek3.qingcloud.com
[email protected]:/#
# 查看本机的 /etc/resolv.conf
[[email protected] test]# cat /etc/resolv.conf
# Generated by NetworkManager
search pek3.qingcloud.com
nameserver 100.64.9.5
[[email protected] test]#
# 访问service不成功
[email protected]:/# curl nginx-deploy.default.svc:8000
curl: (6) Could not resolve host: nginx-deploy.default.svc
[email protected]:/#
# 访问百度成功
[email protected]:/# curl www.baidu.com
<!DOCTYPE html>
<!--STATUS OK--><html> <head><meta http-equiv=content-type content=text/html;charset=utf-8><meta http-equiv=X-UA-Compatible content=IE=Edge><meta content=always name=referrer><link rel=stylesheet type=text/css href=http://s1.bdstatic.com/r/www/cache/bdorz/baidu.min.css><title>百度一下，你就知道</title></head> <body link=#0000cc> <div id=wrapper> <div id=head> <div class=head_wrapper> <div class=s_form> <div class=s_form_wrapper> <div id=lg> <img hidefocus=true src=//www.baidu.com/img/bd_logo1.png width=270 height=129> </div> <form id=form name=f action=//www.baidu.com/s class=fm> <input type=hidden name=bdorz_come value=1> <input type=hidden name=ie value=utf-8> <input type=hidden name=f value=8> <input type=hidden name=rsv_bp value=1> <input type=hidden name=rsv_idx value=1> <input type=hidden name=tn value=baidu><span class="bg s_ipt_wr"><input id=kw name=wd class=s_ipt value maxlength=255 autocomplete=off autofocus></span><span class="bg s_btn_wr"><input type=submit id=su value=百度一下 class="bg s_btn"></span> </form> </div> </div> <div id=u1> <a href=http://news.baidu.com name=tj_trnews class=mnav>新闻</a> <a href=http://www.hao123.com name=tj_trhao123 class=mnav>hao123</a> <a href=http://map.baidu.com name=tj_trmap class=mnav>地图</a> <a href=http://v.baidu.com name=tj_trvideo class=mnav>视频</a> <a href=http://tieba.baidu.com name=tj_trtieba class=mnav>贴吧</a> <noscript> <a href=http://www.baidu.com/bdorz/login.gif?login&tpl=mn&u=http%3A%2F%2Fwww.baidu.com%2f%3fbdorz_come%3d1 name=tj_login class=lb>登录</a> </noscript> <script>document.write('<a href="http://www.baidu.com/bdorz/login.gif?login&tpl=mn&u='+ encodeURIComponent(window.location.href+ (window.location.search === "" ? "?" : "&")+ "bdorz_come=1")+ '" name="tj_login" class="lb">登录</a>');</script> <a href=//www.baidu.com/more/ name=tj_briicon class=bri style="display: block;">更多产品</a> </div> </div> </div> <div id=ftCon> <div id=ftConw> <p id=lh> <a href=http://home.baidu.com>关于百度</a> <a href=http://ir.baidu.com>About Baidu</a> </p> <p id=cp>©2017 Baidu <a href=http://www.baidu.com/duty/>使用百度前必读</a> <a href=http://jianyi.baidu.com/ class=cp-feedback>意见反馈</a> 京ICP证030173号 <img src=//www.baidu.com/img/gs.gif> </p> </div> </div> </div> </body> </html>
[email protected]:/#
说明使用Default策略，Pod会直接使用宿主机上的/etc/resolv.conf文件内容，当然解析service域名是不能成功的。
None
# deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
labels:
app: nginx-deploy
name: nginx-deploy
spec:
replicas: 2
selector:
matchLabels:
app: nginx-deploy
template:
metadata:
labels:
app: nginx-deploy
spec:
restartPolicy: Always
containers:
- name: mynginx
image: nginx
imagePullPolicy: IfNotPresent
dnsPolicy: None
dnsConfig:
nameservers: ["172.31.0.3","172.31.0.4"]
searches:
- default.svc.cluster.local
- svc.cluster.local
- cluster.local
options:
- name: ndots
value: "5"
[[email protected] test]# kubectl apply -f deployment.yaml
deployment.apps/nginx-deploy created
[[email protected] test]# kubectl get pod
NAME READY STATUS RESTARTS AGE
nginx-deploy-6699fcc589-7nrn7 1/1 Running 0 7s
nginx-deploy-6699fcc589-8sk8p 1/1 Running 0 7s
[[email protected] test]#
# 进入到容器内部
[[email protected] test]# kubectl exec -it nginx-deploy-6699fcc589-7nrn7 -c mynginx -- /bin/bash
[email protected]:/# cat /etc/resolv.conf
nameserver 172.31.0.3
nameserver 172.31.0.4
search default.svc.cluster.local svc.cluster.local cluster.local
options ndots:5
[email protected]:/#
说明None策略Pod会使用其dnsConfig字段所提供的DNS配置。 nameserver最多可配置3个ip。
ClusterFirstWithHostNet
# deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
labels:
app: nginx-deploy
name: nginx-deploy
spec:
replicas: 2
selector:
matchLabels:
app: nginx-deploy
template:
metadata:
labels:
app: nginx-deploy
spec:
restartPolicy: Always
containers:
- name: mynginx
image: nginx
imagePullPolicy: IfNotPresent
dnsPolicy: ClusterFirstWithHostNet
hostNetwork: true
[[email protected] test]# kubectl apply -f deployment.yaml
deployment.apps/nginx-deploy created
[[email protected] test]# kubectl get pod
NAME READY STATUS RESTARTS AGE
nginx-deploy-74bd47ccdd-cjbmv 1/1 Running 0 4s
nginx-deploy-74bd47ccdd-m6bm6 1/1 Running 0 4s
[[email protected] test]#
[[email protected] test]# kubectl exec -it nginx-deploy-74bd47ccdd-cjbmv -c mynginx -- /bin/bash
[email protected]:/# cat /etc/resolv.conf
nameserver 10.96.0.10
search default.svc.cluster.local svc.cluster.local cluster.local pek3.qingcloud.com
options ndots:5
[email protected]:/#
# 访问service成功
[email protected]:/# curl nginx-deploy.default.svc:8000
<!DOCTYPE html>
<html>
...
<body>
<h1>Welcome to nginx!</h1>
...
</html>
[email protected]:/#
# 访问百度成功
[email protected]:/# curl www.baidu.com
<!DOCTYPE html>
<!--STATUS OK--><html> <head><meta http-equiv=content-type content=text/html;charset=utf-8><meta http-equiv=X-UA-Compatible content=IE=Edge><meta content=always name=referrer><link rel=stylesheet type=text/css href=http://s1.bdstatic.com/r/www/cache/bdorz/baidu.min.css><title>百度一下，你就知道</title></head> <body link=#0000cc> <div id=wrapper> <div id=head> <div class=head_wrapper> <div class=s_form> <div class=s_form_wrapper> <div id=lg> <img hidefocus=true src=//www.baidu.com/img/bd_logo1.png width=270 height=129> </div> <form id=form name=f action=//www.baidu.com/s class=fm> <input type=hidden name=bdorz_come value=1> <input type=hidden name=ie value=utf-8> <input type=hidden name=f value=8> <input type=hidden name=rsv_bp value=1> <input type=hidden name=rsv_idx value=1> <input type=hidden name=tn value=baidu><span class="bg s_ipt_wr"><input id=kw name=wd class=s_ipt value maxlength=255 autocomplete=off autofocus></span><span class="bg s_btn_wr"><input type=submit id=su value=百度一下 class="bg s_btn"></span> </form> </div> </div> <div id=u1> <a href=http://news.baidu.com name=tj_trnews class=mnav>新闻</a> <a href=http://www.hao123.com name=tj_trhao123 class=mnav>hao123</a> <a href=http://map.baidu.com name=tj_trmap class=mnav>地图</a> <a href=http://v.baidu.com name=tj_trvideo class=mnav>视频</a> <a href=http://tieba.baidu.com name=tj_trtieba class=mnav>贴吧</a> <noscript> <a href=http://www.baidu.com/bdorz/login.gif?login&tpl=mn&u=http%3A%2F%2Fwww.baidu.com%2f%3fbdorz_come%3d1 name=tj_login class=lb>登录</a> </noscript> <script>document.write('<a href="http://www.baidu.com/bdorz/login.gif?login&tpl=mn&u='+ encodeURIComponent(window.location.href+ (window.location.search === "" ? "?" : "&")+ "bdorz_come=1")+ '" name="tj_login" class="lb">登录</a>');</script> <a href=//www.baidu.com/more/ name=tj_briicon class=bri style="display: block;">更多产品</a> </div> </div> </div> <div id=ftCon> <div id=ftConw> <p id=lh> <a href=http://home.baidu.com>关于百度</a> <a href=http://ir.baidu.com>About Baidu</a> </p> <p id=cp>©2017 Baidu <a href=http://www.baidu.com/duty/>使用百度前必读</a> <a href=http://jianyi.baidu.com/ class=cp-feedback>意见反馈</a> 京ICP证030173号 <img src=//www.baidu.com/img/gs.gif> </p> </div> </div> </div> </body> </html>
[email protected]:/#
能同时访问service和百度，说明此配置既能使用集群内部的CoreDNS来做域名解析，又可以使用宿主机的DNS做域名解析。
注意点：我们有时也会看到如下的配置。
dnsPolicy: ClusterFirst
hostNetwork: true
hostNetwork表示与宿主机共享网络空间。但是只有dnsPolicy: ClusterFirstWithHostNet时生效。而此配置的ClusterFirst由于打开了hostNetwork为true，会自动转换为Default。
本文由 mdnice 多平台发布
版权声明
本文为[傻啦猫@[email protected]]所创，转载请带上原文链接，感谢
https://blog.csdn.net/weixin_45842494/article/details/125962639
边栏推荐
- Necessary skills for mobile terminal test: ADB command and packet capturing
- Adaptation dynamics | in June, sequoiadb completed mutual certification with five products
- 05. Libavformat Library of ffmpeg
- Introduction summary of using unirx in unity
- Leetcode 237. 删除链表中的节点
- C Programming -- the solution of dynamic programming of "the sum of the largest subarray"
- uniapp手机端uView的u-collapse组件高度init
- Concepts of phase velocity and phase in transmission line theory
- 剑指 Offer 05. 替换空格
- Performance Optimization: how to solve the slow loading speed of the first screen of spa single page application?
猜你喜欢
The third day of rhcsa summer vacation
Sword finger offer 05. replace spaces
Implement is by yourself_ convertible
The difference between function and task in SystemVerilog
Adaptation dynamics | in June, sequoiadb completed mutual certification with five products
ThreadLocal
Microservice gateway component
Leetcode 202. 快乐数(一点都不快乐)
50：第五章：开发admin管理服务：3：开发【查询admin用户名是否已存在，接口】；（这个接口需要登录时才能调用；所以我们编写了拦截器，让其拦截请求，判断用户是否是登录状态；）
Basset: learning the regulatory code of the accessible genome with deep convolutional neural network
随机推荐
Introduction to interface in SystemVerilog
Game 302 of leetcode
微信小程序相关操作示例
Flexible layout summary
Unity接入ChartAndGraph图表插件
What should testers do if they encounter a bug that is difficult to reproduce?
Nexttick principle analysis
The third day of rhcsa summer vacation
typora+PicGo+阿里云OSS 搭建以及报错解决【转载】
ping命令
odoo14 | 关于状态栏statusbar关键词使用后显示异常及解决方法
编程大杂烩（二）
Single sign on (one sign on, available everywhere)
Leetcode 15: sum of three numbers
flex布局常用属性总结
Programming hodgepodge (I)
Which side of Nacos has the SQL script of this column?
Samsung folding screen has sent samples to apple and Google, and the annual production capacity will be expanded from 2.4 million to 10million!
Deep error
systemverilog中function和task区别