8、kubernetes组件——CoreDns
作者：互联网
kubernetes组件——CoreDns
在Kubernetes集群推荐使用Service Name作为服务的访问地址，因此需要一个Kubernetes集群范围的DNS服务实现从Service Name到Cluster Ip的解析，这就是Kubernetes基于DNS的服务发现功能。
从Kubernetes 1.11开始，可使用CoreDNS作为Kubernetes的DNS插件进入GA状态，这意味着CoreDNS将通过安装工具包（例如kubeadm，kube-up，minikube和kops）作为Kubernetes中的标准功能提供。Kubernetes推荐使用CoreDNS作为集群内的DNS服务。
网站：
https://github.com/coredns/coredns
https://coredns.io/
https://github.com/coredns/deployment/tree/master/kubernetes
安装
准备工作
由于coredns安装时默认使用的时国外源，这里我们将镜像下载到本地harbor
root@k8s-deploy-01:~# docker pull coredns/coredns:1.9.3
root@k8s-deploy-01:~# docker tag coredns/coredns:1.9.3 xmtx.harbor.com/baseimages/coredns-coredns:1.9.3
root@k8s-deploy-01:~# docker push xmtx.harbor.com/baseimages/coredns-coredns:1.9.3
corefile配置
#corefile默认配置
data:
Corefile: |
.:53 {
errors
health {
lameduck 5s
}
ready
kubernetes __DNS__DOMAIN__ in-addr.arpa ip6.arpa {
pods insecure
fallthrough in-addr.arpa ip6.arpa
ttl 30
}
prometheus :9153
forward . /etc/resolv.conf {
max_concurrent 1000
}
cache 30
loop
reload
loadbalance
}
- errors：错误记录到标准输出。
- health：在 处提http://localhost:8080/health供 CoreDNS 的健康报告。
- ready：在端口 8181 上提供的一个 HTTP 末端，当所有能够表达自身就绪的插件都已就绪时，在此末端返回 200 OK。
- kubernetes：CoreDNS 将基于 Kubernetes service name 进行DNS 查询。 你可以使用 ttl 来定制响应的 TTL。默认值是 5 秒钟。TTL 的最小值可以是 0 秒，最大值为 3600 秒。将 TTL 设置为 0 可以禁止对 DNS 记录进行缓存。
- pods insecure 选项是为了与 kube-dns 向后兼容。你可以使用 pods verified 选项，该选项使得 仅在相同名称空间中存在具有匹配 IP 的 Pod 时才返回 A 记录。如果你不使用 Pod 记录，则可以使用 pods disabled选项。
- prometheus：CoreDNS 的度量指标值以 Prometheus的 key-value 格式在http://localhost:9153/metrics 上提供。
- forward: 不在 Kubernetes 集群域内的任何查询都将转发到 预定义的解析器 (/etc/resolv.conf).
- cache：启用service解析缓存，单位为秒。
- loop：检测转发环，如果发现是死循环，则强制中止 CoreDNS 进程(kubernetes会重建)。
- reload：允许自动重新加载已更改的 Corefile。 编辑 ConfigMap 配置后，默认两分钟后会自动加载，以使更改生效。
- loadbalance：轮询DNS域名解析，如果一个域名存在多个记录则轮训解析。
Corefile
# __MACHINE_GENERATED_WARNING__
apiVersion: v1
kind: ServiceAccount
metadata:
name: coredns
namespace: kube-system
labels:
kubernetes.io/cluster-service: "true"
addonmanager.kubernetes.io/mode: Reconcile
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
labels:
kubernetes.io/bootstrapping: rbac-defaults
addonmanager.kubernetes.io/mode: Reconcile
name: system:coredns
rules:
- apiGroups:
- ""
resources:
- endpoints
- services
- pods
- namespaces
verbs:
- list
- watch
- apiGroups:
- ""
resources:
- nodes
verbs:
- get
- apiGroups:
- discovery.k8s.io
resources:
- endpointslices
verbs:
- list
- watch
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
annotations:
rbac.authorization.kubernetes.io/autoupdate: "true"
labels:
kubernetes.io/bootstrapping: rbac-defaults
addonmanager.kubernetes.io/mode: EnsureExists
name: system:coredns
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: system:coredns
subjects:
- kind: ServiceAccount
name: coredns
namespace: kube-system
---
apiVersion: v1
kind: ConfigMap
metadata:
name: coredns
namespace: kube-system
labels:
addonmanager.kubernetes.io/mode: EnsureExists
data:
Corefile: |
.:53 {
errors
health {
lameduck 5s
}
ready
kubernetes xmtx.local in-addr.arpa ip6.arpa { #将xmtx.local替换为自己的
pods insecure
fallthrough in-addr.arpa ip6.arpa
ttl 30
}
prometheus :9153
forward . /etc/resolv.conf {
max_concurrent 1000
}
cache 30
loop
reload
loadbalance
}
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: coredns
namespace: kube-system
labels:
k8s-app: kube-dns
kubernetes.io/cluster-service: "true"
addonmanager.kubernetes.io/mode: Reconcile
kubernetes.io/name: "CoreDNS"
spec:
# replicas: not specified here:
# 1. In order to make Addon Manager do not reconcile this replicas parameter.
# 2. Default is 1.
# 3. Will be tuned in real time if DNS horizontal auto-scaling is turned on.
replicas: 2 #副本数量
strategy:
type: RollingUpdate
rollingUpdate:
maxUnavailable: 1
selector:
matchLabels:
k8s-app: kube-dns
template:
metadata:
labels:
k8s-app: kube-dns
spec:
securityContext:
seccompProfile:
type: RuntimeDefault
priorityClassName: system-cluster-critical
serviceAccountName: coredns
affinity:
podAntiAffinity:
preferredDuringSchedulingIgnoredDuringExecution:
- weight: 100
podAffinityTerm:
labelSelector:
matchExpressions:
- key: k8s-app
operator: In
values: ["kube-dns"]
topologyKey: kubernetes.io/hostname
tolerations:
- key: "CriticalAddonsOnly"
operator: "Exists"
nodeSelector:
kubernetes.io/os: linux
containers:
- name: coredns
image: xmtx.harbor.com/baseimages/coredns-coredns:1.9.3 #使用本地harbor下载镜像
imagePullPolicy: IfNotPresent
resources:
limits: #资源限制
memory: 512Mi
cpu: 200m
requests:
cpu: 200m
memory: 70Mi
args: [ "-conf", "/etc/coredns/Corefile" ]
volumeMounts:
- name: config-volume
mountPath: /etc/coredns
readOnly: true
ports:
- containerPort: 53
name: dns
protocol: UDP
- containerPort: 53
name: dns-tcp
protocol: TCP
- containerPort: 9153
name: metrics
protocol: TCP
livenessProbe:
httpGet:
path: /health
port: 8080
scheme: HTTP
initialDelaySeconds: 60
timeoutSeconds: 5
successThreshold: 1
failureThreshold: 5
readinessProbe:
httpGet:
path: /ready
port: 8181
scheme: HTTP
securityContext:
allowPrivilegeEscalation: false
capabilities:
add:
- NET_BIND_SERVICE
drop:
- all
readOnlyRootFilesystem: true
dnsPolicy: Default
volumes:
- name: config-volume
configMap:
name: coredns
items:
- key: Corefile
path: Corefile
---
apiVersion: v1
kind: Service
metadata:
name: kube-dns
namespace: kube-system
annotations:
prometheus.io/port: "9153"
prometheus.io/scrape: "true"
labels:
k8s-app: kube-dns
kubernetes.io/cluster-service: "true"
addonmanager.kubernetes.io/mode: Reconcile
kubernetes.io/name: "CoreDNS"
spec:
selector:
k8s-app: kube-dns
clusterIP: 10.100.0.2 #自己的clusterIP
ports:
- name: dns
port: 53
protocol: UDP
- name: dns-tcp
port: 53
protocol: TCP
- name: metrics
port: 9153
protocol: TCP
应用coredns
root@k8s-deploy-01:/opt/soft# kubectl apply -f coredns.yaml
serviceaccount/coredns created
clusterrole.rbac.authorization.k8s.io/system:coredns created
clusterrolebinding.rbac.authorization.k8s.io/system:coredns created
configmap/coredns created
deployment.apps/coredns created
service/kube-dns created
验证
root@k8s-master-01:~# kubectl get pods -A
kube-system coredns-8fc4ff95b-bv5ct 1/1 Running 0 5m17s
kube-system coredns-8fc4ff95b-fd8mh 1/1 Running 0 13m
#进入容器ping外网
root@k8s-master-01:~# kubectl exec -it net-test1 bash -n myserver
[root@net-test1 /]# ping www.baidu.com
PING www.wshifen.com (103.235.46.40) 56(84) bytes of data.
64 bytes from 103.235.46.40 (103.235.46.40): icmp_seq=1 ttl=127 time=202 ms
64 bytes from 103.235.46.40 (103.235.46.40): icmp_seq=2 ttl=127 time=204 ms
标签：kube,name,kubernetes,io,coredns,组件,CoreDns,k8s 来源： https://www.cnblogs.com/xmtx97/p/16534752.html