kubernetes集群中部署CoreDNS服务

前言

从k8s 1.11版本开始，k8s集群的dns服务由CoreDNS提供。之前已经使用二进制文件部署了一个三master三node的k8s集群，现在需要在集群内部部署DNS服务。

• 环境信息

步骤

1. 修改node的kubelet启动参数

修改node上的kubelet启动参数，添加以下两个参数，添加完成后重启kubelet。

• --cluster-dns=169.169.0.100，这是集群内DNS的服务地址
• --cluster-domain=cluster.local，为在dns服务中设置的域名

2. 部署CoreDNS服务

1. 创建ConfigMap。主要设置CoreDNS的主配置文件Corefile的内容，其中可以定义各种域名的解析方式和使用的插件。

apiVersion: v1
kind: ConfigMap
metadata:name: corednsnamespace: kube-systemlabels:addonmanager.kubernetes.io/mode: EnsureExists
data:Corefile: |cluster.local {errorshealth {lameduck 5s}readykubernetes cluster.local 169.169.0.0/16 {fallthrough in-addr.arpa ip6.arpa}prometheus :9153forward . /etc/resolv.confcache 30loopreloadloadbalance}. {cache 30loadbalanceforward . /etc/resolv.conf}

1. 创建deployment。

apiVersion: apps/v1
kind: Deployment
metadata:name: corednsnamespace: kube-systemlabels:k8s-app: kube-dnskubernetes.io/name: "CoreDNS"
spec:replicas: 1strategy:type: RollingUpdaterollingUpdate:maxUnavailable: 1selector:matchLabels:k8s-app: kube-dnstemplate:metadata:labels:k8s-app: kube-dnsspec:priorityClassName: system-cluster-criticaltolerations:- key: "CriticalAddonsOnly"operator: "Exists"nodeSelector:kubernetes.io/os: linuxaffinity:podAntiAffinity:preferredDuringSchedulingIgnoredDuringExecution:- weight: 100podAffinityTerm:labelSelector:matchExpressions:- key: k8s-appoperator: Invalues: ["kube-dns"]topologyKey: kubernetes.io/hostnamecontainers:- name: corednsimage: coredns/coredns:1.10.1imagePullPolicy: IfNotPresentresources:limits:memory: 170Mirequests:cpu: 100mmemory: 70Miargs: [ "-conf", "/etc/coredns/Corefile" ]volumeMounts:- name: config-volumemountPath: /etc/corednsreadOnly: trueports:- containerPort: 53name: dnsprotocol: UDP- containerPort: 53name: dns-tcpprotocol: TCP- containerPort: 9153name: metricsprotocol: TCPsecurityContext:allowPrivilegeEscalation: falsecapabilities:add:- NET_BIND_SERVICEdrop:- allreadOnlyRootFilesystem: truelivenessProbe:httpGet:path: /healthport: 8080scheme: HTTPinitialDelaySeconds: 60timeoutSeconds: 5successThreshold: 1failureThreshold: 5readinessProbe:httpGet:path: /readyport: 8181scheme: HTTPdnsPolicy: Defaultvolumes:- name: config-volumeconfigMap:name: corednsitems:- key: Corefilepath: Corefile

1. 创建service

apiVersion: v1
kind: Service
metadata:name: kube-dnsnamespace: kube-systemannotations:prometheus.io/port: "9153"prometheus.io/scrape: "true"labels:k8s-app: kube-dnskubernetes.io/cluster-service: "true"kubernetes.io/name: "CoreDNS"
spec:selector:k8s-app: kube-dnsclusterIP: 169.169.0.100ports:- name: dnsport: 53protocol: UDP- name: dns-tcpport: 53protocol: TCP- name: metricsport: 9153protocol: TCP

3. 验证

使用带有nslookup工具的pod来验证dns服务是否正常（《kubernetes权威指南》中用的busybox，但自己测试不行，所以改成了用ubuntu镜像，pod起来后在容器中安装nslookup。）：

# pod-ubuntu.yaml
apiVersion: v1
kind: Pod
metadata:name: ubuntunamespace: default
spec:containers:- name: ubuntuimage: ubuntu:22.04command:- sleep- "3600"

1. 先创建pod

kubectl create -f pod-ubuntu.yaml

1. 容器启动后，执行命令测试

apt update
apt install -y dnsutils
nslookup svc-nginx

Corefile配置说明

CoreDNS的主要功能是通过插件系统实现的。常用插件如下：