DNS 组件历史版本有skydns、kube-dns和coredns三个,k8s1.3版本之前使用skydns,之后的版本到1.17及之间的版本使用kube-dns,目前主要使用coredns,DNS组件用于解析k8s集群中service name 所对应的ip地址
官方文档:
coreDNS官方文档
获取官方包和yaml文件:
官方包和yaml文件地址
github搜索kubernetes,找到相应的k8s版本,点击changelog
需要下载这几个包:
client:
server:
node:
下载之后上传到master并解压,解压之后的目录结构如下图:
相关yaml文件和插件目录,如dns,dashboard等
相关二进制文件:
coredns一般用coredns.yaml.base 修改
官方yaml文件:
# __MACHINE_GENERATED_WARNING__
apiVersion: v1
kind: ServiceAccount
metadata:
name: coredns
namespace: kube-system
labels:
kubernetes.io/cluster-service: "true"
addonmanager.kubernetes.io/mode: Reconcile
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
labels:
kubernetes.io/bootstrapping: rbac-defaults
addonmanager.kubernetes.io/mode: Reconcile
name: system:coredns
rules:
- apiGroups:
- ""
resources:
- endpoints
- services
- pods
- namespaces
verbs:
- list
- watch
- apiGroups:
- ""
resources:
- nodes
verbs:
- get
- apiGroups:
- discovery.k8s.io
resources:
- endpointslices
verbs:
- list
- watch
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
annotations:
rbac.authorization.kubernetes.io/autoupdate: "true"
labels:
kubernetes.io/bootstrapping: rbac-defaults
addonmanager.kubernetes.io/mode: EnsureExists
name: system:coredns
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: system:coredns
subjects:
- kind: ServiceAccount
name: coredns
namespace: kube-system
---
apiVersion: v1
kind: ConfigMap
metadata:
name: coredns
namespace: kube-system
labels:
addonmanager.kubernetes.io/mode: EnsureExists
data:
Corefile: |
.:53 {
#errors:错误信息标准输出
errors
#心跳检测,检测服务是否存活,在CoreDNS的http://localhost:8080/health端口提供CoreDNS服务的健康报告
health {
lameduck 5s
}
#监听8181端口,当coredns的插件已经就绪时,访问该接口会返回200 OK
ready
#需要修改的地方(__DNS__DOMAIN__),这个是在创建k8s集群时在/etc/kubeasz/clusters/k8s-cluster/hosts中指定的CLUSTER_DNS_DOMAIN="clusterdujie.local"
kubernetes kubernetes clusterdujie.local in-addr.arpa ip6.arpa {
pods insecure
fallthrough in-addr.arpa ip6.arpa
ttl 30
}
prometheus :9153
#forward就表示coredns解析不了的dns域名往哪里转发。可以指向公司内部dns地址
forward . 223.6.6.6 {
max_concurrent 1000
}
#dns缓存,如果第一次请求,先去etcd查询再用coredns缓存30s,如果30s内再有请求访问直接通过缓存返回
cache 30
#检测域名解析是否有死循环,如coredns转发给内网DNS服务器,而内网服务器又转发给coredns,如果发现解析时死循环,则强制终止coredns进程(kubernetes会重建),如果不加该参数可能会导致coredns资源利用率非常高甚至卡死
loop
#检测corefile是否更改,再重新编辑configmap配置后,默认2分钟会优雅的自动加载新的配置
reload
#轮询DNS域名解析,如果一个域名存在多个记录则轮询解析
loadbalance
}
#把myserver。online的请求转发到下面的地址
myserver.online {
forward . 192.168.17.131:53
}
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: coredns
namespace: kube-system
labels:
k8s-app: kube-dns
kubernetes.io/cluster-service: "true"
addonmanager.kubernetes.io/mode: Reconcile
kubernetes.io/name: "CoreDNS"
spec:
# replicas: not specified here:
# 1. In order to make Addon Manager do not reconcile this replicas parameter.
# 2. Default is 1.
# 3. Will be tuned in real time if DNS horizontal auto-scaling is turned on.
strategy:
type: RollingUpdate
rollingUpdate:
maxUnavailable: 1
selector:
matchLabels:
k8s-app: kube-dns
template:
metadata:
labels:
k8s-app: kube-dns
spec:
securityContext:
seccompProfile:
type: RuntimeDefault
priorityClassName: system-cluster-critical
serviceAccountName: coredns
affinity:
podAntiAffinity:
preferredDuringSchedulingIgnoredDuringExecution:
- weight: 100
podAffinityTerm:
labelSelector:
matchExpressions:
- key: k8s-app
operator: In
values: ["kube-dns"]
topologyKey: kubernetes.io/hostname
tolerations:
- key: "CriticalAddonsOnly"
operator: "Exists"
nodeSelector:
kubernetes.io/os: linux
containers:
- name: coredns
#镜像地址默认是谷歌的,需要更换成国内镜像源或者官方hub仓库源,下面可以看图
image: coredns/coredns:1.8.6
imagePullPolicy: IfNotPresent
resources:
#限制coredns可以使用多少资源
limits:
memory: 200Mi #200毫核 ,一般生产会写2000Mi 或者直接写2
requests:
cpu: 100m
memory: 70Mi
args: [ "-conf", "/etc/coredns/Corefile" ]
volumeMounts:
- name: config-volume
mountPath: /etc/coredns
readOnly: true
ports:
- containerPort: 53
name: dns
protocol: UDP
- containerPort: 53
name: dns-tcp
protocol: TCP
- containerPort: 9153
name: metrics
protocol: TCP
livenessProbe:
httpGet:
path: /health
port: 8080
scheme: HTTP
initialDelaySeconds: 60
timeoutSeconds: 5
successThreshold: 1
failureThreshold: 5
readinessProbe:
httpGet:
path: /ready
port: 8181
scheme: HTTP
securityContext:
allowPrivilegeEscalation: false
capabilities:
add:
- NET_BIND_SERVICE
drop:
- all
readOnlyRootFilesystem: true
dnsPolicy: Default
volumes:
- name: config-volume
configMap:
name: coredns
items:
- key: Corefile
path: Corefile
---
apiVersion: v1
kind: Service
metadata:
name: kube-dns
namespace: kube-system
annotations:
prometheus.io/port: "9153"
prometheus.io/scrape: "true"
labels:
k8s-app: kube-dns
kubernetes.io/cluster-service: "true"
addonmanager.kubernetes.io/mode: Reconcile
kubernetes.io/name: "CoreDNS"
spec:
selector:
k8s-app: kube-dns
#clusterIP:dns地址,这个地址可以创建一个pod然后查看pod的/etc/resolv.conf的namespaces查看,如下面
clusterIP: 10.100.0.2
ports:
- name: dns
port: 53
protocol: UDP
- name: dns-tcp
port: 53
protocol: TCP
- name: metrics
port: 9153
protocol: TCP
查看coredns的svc地址,上面的10.100.0.1是kubernetes的api的地址,k8s内部会将第一个地址分配给apiserver
镜像更换:
修改完成后apply -f coredns.yaml,启动成功后进入pod查看是否能够进行域名解析测试
nslookup测试该域名是否可以解析
一般会将coredns多副本,保证业务解析正常,会以轮询的方式请求,或者修改limit占用资源。一般cpu为2核,内存为3个Gi就够了,如果不够就多副本
k8s域名固定格式:
ping kube-dns.kube-system.svc.clusterdujie.local
名称.namespace.svc.域名后缀
coredns性能优化:
1、(pod级别缓存)在pod中添加dnsmasq缓存,优缺点:pod自己缓存自己的,缓存不共享是隔离的,每个容器中都需要添加域名解析记录
2、(node级别缓存)缓存放在node上,localdns,pod第一次宿主机请求的时候,宿主机向coredns请求解析,获取解析后缓存到node,下次pod再请求直接通过node节点的localdns直接返回给pod
[root@master01 ~]# vim /etc/kubeasz/clusters/k8s-cluster/config.yml
3、(coredns级别缓存)在coredns容器里,修改缓存时间,默认30s,可以调成180s,不过需要coredns内存比较大,,缓存时间设置不要太长也不要太短