解決CoreDNS附加元件部署排查

尹正杰發表於2024-12-04
DNS元件
  • 解決CoreDNS附加元件部署排查
    1.報錯資訊
    [FATAL] plugin/loop: Loop (127.0.0.1:36030 -> :53) detected for zone ".", see https://coredns.io/plugins/loop#troubleshooting. Query: "HINFO 8244365230594049349.2552766472385065880."

錯誤原因:
CoreDNS元件本地的DNS解析和Pod解析迴環問題導致的錯誤。

參考連結:
	https://coredns.io/plugins/loop#troubleshooting

解決方案:
如果修改本地的"/etc/resolv.conf"你會發現，修改後會被覆蓋！因此我們需要自行定義一個檔案解析記錄。

1.所有節點新增解析記錄

echo "nameserver 223.5.5.5" > /etc/kubernetes/resolv.conf

2.所有節點修改kubelet的配置檔案

vim /etc/kubernetes/kubelet-conf.yml

...
resolvConf: /etc/kubernetes/resolv.conf

3.所有節點重啟kubelet元件

systemctl daemon-reload
systemctl restart kubelet

4.建立CoreDNS元件

[root@node-exporter41 ~]# cat coredns.yaml

MACHINE_GENERATED_WARNING

apiVersion: v1
kind: ServiceAccount
metadata:
name: coredns
namespace: kube-system
labels:
kubernetes.io/cluster-service: "true"
addonmanager.kubernetes.io/mode: Reconcile

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
labels:
kubernetes.io/bootstrapping: rbac-defaults
addonmanager.kubernetes.io/mode: Reconcile
name: system:coredns
rules:

  • apiGroups:
    • ""
      resources:
    • endpoints
    • services
    • pods
    • namespaces
      verbs:
    • list
    • watch
  • apiGroups:
    • discovery.k8s.io
      resources:
    • endpointslices
      verbs:
    • list
    • watch

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
annotations:
rbac.authorization.kubernetes.io/autoupdate: "true"
labels:
kubernetes.io/bootstrapping: rbac-defaults
addonmanager.kubernetes.io/mode: EnsureExists
name: system:coredns
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: system:coredns
subjects:

  • kind: ServiceAccount
    name: coredns
    namespace: kube-system

apiVersion: v1
kind: ConfigMap
metadata:
name: coredns
namespace: kube-system
labels:
addonmanager.kubernetes.io/mode: EnsureExists
data:
Corefile: |
.:53 {
errors
health {
lameduck 5s
}
ready
kubernetes yinzhengjie.com in-addr.arpa ip6.arpa {
pods insecure
fallthrough in-addr.arpa ip6.arpa
ttl 30
}
prometheus :9153
forward . /etc/resolv.conf {
max_concurrent 1000
}
cache 30
loop
reload
loadbalance
}

apiVersion: apps/v1
kind: Deployment
metadata:
name: coredns
namespace: kube-system
labels:
k8s-app: kube-dns
kubernetes.io/cluster-service: "true"
addonmanager.kubernetes.io/mode: Reconcile
kubernetes.io/name: "CoreDNS"
spec:

replicas: not specified here:

1. In order to make Addon Manager do not reconcile this replicas parameter.

2. Default is 1.

3. Will be tuned in real time if DNS horizontal auto-scaling is turned on.

replicas: 2
strategy:
type: RollingUpdate
rollingUpdate:
maxUnavailable: 1
selector:
matchLabels:
k8s-app: kube-dns
template:
metadata:
labels:
k8s-app: kube-dns
spec:
securityContext:
seccompProfile:
type: RuntimeDefault
priorityClassName: system-cluster-critical
serviceAccountName: coredns
affinity:
podAntiAffinity:
preferredDuringSchedulingIgnoredDuringExecution:
- weight: 100
podAffinityTerm:
labelSelector:
matchExpressions:
- key: k8s-app
operator: In
values: ["kube-dns"]
topologyKey: kubernetes.io/hostname
tolerations:
- key: "CriticalAddonsOnly"
operator: "Exists"
nodeSelector:
kubernetes.io/os: linux
containers:
- name: coredns
image: registry.k8s.io/coredns/coredns:v1.11.3
imagePullPolicy: IfNotPresent
resources:
limits:
memory: 300Mi
requests:
cpu: 100m
memory: 70Mi
args: [ "-conf", "/etc/coredns/Corefile" ]
volumeMounts:
- name: config-volume
mountPath: /etc/coredns
readOnly: true
ports:
- containerPort: 53
name: dns
protocol: UDP
- containerPort: 53
name: dns-tcp
protocol: TCP
- containerPort: 9153
name: metrics
protocol: TCP
livenessProbe:
httpGet:
path: /health
port: 8080
scheme: HTTP
initialDelaySeconds: 60
timeoutSeconds: 5
successThreshold: 1
failureThreshold: 5
readinessProbe:
httpGet:
path: /ready
port: 8181
scheme: HTTP
securityContext:
allowPrivilegeEscalation: false
capabilities:
add:
- NET_BIND_SERVICE
drop:
- ALL
readOnlyRootFilesystem: true
dnsPolicy: Default
volumes:
- name: config-volume
configMap:
name: coredns
items:
- key: Corefile
path: Corefile

apiVersion: v1
kind: Service
metadata:
name: kube-dns
namespace: kube-system
annotations:
prometheus.io/port: "9153"
prometheus.io/scrape: "true"
labels:
k8s-app: kube-dns
kubernetes.io/cluster-service: "true"
addonmanager.kubernetes.io/mode: Reconcile
kubernetes.io/name: "CoreDNS"
spec:
selector:
k8s-app: kube-dns
clusterIP: 10.200.0.254
ports:

  • name: dns
    port: 53
    protocol: UDP

  • name: dns-tcp
    port: 53
    protocol: TCP

  • name: metrics
    port: 9153
    protocol: TCP
    [root@node-exporter41 ~]#
    [root@node-exporter41 ~]# kubectl get pods -o wide -n kube-system
    NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES
    coredns-64cf9f859-ccbrm 1/1 Running 0 7s 10.100.246.203 node-exporter43
    coredns-64cf9f859-dcdwx 1/1 Running 0 7s 10.100.59.149 node-exporter41
    [root@node-exporter41 ~]#

    5.驗證DNS元件是否正常工作
    [root@node-exporter41 ~]# kubectl get svc,pods -n kube-system
    NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
    service/coredns ClusterIP 10.200.0.254 53/UDP,53/TCP,9153/TCP 14h

NAME READY STATUS RESTARTS AGE
pod/coredns-859664f9d8-2fl7l 1/1 Running 0 89s
pod/coredns-859664f9d8-stdbs 1/1 Running 0 89s
[root@node-exporter41 ~]#
[root@node-exporter41 ~]# kubectl get svc -A
NAMESPACE NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
calico-apiserver calico-api ClusterIP 10.200.93.100 443/TCP 16h
calico-system calico-kube-controllers-metrics ClusterIP None 9094/TCP 15h
calico-system calico-typha ClusterIP 10.200.250.163 5473/TCP 16h
default kubernetes ClusterIP 10.200.0.1 443/TCP 17h
kube-system coredns ClusterIP 10.200.0.254 53/UDP,53/TCP,9153/TCP 14h
[root@node-exporter41 ~]#
[root@node-exporter41 ~]# dig @10.200.0.254 calico-api.calico-apiserver.svc.yinzhengjie.com +short
10.200.93.100
[root@node-exporter41 ~]#
[root@node-exporter41 ~]# dig @10.200.0.254 calico-typha.calico-system.svc.yinzhengjie.com +short
10.200.250.163
[root@node-exporter41 ~]#

相關文章