kubernetes實踐之六十四：CoreDNS

百聯達發表於2018-06-26
DNS
一：簡介
1.Kubernetes包括用於服務發現的DNS伺服器Kube-DNS。 該DNS伺服器利用SkyDNS的庫來為Kubernetes pod和服務提供DNS請求。SkyDNS2的作者，Miek Gieben，建立了一個新的DNS伺服器，CoreDNS，它採用更模組化，可擴充套件的框架構建。 Infoblox已經與Miek合作，將此DNS伺服器作為Kube-DNS的替代品。
2.CoreDNS利用作為Web伺服器Caddy的一部分而開發的伺服器框架。該框架具有非常靈活，可擴充套件的模型，用於透過各種中介軟體元件傳遞請求。這些中介軟體元件根據請求提供不同的操作，例如記錄，重定向，修改或維護。雖然它一開始作為Web伺服器，但是Caddy並不是專門針對HTTP協議的，而是構建了一個基於CoreDNS的理想框架。
3.在這種靈活的模型中新增對Kubernetes的支援，相當於建立了一個Kubernetes中介軟體。該中介軟體使用Kubernetes API來滿足針對特定Kubernetes pod或服務的DNS請求。而且由於Kube-DNS作為Kubernetes的另一項服務，kubelet和Kube-DNS之間沒有緊密的繫結。您只需要將DNS服務的IP地址和域名傳遞給kubelet，而Kubernetes並不關心誰在實際處理該IP請求。
4.CoreDNS可以在具有標準的Kube-DNS的Kubernetes叢集中執行。作為Kubernetes 的外掛使用，CoreDNS將從 Kubernetes叢集中讀取區（zone）資料。它實現了為Kubernetes的DNS服務發現定義的規範：。

二：部署

部署CoreDNS需要使用到官方提供的兩個檔案 deploy.sh和coredns.yaml.sed

1.deploy.sh 是一個用於在已經執行kube-dns的叢集中生成執行CoreDNS部署檔案（manifest）的工具指令碼。它使用 coredns.yaml.sed檔案作為模板，建立一個ConfigMap和CoreDNS的deployment，然後更新叢集中已有的kube-dns 服務的selector使用CoreDNS的deployment。重用已有的服務並不會在服務的請求中發生衝突。

2.deploy.sh檔案並不會刪除kube-dns的deployment或者replication controller。如果要刪除kube-dns，你必須在部署CoreDNS後手動的刪除kube-dns。

3.使用CoreDNS替換Kube-DNS只需要使用下面的兩個命令：

點選(此處)摺疊或開啟

  1. $ ./deploy.sh | kubectl apply -f -
  2. $ kubectl delete --namespace=kube-system deployment kube-dns
4.deploy.sh()

點選(此處)摺疊或開啟

  1. #!/bin/bash

  3. # Deploys CoreDNS to a cluster currently running Kube-DNS.

  5. show_help () {
  6. cat << USAGE
  7. usage: $0 [ -r REVERSE-CIDR ] [ -i DNS-IP ] [ -d CLUSTER-DOMAIN ] [ -t YAML-TEMPLATE ]
  8.     -r : Define a reverse zone for the given CIDR. You may specifcy this option more
  9.          than once to add multiple reverse zones. If no reverse CIDRs are defined,
  10.          then the default is to handle all reverse zones (i.e. in-addr.arpa and ip6.arpa)
  11.     -i : Specify the cluster DNS IP address. If not specificed, the IP address of
  12.          the existing "kube-dns" service is used, if present.
  13. USAGE
  14. exit 0
  15. }

  17. # Simple Defaults
  18. CLUSTER_DOMAIN=cluster.local
  19. YAML_TEMPLATE=`pwd`/coredns.yaml.sed


  22. # Get Opts
  23. while getopts "hr:i:d:t:" opt; do
  24.     case "$opt" in
  25.     h) show_help
  26.         ;;
  27.     r) REVERSE_CIDRS="$REVERSE_CIDRS $OPTARG"
  28.         ;;
  29.     i) CLUSTER_DNS_IP=$OPTARG
  30.         ;;
  31.     d) CLUSTER_DOMAIN=$OPTARG
  32.         ;;
  33.     t) YAML_TEMPLATE=$OPTARG
  34.         ;;
  35.     esac
  36. done

  38. # Conditional Defaults
  39. if [[ -z $REVERSE_CIDRS ]]; then
  40.   REVERSE_CIDRS="in-addr.arpa ip6.arpa"
  41. fi
  42. if [[ -z $CLUSTER_DNS_IP ]]; then
  43.   # Default IP to kube-dns IP
  44.   CLUSTER_DNS_IP=$(kubectl get service --namespace kube-system kube-dns -o jsonpath="{.spec.clusterIP}")
  45.   if [ $? -ne 0 ]; then
  46.       >&2 echo "Error! The IP address for DNS service couldn't be determined automatically. Please specify the DNS-IP with the '-i' option."
  47.       exit 2
  48.   fi
  49. fi

  51. sed -e s/CLUSTER_DNS_IP/$CLUSTER_DNS_IP/g -e s/CLUSTER_DOMAIN/$CLUSTER_DOMAIN/g -e "s?REVERSE_CIDRS?$REVERSE_CIDRS?g" $YAML_TEMPLATE
5.coredns.yaml.sed

點選(此處)摺疊或開啟

  1. apiVersion: v1
  2. kind: ServiceAccount
  3. metadata:
  4.   name: coredns
  5.   namespace: kube-system
  6. ---
  7. apiVersion: rbac.authorization.k8s.io/v1beta1
  8. kind: ClusterRole
  9. metadata:
  10.   labels:
  11.     kubernetes.io/bootstrapping: rbac-defaults
  12.   name: system:coredns
  13. rules:
  14. - apiGroups:
  15.   - ""
  16.   resources:
  17.   - endpoints
  18.   - services
  19.   - pods
  20.   - namespaces
  21.   verbs:
  22.   - list
  23.   - watch
  24. ---
  25. apiVersion: rbac.authorization.k8s.io/v1beta1
  26. kind: ClusterRoleBinding
  27. metadata:
  28.   annotations:
  29.     rbac.authorization.kubernetes.io/autoupdate: "true"
  30.   labels:
  31.     kubernetes.io/bootstrapping: rbac-defaults
  32.   name: system:coredns
  33. roleRef:
  34.   apiGroup: rbac.authorization.k8s.io
  35.   kind: ClusterRole
  36.   name: system:coredns
  37. subjects:
  38. - kind: ServiceAccount
  39.   name: coredns
  40.   namespace: kube-system
  41. ---
  42. apiVersion: v1
  43. kind: ConfigMap
  44. metadata:
  45.   name: coredns
  46.   namespace: kube-system
  47. data:
  48.   Corefile: |
  49.     .:53 {
  50.         errors
  51.         health
  52.         kubernetes CLUSTER_DOMAIN REVERSE_CIDRS {
  53.           pods insecure
  54.           upstream
  55.           fallthrough in-addr.arpa ip6.arpa
  56.         }
  57.         prometheus :9153
  58.         proxy . /etc/resolv.conf
  59.         cache 30
  60.         reload
  61.     }
  62. ---
  63. apiVersion: extensions/v1beta1
  64. kind: Deployment
  65. metadata:
  66.   name: coredns
  67.   namespace: kube-system
  68.   labels:
  69.     k8s-app: kube-dns
  70.     kubernetes.io/name: "CoreDNS"
  71. spec:
  72.   replicas: 2
  73.   strategy:
  74.     type: RollingUpdate
  75.     rollingUpdate:
  76.       maxUnavailable: 1
  77.   selector:
  78.     matchLabels:
  79.       k8s-app: kube-dns
  80.   template:
  81.     metadata:
  82.       labels:
  83.         k8s-app: kube-dns
  84.     spec:
  85.       serviceAccountName: coredns
  86.       tolerations:
  87.         - key: "CriticalAddonsOnly"
  88.           operator: "Exists"
  89.       containers:
  90.       - name: coredns
  91.         image: coredns/coredns:1.1.3
  92.         imagePullPolicy: IfNotPresent
  93.         args: [ "-conf", "/etc/coredns/Corefile" ]
  94.         volumeMounts:
  95.         - name: config-volume
  96.           mountPath: /etc/coredns
  97.           readOnly: true
  98.         ports:
  99.         - containerPort: 53
  100.           name: dns
  101.           protocol: UDP
  102.         - containerPort: 53
  103.           name: dns-tcp
  104.           protocol: TCP
  105.         - containerPort: 9153
  106.           name: metrics
  107.           protocol: TCP
  108.         securityContext:
  109.           allowPrivilegeEscalation: false
  110.           capabilities:
  111.             add:
  112.             - NET_BIND_SERVICE
  113.             drop:
  114.             - all
  115.           readOnlyRootFilesystem: true
  116.         livenessProbe:
  117.           httpGet:
  118.             path: /health
  119.             port: 8080
  120.             scheme: HTTP
  121.           initialDelaySeconds: 60
  122.           timeoutSeconds: 5
  123.           successThreshold: 1
  124.           failureThreshold: 5
  125.       dnsPolicy: Default
  126.       volumes:
  127.         - name: config-volume
  128.           configMap:
  129.             name: coredns
  130.             items:
  131.             - key: Corefile
  132.               path: Corefile
  133. ---
  134. apiVersion: v1
  135. kind: Service
  136. metadata:
  137.   name: kube-dns
  138.   namespace: kube-system
  139.   annotations:
  140.     prometheus.io/scrape: "true"
  141.   labels:
  142.     k8s-app: kube-dns
  143.     kubernetes.io/cluster-service: "true"
  144.     kubernetes.io/name: "CoreDNS"
  145. spec:
  146.   selector:
  147.     k8s-app: kube-dns
  148.   clusterIP: CLUSTER_DNS_IP
  149.   ports:
  150.   - name: dns
  151.     port: 53
  152.     protocol: UDP
  153.   - name: dns-tcp
  154.     port: 53
  155.     protocol: TCP
三：備註
對於非RBAC部署，你需要編輯生成的結果yaml檔案：
1.從yaml檔案的Deployment部分刪除 serviceAccountName: coredns
2.刪除 ServiceAccount、 ClusterRole和 ClusterRoleBinding 部分



來自 “ ITPUB部落格 ” ，連結：http://blog.itpub.net/28624388/viewspace-2156642/，如需轉載，請註明出處，否則將追究法律責任。

相關文章