1、原理
每个Kubernetes service都绑定了一个虚拟IP 地址(ClusterIP),而且Kubernetes最初使用向pod中注入环境变量的方式实现服务发现,但这会带来环境变量泛滥等问题。故需要增加集群DNS服务为每个service映射一个域名。到Kubernetes v1.2版本时,DNS作为一个系统可选插件集成到Kubernetes集群中。Kubernetes默认使用SkyDNS作为集群的DNS服务器,kubernetes可以为pod提供dns(skyDNS)内部域名解析服务。其主要作用是为pod提供可以直接通过service的名字解析为对应service的ip的功能。启用了集群DNS选项,需要创建一个运行SkyDNS域名服务器的pod和一个对外提供集群service域名解析服务的SkyDNS service,并且还会为该service绑定一个稳定的 静态IP地址作为入口IP地址。然后,Kubelet被配置成向每个Docker容器传人SkyDNS service的IP地址。作为它们其中一个DNS服务器。每个在Kubernetes集群中定义的service包括DNS服务器本身对应的service都会被映射到一个DNS域名,该域名一般由两个部分组成:service所在namespace和service名。默认情况下,一个客户端pod的DNS搜索列表一般包含pod自身的namespace和集群的默认域名集。
SkyDNS service的域名搜索顺序大致如下。
- 大型网站高并发解决方案LVS搜索客户端pod所在namespace中所有的service域名记录;
- 搜索目标域名namespace中所有的service域名记录;
- 从当前Kubernetes集群中,搜索所有的service域名记录。
skyDNS由三部分组成:kube2sky、etcd、skydns。
- kube2sky的功能是监测api-server中的service的变化,当service创建、删除、修改时,获取对应的service信息,将其保存在etcd的中;
- Etcd的功能是存储kube2sky保存过来的数据;
- Skydns,在kubelet创建pod时,会使用为kubelet配置的"KUBELET_ARGS="--cluster-dns=10.254.10.2 --cluster-domain=sky --allow-privileged=true"" 在创建的pod中从而使用对应的dns服务器。而这一dns解析服务,实际是由Skydns提供的。
上面是Kubernetes1.2的,有点原始。 下面主要讲解Kubernetes1.4版本中的DNS插件的安装。 与1.2版本相比,1.4中的DNS增加了解析Pod(HostName)对应的域名的新功能,且在部署上也有了一些变化。
- 1.2中,需要部署etcd(或使用master上的Etcd)、kube2sky、skydns三个组件;
- 1.4中,DNS组件由kubedns(监控Kubernetes中DNS服务)和一个健康检查容器——healthz组成。
- 在搭建PetSet(宠物应用)时,系统首先要为PetSet设置一个HeadLess service,即service的ClusterIP显示的设置成none,而对每一个有特定名称的Pet(Named Pod),可以通过其HostName进行寻址访问。这就用到了1.4中的新功能。以下给出具体的搭建过程。
2、修改配置
2.1修改各个node上的kubelet
修改以下带**部分,完成后重启kubelet服务。
[root@k8s-node-1 /]# vim /etc/kubernetes/kubelet
###
# kubernetes kubelet (minion) config
# The address for the info server to serve on (set to 0.0.0.0 or "" for all interfaces)
KUBELET_ADDRESS="--address=0.0.0.0"
# The port for the info server to serve on
# KUBELET_PORT="--port=10250"
# You may leave this blank to use the actual hostname
KUBELET_HOSTNAME="--hostname-override=k8s-node-1"
# location of the api-server
KUBELET_API_SERVER="--api-servers=http://k8s-master:8080"
# pod infrastructure container
KUBELET_POD_INFRA_CONTAINER="--pod-infra-container-image=docker.io/tianyebj/pod-infrastructure:latest"
# Add your own!
**KUBELET_ARGS="--cluster-dns=10.254.10.2 --cluster-domain=cluster.local. --allow-privileged=true"
[root@k8s-node-1 ~]# systemctl restart kubelet.service
2.2修改APIserver
修改以下带**部分:
[root@k8s-master /]# vim /etc/kubernetes/apiserver
###
# kubernetes system config
#
# The following values are used to configure the kube-apiserver
#
# The address on the local server to listen to.
KUBE_API_ADDRESS="--insecure-bind-address=0.0.0.0"
# The port on the local server to listen on.
# KUBE_API_PORT="--port=8080"
KUBE_API_PORT="--port=8080"
# Port minions listen on
# KUBELET_PORT="--kubelet-port=10250"
# Comma separated list of nodes in the etcd cluster
KUBE_ETCD_SERVERS="--etcd-servers=http://etcd:2379"
# Address range to use for services
KUBE_SERVICE_ADDRESSES="--service-cluster-ip-range=10.254.0.0/16"
# default admission control policies
** KUBE_ADMISSION_CONTROL="--admission-control=NamespaceLifecycle,NamespaceExists,LimitRanger,SecurityContextDeny,ResourceQuota"
# Add your own!
KUBE_API_ARGS=""
2.3 修改yaml文件
注意修改以下带**部分:
[root@k8s-master /]# vim kube-dns-rc_14.yaml
apiVersion: v1
kind: ReplicationController
metadata:
name: kube-dns-v20
namespace: kube-system
labels:
k8s-app: kube-dns
version: v20
kubernetes.io/cluster-service: "true"
spec:
replicas: 1
selector:
k8s-app: kube-dns
version: v20
template:
metadata:
labels:
k8s-app: kube-dns
version: v20
annotations:
scheduler.alpha.kubernetes.io/critical-pod: ''
scheduler.alpha.kubernetes.io/tolerations: '[{"key":"CriticalAddonsOnly", "operator":"Exists"}]'
spec:
containers:
- name: kubedns
**image: docker.io/ist0ne/kubedns-amd64:latest
imagePullPolicy: IfNotPresent
resources:
# TODO: Set memory limits when we've profiled the container for large
# clusters, then set request = limit to keep this container in
# guaranteed class. Currently, this container falls into the
# "burstable" category so the kubelet doesn't backoff from restarting it.
limits:
memory: 170Mi
requests:
cpu: 100m
memory: 70Mi
livenessProbe:
httpGet:
path: /healthz-kubedns
port: 8080
scheme: HTTP
initialDelaySeconds: 60
timeoutSeconds: 5
successThreshold: 1
failureThreshold: 5
readinessProbe:
httpGet:
path: /readiness
port: 8081
scheme: HTTP
# we poll on pod startup for the Kubernetes master service and
# only setup the /readiness HTTP server once that's available.
initialDelaySeconds: 3
timeoutSeconds: 5
args:
# command = "/kube-dns"
**- --domain=cluster.local.
- --dns-port=10053
**- --kube-master-url=http://192.168.245.250:8080
ports:
- containerPort: 10053
name: dns-local
protocol: UDP
- containerPort: 10053
name: dns-tcp-local
protocol: TCP
- name: dnsmasq
**image: docker.io/mritd/kube-dnsmasq-amd64:latest
imagePullPolicy: IfNotPresent
livenessProbe:
httpGet:
path: /healthz-dnsmasq
port: 8080
scheme: HTTP
initialDelaySeconds: 60
timeoutSeconds: 5
successThreshold: 1
failureThreshold: 5
args:
- --cache-size=1000
- --no-resolv
- --server=127.0.0.1#10053
- --log-facility=-
ports:
- containerPort: 53
name: dns
protocol: UDP
- containerPort: 53
name: dns-tcp
protocol: TCP
- name: healthz
**image: docker.io/ist0ne/exechealthz-amd64:latest
imagePullPolicy: IfNotPresent
resources:
limits:
memory: 50Mi
requests:
cpu: 10m
# Note that this container shouldn't really need 50Mi of memory. The
# limits are set higher than expected pending investigation on #29688.
# The extra memory was stolen from the kubedns container to keep the
# net memory requested by the pod constant.
memory: 50Mi
args:
# cluster.local 部分
**- --cmd=nslookup kubernetes.default.svc.cluster.local. 127.0.0.1 >/dev/null
- --url=/healthz-dnsmasq
# cluster.local 部分
**- --cmd=nslookup kubernetes.default.svc.cluster.local. 127.0.0.1:10053 >/dev/null
- --url=/healthz-kubedns
- --port=8080
- --quiet
ports:
- containerPort: 8080
protocol: TCP
dnsPolicy: Default # Don't use cluster DNS.
[root@k8s-master dns14]# cat kube-dns-svc_14.yaml
apiVersion: v1
kind: Service
metadata:
name: kube-dns
namespace: kube-system
labels:
k8s-app: kube-dns
kubernetes.io/cluster-service: "true"
kubernetes.io/name: "KubeDNS"
spec:
selector:
k8s-app: kube-dns
clusterIP: 10.254.10.2
ports:
- name: dns
port: 53
protocol: UDP
- name: dns-tcp
port: 53
protocol: TCP
2.4 下载下面3个镜像
docker.io/ist0ne/kubedns-amd64:latest
docker.io/mritd/kube-dnsmasq-amd64:latest
docker.io/ist0ne/exechealthz-amd64:latest
还是没有国内源,需要先在国外服务器上下载然后打包拷贝到本地,再导入
3、启动
[root@k8s-master dns14]# kubectl create -f kube-dns-rc_14.yaml
replicationcontroller "kube-dns-v20" created
[root@k8s-master dns14]# kubectl create -f kube-dns-svc_14.yaml
service "kube-dns" created
4、查看
[root@k8s-master /]# kubectl get pod -o wide --all-namespaces
NAMESPACE NAME READY STATUS RESTARTS AGE IP NODE
kube-system kube-dns-v20-gbd1m 3/3 Running 0 19m 10.0.27.3 k8s-node-2
kube-system kubernetes-dashboard-latest-1231782504-t79t7 1/1 Running 0 6h 10.0.27.2 k8s-node-2
使用:
创建web容器-->通过kubectl exec -it Podip /bin/bash进入容器-->cat /etc/resolve.conf-->发现已经指定好DNS服务器IP,接下来可以直接使用其他pod的name了,比如:
# pod名:端口号
root@myweb-76h6w:/usr/local/tomcat# curl myweb:8080
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8" />
<title>Apache Tomcat/8.0.35</title>
<link href="favicon.ico" rel="icon" type="image/x-icon" />
<link href="favicon.ico" rel="shortcut icon" type="image/x-icon" />
<link href="tomcat.css" rel="stylesheet" type="text/css" />
</head>