tag: k8s coredns
一、前言
有个同学不小心将CoreDNS干掉了，直接使用helm安装，但是DNS SVC的IP会重新分配一个。部署的POD的dns服务器地址不会变成新的（老的也不会改变）。
二、集群示例
kubelet 通过--cluster-dns=<dns-service-ip> 传递dns的地址。当创建POD时，如果使用ClusterDNS，则/etc/resolv.conf文件里的地址就使用这个。参考官网
kubelet状态
查看kubelet的PID，及启动配置。
# systemctl status kubelet
● kubelet.service - kubelet: The Kubernetes Node Agent
Loaded: loaded (/etc/systemd/system/kubelet.service; enabled; vendor preset: disabled)
Drop-In: /etc/systemd/system/kubelet.service.d
└─10-node-kubeadm.conf
Active: active (running) since Wed 2020-04-15 22:37:12 CST; 1 months 24 days ago
Docs: http://kubernetes.io/docs/
Main PID: 1181 (kubelet)
Memory: 354.7M
CGroup: /system.slice/kubelet.service
└─1181 /usr/bin/kubelet --bootstrap-kubeconfig=/etc/kubernetes/node-bootstrap-kubelet.conf --kubeconfig=/etc/kubernetes/kubelet.conf --config=/etc/kubelet/no...
kubelet启动参数
--config=/etc/kubelet/node-config.yaml 节点配置，里面配置了dns的地址。
[root@k8s-node-vm6fqz-77jtilv0tc ~]# cat /proc/1181/cmdline | strings -1
/usr/bin/kubelet
--bootstrap-kubeconfig=/etc/kubernetes/node-bootstrap-kubelet.conf
--kubeconfig=/etc/kubernetes/kubelet.conf
--config=/etc/kubelet/node-config.yaml
--network-plugin=cni
--pod-infra-container-image=jdcloud-cn-south-1.jcr.service.jdcloud.com/k8s/pause-amd64:3.1
--kube-reserved=cpu=80m,memory=2562Mi
--node-labels=group=default,failure-domain.beta.kubernetes.io/zone=cn-south-1b,failure-domain.beta.kubernetes.io/region=cn-south-1
--cloud-provider=external
clusterDNS配置
默认dns地址为：172.16.56.10
# cat /etc/kubelet/node-config.yaml
address: 0.0.0.0
apiVersion: kubelet.config.k8s.io/v1beta1
cgroupDriver: cgroupfs
cgroupsPerQOS: true
clusterDNS:
- 172.16.56.10
clusterDomain: cluster.local
configMapAndSecretChangeDetectionStrategy: Watch
三、DNS地址由来
以kubeadm部署集群为例，kubeadm默认获取svc网段下的第10个IP作为DNS的地址。
dns地址
- CoreDNS在创建SVC时调用GetDNSIP，显示的将ClusterIP字段进行设置。
- kubelet初始化时，调用GetDNSIP将地址传入到启动参数里。
cmd/kubeadm/app/constants/constants.go:GetDNSIP
// GetDNSIP returns a dnsIP, which is 10th IP in svcSubnet CIDR range
func GetDNSIP(svcSubnetList string, isDualStack bool) (net.IP, error) {
// Get the service subnet CIDR
svcSubnetCIDR, err := GetKubernetesServiceCIDR(svcSubnetList, isDualStack)
if err != nil {
return nil, errors.Wrapf(err, "unable to get internal Kubernetes Service IP from the given service CIDR (%s)", svcSubnetList)
}
// Selects the 10th IP in service subnet CIDR range as dnsIP
dnsIP, err := utilnet.GetIndexedIP(svcSubnetCIDR, 10)
if err != nil {
return nil, errors.Wrap(err, "unable to get internal Kubernetes Service IP from the given service CIDR")
}
return dnsIP, nil
}
image-20200609120618743
四、POD DNS配置
dns内部类型
用户对pod的配置，会在内部进行转换，转为以下3种。
podDNSCluster k8s集群内部的DNS
podDNSHost 主机节点的DNS
podDNSNone 不配置DNS
dns配置转换
- “
Default”: Pod从运行所在的节点继承名称解析配置。 - “
ClusterFirst”: dnsPolicy的默认配置。与配置的群集域后缀不匹配的任何DNS查询(例如 “www.kubernetes.io” )都将转发到从节点继承的上游名称服务器。 群集管理员可能配置了额外的存根域和上游DNS服务器。 - “
ClusterFirstWithHostNet”:hostNetwork=true的 Pod，应显式设置其DNS策略 “ClusterFirstWithHostNet”。 - “
None”: 它允许 Pod 忽略 Kubernetes 环境中的 DN S设置。 应该使用 Pod Spec 中的dnsConfig字段提供所有 DNS 设置。
pkg/kubelet/network/dns/dns.go:getPodDNSType
func getPodDNSType(pod *v1.Pod) (podDNSType, error) {
dnsPolicy := pod.Spec.DNSPolicy
switch dnsPolicy {
case v1.DNSNone:
return podDNSNone, nil
case v1.DNSClusterFirstWithHostNet:
return podDNSCluster, nil
case v1.DNSClusterFirst:
if !kubecontainer.IsHostNetworkPod(pod) {
return podDNSCluster, nil
}
// Fallback to DNSDefault for pod on hostnetowrk.
fallthrough
case v1.DNSDefault:
return podDNSHost, nil
}
// This should not happen as kube-apiserver should have rejected
// invalid dnsPolicy.
return podDNSCluster, fmt.Errorf(fmt.Sprintf("invalid DNSPolicy=%v", dnsPolicy))
}
https://kubernetes.io/zh/docs/concepts/services-networking/dns-pod-service/
dns地址
pkg/kubelet/network/dns/dns.go:331
func (c *Configurer) GetPodDNS(pod *v1.Pod) (*runtimeapi.DNSConfig, error) {
dnsConfig, err := c.getHostDNSConfig()
dnsType, err := getPodDNSType(pod)
switch dnsType {
case podDNSNone:
dnsConfig = &runtimeapi.DNSConfig{}
case podDNSCluster:
// 从c.clusterDNS里获取dns地址
if len(c.clusterDNS) != 0 {
dnsConfig.Servers = []string{}
for _, ip := range c.clusterDNS {
dnsConfig.Servers = append(dnsConfig.Servers, ip.String())
}
dnsConfig.Searches = c.generateSearchesForDNSClusterFirst(dnsConfig.Searches, pod)
dnsConfig.Options = defaultDNSOptions
break
}
fallthrough
case podDNSHost:
if c.ResolverConfig == "" {
switch {
case c.nodeIP == nil || c.nodeIP.To4() != nil:
dnsConfig.Servers = []string{"127.0.0.1"}
case c.nodeIP.To16() != nil:
dnsConfig.Servers = []string{"::1"}
}
dnsConfig.Searches = []string{"."}
}
}
if pod.Spec.DNSConfig != nil {
dnsConfig = appendDNSConfig(dnsConfig, pod.Spec.DNSConfig)
}
return c.formDNSConfigFitsLimits(dnsConfig, pod), nil
}
五、DNS修复
1）重新创建， svc的IP设置为之前的地址。
helm install coredns -n kube-system stable/coredns --set service.clusterIP=10.0.56.10
2）更换DNS地址，需要修改kubelet配置，重启kubelet。
