kubernetes中coredns组件的高级用法

通过coredns实现内外流量分离

场景

1. 旧业务固定了域名，无法通过内部service直接访问服务
2. 需要实现内部流量和外部流量自动拆分

实现

1. 通过coredns的rewrite功能实现以上能力,如以下内部访问tenant.msa.chinamcloud.com域名时，会将流量转发到tenantapi.yunjiao.svc.cluster.local域名，实现内外域名访问一致。
2. 部分版本nginx配置时候可能遇见无法访问的情况

[root@k8s-master1 ingress]# cat coredns.yamlapiVersion: v1data:  Corefile: |    .:53 {        errors        health        rewrite name tenant.msa.chinamcloud.com tenantapi.yunjiao.svc.cluster.local        rewrite name console.msa.chinamcloud.com console.yunjiao.svc.cluster.local        rewrite name user.msa.chinamcloud.com userapi.yunjiao.svc.cluster.local        rewrite name lims.msa.chinamcloud.com lims.yunjiao.svc.cluster.local        rewrite name labapp.msa.chinamcloud.com limsapp.yunjiao.svc.cluster.local        kubernetes cluster.local in-addr.arpa ip6.arpa {           pods insecure           upstream           fallthrough in-addr.arpa ip6.arpa        }        prometheus :9153        forward . /etc/resolv.conf        cache 30        loop        reload        loadbalance    }kind: ConfigMapmetadata:  creationTimestamp: "2019-04-02T04:57:19Z"  name: coredns  namespace: kube-system  resourceVersion: "197"  selfLink: /api/v1/namespaces/kube-system/configmaps/coredns  uid: cb686453-5503-11e9-8ea6-005056be93f5

检查

[root@k8s-master1 ingress]#  kubectl run -it --rm --restart=Never --image=infoblox/dnstools:latest dnstoolsIf you don't see a command prompt, try pressing enter.dnstools# ping tenant.msa.chinamcloud.comPING tenant.msa.chinamcloud.com (10.98.220.54): 56 data bytes^C--- tenant.msa.chinamcloud.com ping statistics ---4 packets transmitted, 0 packets received, 100% packet loss

kubernetes内部实现hosts功能

coredns配置参考文档

场景

1. 通过kubernetes的coredns实现子域名解析
2. 实现kubernetes内部 hosts绑定功能

实现

创建pod时声明hosts(不推荐)

[root@k8s-master-1 coredns]# kubectl  explain  pods.spec.hostAliasesKIND:     PodVERSION:  v1RESOURCE: hostAliases <[]Object>DESCRIPTION:     HostAliases is an optional list of hosts and IPs that will be injected into     the pod's hosts file if specified. This is only valid for non-hostNetwork     pods.     HostAlias holds the mapping between IP and hostnames that will be injected     as an entry in the pod's hosts file.FIELDS:   hostnames    <[]string>     Hostnames for the above IP address.   ip        IP address of the host file entry.[root@k8s-master-1 coredns]#

coredns的hosts特性声明

hosts 字段部分指明了三个域名的解析地址

[root@k8s-master-1 coredns]# cat coredns-cm.yamlapiVersion: v1data:  Corefile: |    .:53 {        errors        health        hosts {            100.64.139.66 minio.chinamcloud.com            100.64.139.66 registry.chinamcloud.com            100.64.139.66 gitlab.chinamcloud.com            fallthrough        }        kubernetes cluster.local in-addr.arpa ip6.arpa {           pods insecure           upstream           fallthrough in-addr.arpa ip6.arpa        }        prometheus :9153        forward . /etc/resolv.conf        cache 30        loop        reload        loadbalance    }kind: ConfigMapmetadata:  name: coredns  namespace: kube-system

根据域名指定上游dns服务器

sobeydemo.com 字段指明了解析该域名的dns服务器地址

[root@k8s-master-1 coredns]# cat coredns-cm.yamlapiVersion: v1data:  Corefile: |    .:53 {        errors        health        kubernetes cluster.local in-addr.arpa ip6.arpa {           pods insecure           upstream           fallthrough in-addr.arpa ip6.arpa        }        prometheus :9153        forward . /etc/resolv.conf        cache 30        loop        reload        loadbalance    }    sobeydemo.com {        forward . 100.64.134.250:53    }kind: ConfigMapmetadata:  name: coredns  namespace: kube-system

检查

[root@k8s-master-1 coredns]#  kubectl run -it --rm --restart=Never --image=infoblox/dnstools:latest dnstoolsIf you don't see a command prompt, try pressing enter.dnstools# host 0DJ01YUR.sobeydemo.com0DJ01YUR.sobeydemo.com has address 100.64.148.1160DJ01YUR.sobeydemo.com has IPv6 address 2002:6440:9474::6440:9474dnstools# host minio.chinamcloud.comminio.chinamcloud.com has address 100.64.139.66Host minio.chinamcloud.com not found: 3(NXDOMAIN)Host minio.chinamcloud.com not found: 3(NXDOMAIN)dnstools#