Alpine镜像在K8S环境中DNS解析异常与DNS查询优化
基础环境
公司生产环境alpine基础基础镜像在解析类似``servicename、servicename.namespace.svc.cluster.local时不存在问题，能正常返回后端的SVC IP，但是解析servicename.namespace、servicename.namespace.svc`时存在异常，无法获取到正常IP，所以排查一下原因，发现是alpine基础镜像问题。
# alpine基础镜像版本
alpine:3.17.2
# 查看当前集群存在的SVC
╰─ kubectl get svc -n monitor ─╯
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
alertmanager-operated ClusterIP None <none> 9093/TCP,9094/TCP,9094/UDP 35d
monitor-grafana NodePort 10.96.200.100 <none> 80:30005/TCP 35d
monitor-kube-prometheus-st-alertmanager NodePort 10.96.193.81 <none> 9093:30004/TCP 35d
monitor-kube-prometheus-st-operator ClusterIP 10.96.88.67 <none> 443/TCP 35d
monitor-kube-prometheus-st-prometheus NodePort 10.96.249.181 <none> 9090:30003/TCP 35d
monitor-kube-state-metrics ClusterIP 10.96.115.64 <none> 8080/TCP 35d
monitor-prometheus-node-exporter ClusterIP 10.96.176.239 <none> 9100/TCP 35d
nginx ClusterIP None <none> 80/TCP 4d17h
prometheus-operated ClusterIP None <none> 9090/TCP 35d
之所以存在这种短域的写法，是为了减少拼接次数，通常的短域写法如下：
- Pod访问同命名空间的Service，优先使用
service-name代指Service名称 - Pod跨命名空间访问Service，优先使用
. namespace-name代指Service所处的命名空间 - Pod访问集群外部域名时，优先使用FQDN类型域名访问，这类域名通过常见域名最后加半角句号（.）的方式来指定地址，可以避免
search搜索域拼接带来的多次无效搜索，例如需要访问www.aliyun.com，则优先使用FQDN类型域名www.aliyun.com.来访问
通常我们一般在解析普通dns时，一般写法都是：servicename.namespace.svc.cluster.local,其流量抓包如下，从下述的抓包我们可知：
- 由于
servicename.namespace.svc.cluster.local.的个数<5，所以会走dns拼接，从抓包来看，查了nginx.monitor.svc.cluster.local.monitor.svc.cluster.local.、nginx.monitor.svc.cluster.local.svc.cluster.local.、nginx.monitor.svc.cluster.local.cluster.local.、nginx.monitor.svc.cluster.local.，前边大概有三次无效的DNS查询 - 解析
nginx时，由于.的个数<5，所以按照/etc/resolv.conf拼接，第一次拼接nginx.monitor.svc.cluster.local.时即可查询出ip，减少了DNS查询次数，但是这种写法一般只能用于同一个命名空间内 - 当我们需要跨命名空间通信时，可以这样写：
nginx.monitor由于.的个数<5，所以按照/etc/resolv.conf拼接，查询了nginx.monitor.monitor.svc.cluster.local.、nginx.monitor.svc.cluster.local.，可以发现跨命名空间这种写法，仅多查询了一次 - 我们解析类似
nginx.monitor.svc(一般不这么写),根据拼接规则可知会查询dns有nginx.monitor.svc.monitor.svc.cluster.local.、nginx.monitor.svc.svc.cluster.local.、nginx.monitor.svc.cluster.local.，多查询了二次才能解析到ip - 还有一种statefulset控制器中使用较多的查询后端pod的dns
podname.svcname.namespace.svc.cluster.local,根据拼接规则可知，如不跨命名空间通信推荐使用podname.svcname，如需要跨命名空间推荐使用podname.svcname.namespace来解析，前者一次即可解析出来，后者二次即可解析出来，其抓包下面也有
# 查看dns解析信息
bash-5.1# cat /etc/resolv.conf
nameserver 10.96.0.10
search monitor.svc.cluster.local svc.cluster.local cluster.local
options ndots:5
# 解析nginx.monitor.svc.cluster.local
bash-5.1# nslookup nginx.monitor.svc.cluster.local
Server: 10.96.0.10
Address: 10.96.0.10#53
Name: nginx.monitor.svc.cluster.local
Address: 172.16.0.78
Name: nginx.monitor.svc.cluster.local
Address: 172.16.1.64
[root@k8s-master-1 ~]# docker ps | grep tool
86ce5fe67ca7 f309c8fd1053 "/bin/sh -c 'sleep 1…" 7 seconds ago Up 6 seconds k8s_network-multitool_network-multitool_monitor_848cb38d-a4cf-4248-9ada-293437a17413_0
9d6663dc3841 registry.aliyuncs.com/google_containers/pause:3.8 "/pause" 7 seconds ago Up 6 seconds k8s_POD_network-multitool_monitor_848cb38d-a4cf-4248-9ada-293437a17413_0
[root@k8s-master-1 ~]# docker inspect 86ce5fe67ca7 | grep -i pid
"Pid": 91933,
"PidMode": "",
"PidsLimit": null,
# 抓包如下
[root@k8s-master-1 ~]# nsenter -t 91933 -n tcpdump -i any port domain -Nnnvl
tcpdump: data link type LINUX_SLL2
dropped privs to tcpdump
tcpdump: listening on any, link-type LINUX_SLL2 (Linux cooked v2), snapshot length 262144 bytes
17:38:25.150241 eth0 Out IP (tos 0x0, ttl 64, id 8111, offset 0, flags [none], proto UDP (17), length 103)
172.16.0.79.55212 > 10.96.0.10.53: 25756+ A? nginx.monitor.svc.cluster.local.monitor.svc.cluster.local. (75)
17:38:25.150662 eth0 In IP (tos 0x0, ttl 64, id 9540, offset 0, flags [DF], proto UDP (17), length 196)
10.96.0.10.53 > 172.16.0.79.55212: 25756 NXDomain*- 0/1/0 (168)
17:38:25.154449 eth0 Out IP (tos 0x0, ttl 64, id 8112, offset 0, flags [none], proto UDP (17), length 95)
172.16.0.79.53010 > 10.96.0.10.53: 15187+ A? nginx.monitor.svc.cluster.local.svc.cluster.local. (67)
17:38:25.154698 eth0 In IP (tos 0x0, ttl 64, id 9541, offset 0, flags [DF], proto UDP (17), length 188)
10.96.0.10.53 > 172.16.0.79.53010: 15187 NXDomain*- 0/1/0 (160)
17:38:25.154809 eth0 Out IP (tos 0x0, ttl 64, id 8113, offset 0, flags [none], proto UDP (17), length 91)
172.16.0.79.50964 > 10.96.0.10.53: 41361+ A? nginx.monitor.svc.cluster.local.cluster.local. (63)
17:38:25.154966 eth0 In IP (tos 0x0, ttl 64, id 9542, offset 0, flags [DF], proto UDP (17), length 184)
10.96.0.10.53 > 172.16.0.79.50964: 41361 NXDomain*- 0/1/0 (156)
17:38:25.155086 eth0 Out IP (tos 0x0, ttl 64, id 8114, offset 0, flags [none], proto UDP (17), length 77)
172.16.0.79.48908 > 10.96.0.10.53: 23260+ A? nginx.monitor.svc.cluster.local. (49)
17:38:25.155245 eth0 In IP (tos 0x0, ttl 64, id 9543, offset 0, flags [DF], proto UDP (17), length 171)
10.96.0.10.53 > 172.16.0.79.48908: 23260*- 2/0/0 nginx.monitor.svc.cluster.local. A 172.16.0.78, nginx.monitor.svc.cluster.local. A 172.16.1.64 (143)
17:38:25.155754 eth0 Out IP (tos 0x0, ttl 64, id 8115, offset 0, flags [none], proto UDP (17), length 77)
172.16.0.79.42284 > 10.96.0.10.53: 55628+ AAAA? nginx.monitor.svc.cluster.local. (49)
17:38:25.156373 eth0 In IP (tos 0x0, ttl 64, id 9544, offset 0, flags [DF], proto UDP (17), length 170)
10.96.0.10.53 > 172.16.0.79.42284: 55628*- 0/1/0 (142)
# 解析: nginx,其抓包如下
[root@k8s-master-1 ~]# nsenter -t 91933 -n tcpdump -i any port domain -Nnnvl
tcpdump: data link type LINUX_SLL2
dropped privs to tcpdump
tcpdump: listening on any, link-type LINUX_SLL2 (Linux cooked v2), snapshot length 262144 bytes
17:44:55.238312 eth0 Out IP (tos 0x0, ttl 64, id 12041, offset 0, flags [none], proto UDP (17), length 77)
172.16.0.79.33648 > 10.96.0.10.53: 7150+ A? nginx.monitor.svc.cluster.local. (49)
17:44:55.238666 eth0 In IP (tos 0x0, ttl 64, id 24377, offset 0, flags [DF], proto UDP (17), length 171)
10.96.0.10.53 > 172.16.0.79.33648: 7150*- 2/0/0 nginx.monitor.svc.cluster.local. A 172.16.1.64, nginx.monitor.svc.cluster.local. A 172.16.0.78 (143)
17:44:55.242310 eth0 Out IP (tos 0x0, ttl 64, id 12042, offset 0, flags [none], proto UDP (17), length 77)
172.16.0.79.49147 > 10.96.0.10.53: 43921+ AAAA? nginx.monitor.svc.cluster.local. (49)
17:44:55.242537 eth0 In IP (tos 0x0, ttl 64, id 24378, offset 0, flags [DF], proto UDP (17), length 170)
10.96.0.10.53 > 172.16.0.79.49147: 43921*- 0/1/0 (142)
# 解析： nginx.monitor,其抓包如下：
[root@k8s-master-1 ~]# nsenter -t 91933 -n tcpdump -i any port domain -Nnnvl
tcpdump: data link type LINUX_SLL2
dropped privs to tcpdump
tcpdump: listening on any, link-type LINUX_SLL2 (Linux cooked v2), snapshot length 262144 bytes
17:49:55.440268 eth0 Out IP (tos 0x0, ttl 64, id 35930, offset 0, flags [none], proto UDP (17), length 85)
172.16.0.79.55867 > 10.96.0.10.53: 10150+ A? nginx.monitor.monitor.svc.cluster.local. (57)
17:49:55.440770 eth0 In IP (tos 0x0, ttl 64, id 32679, offset 0, flags [DF], proto UDP (17), length 178)
10.96.0.10.53 > 172.16.0.79.55867: 10150 NXDomain*- 0/1/0 (150)
17:49:55.440975 eth0 Out IP (tos 0x0, ttl 64, id 35931, offset 0, flags [none], proto UDP (17), length 77)
172.16.0.79.53984 > 10.96.0.10.53: 3418+ A? nginx.monitor.svc.cluster.local. (49)
17:49:55.441178 eth0 In IP (tos 0x0, ttl 64, id 32680, offset 0, flags [DF], proto UDP (17), length 171)
10.96.0.10.53 > 172.16.0.79.53984: 3418*- 2/0/0 nginx.monitor.svc.cluster.local. A 172.16.0.78, nginx.monitor.svc.cluster.local. A 172.16.1.64 (143)
17:49:55.441571 eth0 Out IP (tos 0x0, ttl 64, id 35932, offset 0, flags [none], proto UDP (17), length 77)
172.16.0.79.51724 > 10.96.0.10.53: 18190+ AAAA? nginx.monitor.svc.cluster.local. (49)
17:49:55.441766 eth0 In IP (tos 0x0, ttl 64, id 32681, offset 0, flags [DF], proto UDP (17), length 170)
10.96.0.10.53 > 172.16.0.79.51724: 18190*- 0/1/0 (142)
# 解析nginx-0.nginx（通常用于同命名空间通信）
bash-5.1# nslookup nginx-0.nginx
Server: 10.96.0.10
Address: 10.96.0.10#53
Name: nginx-0.nginx.monitor.svc.cluster.local
Address: 172.16.1.64
[root@k8s-master-1 ~]# nsenter -t 91933 -n tcpdump -i any port domain -Nnnvl
tcpdump: data link type LINUX_SLL2
dropped privs to tcpdump
tcpdump: listening on any, link-type LINUX_SLL2 (Linux cooked v2), snapshot length 262144 bytes
18:00:39.408649 eth0 Out IP (tos 0x0, ttl 64, id 8037, offset 0, flags [none], proto UDP (17), length 85)
172.16.0.79.59798 > 10.96.0.10.53: 53116+ A? nginx-0.nginx.monitor.svc.cluster.local. (57)
18:00:39.409023 eth0 In IP (tos 0x0, ttl 64, id 16065, offset 0, flags [DF], proto UDP (17), length 140)
10.96.0.10.53 > 172.16.0.79.59798: 53116*- 1/0/0 nginx-0.nginx.monitor.svc.cluster.local. A 172.16.1.64 (112)
18:00:39.413021 eth0 Out IP (tos 0x0, ttl 64, id 8038, offset 0, flags [none], proto UDP (17), length 85)
172.16.0.79.40082 > 10.96.0.10.53: 19536+ AAAA? nginx-0.nginx.monitor.svc.cluster.local. (57)
18:00:39.413512 eth0 In IP (tos 0x0, ttl 64, id 16066, offset 0, flags [DF], proto UDP (17), length 178)
10.96.0.10.53 > 172.16.0.79.40082: 19536*- 0/1/0 (150)
# 解析nginx-0.nginx.monitor（通常用于跨命名空间通信)
bash-5.1# nslookup nginx-0.nginx.monitor
Server: 10.96.0.10
Address: 10.96.0.10#53
Name: nginx-0.nginx.monitor.svc.cluster.local
Address: 172.16.1.64
[root@k8s-master-1 ~]# nsenter -t 91933 -n tcpdump -i any port domain -Nnnvl
tcpdump: data link type LINUX_SLL2
dropped privs to tcpdump
tcpdump: listening on any, link-type LINUX_SLL2 (Linux cooked v2), snapshot length 262144 bytes
18:01:58.195694 eth0 Out IP (tos 0x0, ttl 64, id 10099, offset 0, flags [none], proto UDP (17), length 93)
172.16.0.79.37081 > 10.96.0.10.53: 53744+ A? nginx-0.nginx.monitor.monitor.svc.cluster.local. (65)
18:01:58.196797 eth0 In IP (tos 0x0, ttl 64, id 20029, offset 0, flags [DF], proto UDP (17), length 186)
10.96.0.10.53 > 172.16.0.79.37081: 53744 NXDomain*- 0/1/0 (158)
18:01:58.204490 eth0 Out IP (tos 0x0, ttl 64, id 10100, offset 0, flags [none], proto UDP (17), length 85)
172.16.0.79.46972 > 10.96.0.10.53: 39248+ A? nginx-0.nginx.monitor.svc.cluster.local. (57)
18:01:58.204783 eth0 In IP (tos 0x0, ttl 64, id 20030, offset 0, flags [DF], proto UDP (17), length 140)
10.96.0.10.53 > 172.16.0.79.46972: 39248*- 1/0/0 nginx-0.nginx.monitor.svc.cluster.local. A 172.16.1.64 (112)
18:01:58.204965 eth0 Out IP (tos 0x0, ttl 64, id 10101, offset 0, flags [none], proto UDP (17), length 85)
172.16.0.79.57902 > 10.96.0.10.53: 3394+ AAAA? nginx-0.nginx.monitor.svc.cluster.local. (57)
18:01:58.205164 eth0 In IP (tos 0x0, ttl 64, id 20031, offset 0, flags [DF], proto UDP (17), length 178)
10.96.0.10.53 > 172.16.0.79.57902: 3394*- 0/1/0 (150)
alpine镜像解析servicename&servicename.namespace.svc.cluster.local
# 新开一个终端，抓取alpine容器内部的dns解析流量
[root@k8s-master-1 ~]# docker ps | grep alpine
94fa1bcf0a5e d74e625d9115 "/bin/sh -c 'sleep 1…" 8 minutes ago Up 8 minutes k8s_alpine_alpine_monitor_da1874a7-e739-4dd1-ae6e-7f2d49e04de7_4
c0f216c788cf registry.aliyuncs.com/google_containers/pause:3.8 "/pause" 8 minutes ago Up 8 minutes k8s_POD_alpine_monitor_da1874a7-e739-4dd1-ae6e-7f2d49e04de7_12
[root@k8s-master-1 ~]# docker inspect 94fa1bcf0a5e | grep -i pid
"Pid": 6425,
"PidMode": "",
"PidsLimit": null,
# 查看dns拼接
/ # cat /etc/resolv.conf
nameserver 10.96.0.10
search monitor.svc.cluster.local svc.cluster.local cluster.local
options ndots:5
# alpine基础镜像解析nginx
/ # nslookup nginx
Server: 10.96.0.10
Address: 10.96.0.10:53
** server can't find nginx.cluster.local: NXDOMAIN
** server can't find nginx.svc.cluster.local: NXDOMAIN
Name: nginx.monitor.svc.cluster.local
Address: 172.16.1.64
Name: nginx.monitor.svc.cluster.local
Address: 172.16.0.78
** server can't find nginx.cluster.local: NXDOMAIN
** server can't find nginx.svc.cluster.local: NXDOMAIN
# 使用alpine镜像解析servicename： nslookup nginx
[root@k8s-master-1 ~]# nsenter -t 6425 -n tcpdump -i any port domain -Nnnvl
tcpdump: data link type LINUX_SLL2
dropped privs to tcpdump
tcpdump: listening on any, link-type LINUX_SLL2 (Linux cooked v2), snapshot length 262144 bytes
17:08:12.031002 eth0 Out IP (tos 0x0, ttl 64, id 50483, offset 0, flags [DF], proto UDP (17), length 77)
172.16.0.67.55971 > 10.96.0.10.53: 37361+ A? nginx.monitor.svc.cluster.local. (49)
17:08:12.031210 eth0 Out IP (tos 0x0, ttl 64, id 50484, offset 0, flags [DF], proto UDP (17), length 69)
172.16.0.67.55971 > 10.96.0.10.53: 38528+ A? nginx.svc.cluster.local. (41)
17:08:12.031224 eth0 Out IP (tos 0x0, ttl 64, id 50485, offset 0, flags [DF], proto UDP (17), length 65)
172.16.0.67.55971 > 10.96.0.10.53: 39403+ A? nginx.cluster.local. (37)
17:08:12.031232 eth0 Out IP (tos 0x0, ttl 64, id 50486, offset 0, flags [DF], proto UDP (17), length 77)
172.16.0.67.55971 > 10.96.0.10.53: 40278+ AAAA? nginx.monitor.svc.cluster.local. (49)
17:08:12.031239 eth0 Out IP (tos 0x0, ttl 64, id 50487, offset 0, flags [DF], proto UDP (17), length 69)
172.16.0.67.55971 > 10.96.0.10.53: 52778+ AAAA? nginx.svc.cluster.local. (41)
17:08:12.031246 eth0 Out IP (tos 0x0, ttl 64, id 50488, offset 0, flags [DF], proto UDP (17), length 65)
172.16.0.67.55971 > 10.96.0.10.53: 53653+ AAAA? nginx.cluster.local. (37)
17:08:12.031744 eth0 In IP (tos 0x0, ttl 64, id 51319, offset 0, flags [DF], proto UDP (17), length 158)
10.96.0.10.53 > 172.16.0.67.55971: 53653 NXDomain*- 0/1/0 (130)
17:08:12.031814 eth0 In IP (tos 0x0, ttl 64, id 51320, offset 0, flags [DF], proto UDP (17), length 171)
10.96.0.10.53 > 172.16.0.67.55971: 37361*- 2/0/0 nginx.monitor.svc.cluster.local. A 172.16.1.64, nginx.monitor.svc.cluster.local. A 172.16.0.78 (143)
17:08:12.031843 eth0 In IP (tos 0x0, ttl 64, id 51321, offset 0, flags [DF], proto UDP (17), length 158)
10.96.0.10.53 > 172.16.0.67.55971: 39403 NXDomain*- 0/1/0 (130)
17:08:12.031911 eth0 In IP (tos 0x0, ttl 64, id 51322, offset 0, flags [DF], proto UDP (17), length 170)
10.96.0.10.53 > 172.16.0.67.55971: 40278*- 0/1/0 (142)
17:08:12.031944 eth0 In IP (tos 0x0, ttl 64, id 51323, offset 0, flags [DF], proto UDP (17), length 162)
10.96.0.10.53 > 172.16.0.67.55971: 38528 NXDomain*- 0/1/0 (134)
17:08:12.031998 eth0 In IP (tos 0x0, ttl 64, id 51324, offset 0, flags [DF], proto UDP (17), length 162)
10.96.0.10.53 > 172.16.0.67.55971: 52778 NXDomain*- 0/1/0 (134)
从alpine解析servicename的流量抓包我们可以确定
- alpine再解析servicename时，由于ndots<=5，所以帮我们拼接了
nginx.monitor.svc.cluster.local.、nginx.svc.cluster.local.、nginx.cluster.local.dns查询，这是符合/etc/resolv.conf的search规则的，其中nginx.monitor.svc.cluster.local.请求到达coredns后，是能被正常解析的。 - Nginx.monitor.svc.cluster.local由于是默认就可以拼接出来，这里不做测试了
alpine镜像解析servicename.namespace&servicename.namespace.svc
# 解析nginx.monitor域名，通常用于跨命名空间的时候使用
/ # nslookup nginx.monitor
Server: 10.96.0.10
Address: 10.96.0.10:53
** server can't find nginx.monitor: NXDOMAIN
** server can't find nginx.monitor: NXDOMAIN
# 抓包信息
[root@k8s-master-1 ~]# nsenter -t 6425 -n tcpdump -i any port domain -Nnnvl
tcpdump: data link type LINUX_SLL2
dropped privs to tcpdump
tcpdump: listening on any, link-type LINUX_SLL2 (Linux cooked v2), snapshot length 262144 bytes
17:20:51.579010 eth0 Out IP (tos 0x0, ttl 64, id 31173, offset 0, flags [DF], proto UDP (17), length 59)
172.16.0.67.35721 > 10.96.0.10.53: 60062+ A? nginx.monitor. (31)
17:20:51.579085 eth0 Out IP (tos 0x0, ttl 64, id 31174, offset 0, flags [DF], proto UDP (17), length 59)
172.16.0.67.35721 > 10.96.0.10.53: 60229+ AAAA? nginx.monitor. (31)
17:20:51.610681 eth0 In IP (tos 0x0, ttl 64, id 44955, offset 0, flags [DF], proto UDP (17), length 134)
10.96.0.10.53 > 172.16.0.67.35721: 60062 NXDomain 0/1/0 (106)
17:20:51.618168 eth0 In IP (tos 0x0, ttl 64, id 44956, offset 0, flags [DF], proto UDP (17), length 134)
10.96.0.10.53 > 172.16.0.67.35721: 60229 NXDomain 0/1/0 (106)
# 解析nginx.monitor.svc域名，安装search规则，应该也是可以解析的
/ # nslookup nginx.monitor.svc
Server: 10.96.0.10
Address: 10.96.0.10:53
** server can't find nginx.monitor.svc: NXDOMAIN
** server can't find nginx.monitor.svc: NXDOMAIN
# 抓包信息
[root@k8s-master-1 ~]# nsenter -t 6425 -n tcpdump -i any port domain -Nnnvl
tcpdump: data link type LINUX_SLL2
dropped privs to tcpdump
tcpdump: listening on any, link-type LINUX_SLL2 (Linux cooked v2), snapshot length 262144 bytes
17:22:31.052684 eth0 Out IP (tos 0x0, ttl 64, id 31870, offset 0, flags [DF], proto UDP (17), length 63)
172.16.0.67.46894 > 10.96.0.10.53: 63421+ A? nginx.monitor.svc. (35)
17:22:31.052870 eth0 Out IP (tos 0x0, ttl 64, id 31871, offset 0, flags [DF], proto UDP (17), length 63)
172.16.0.67.46894 > 10.96.0.10.53: 63629+ AAAA? nginx.monitor.svc. (35)
17:22:31.105724 eth0 In IP (tos 0x0, ttl 64, id 51505, offset 0, flags [DF], proto UDP (17), length 138)
10.96.0.10.53 > 172.16.0.67.46894: 63629 NXDomain 0/1/0 (110)
17:22:31.647632 eth0 In IP (tos 0x0, ttl 64, id 51506, offset 0, flags [DF], proto UDP (17), length 138)
10.96.0.10.53 > 172.16.0.67.46894: 63421 NXDomain 0/1/0 (110)
从上述的抓包我们可以知道，alpine基础镜像在解析servicename.namespace&servicename.namespace.svc时并未按照/etc/resolv.conf 中规则进行dns search，导致上述二种dns无法被解析，其中servicename.namespace通常用于跨命名空间的时候使用，之所以用servicename.namespace这种短域方式就是为了提高dns查询速度，减少无效dns查询
alpine镜像解析podname.servicename&podname.servicename.namespace
根据下面alpine基础镜像抓包我们可知
- alpine基础镜像在解析
podname.servicename&podname.servicename.namespace时，并为帮助我们拼接正常的DNS请求，从而导致无法获取到pod IP - 解析
nginx-0.nginx.monitor.svc.cluster.local
# 解析nginx-0.nginx
/ # nslookup nginx-0.nginx
Server: 10.96.0.10
Address: 10.96.0.10:53
** server can't find nginx-0.nginx: NXDOMAIN
** server can't find nginx-0.nginx: NXDOMAIN
# 其抓包如下（我们可以发现alpine镜像并未帮助我们正常拼接dns）
[root@k8s-master-1 ~]# nsenter -t 6425 -n tcpdump -i any port domain -Nnnvl
tcpdump: data link type LINUX_SLL2
dropped privs to tcpdump
tcpdump: listening on any, link-type LINUX_SLL2 (Linux cooked v2), snapshot length 262144 bytes
18:07:24.546216 eth0 Out IP (tos 0x0, ttl 64, id 42318, offset 0, flags [DF], proto UDP (17), length 59)
172.16.0.67.57526 > 10.96.0.10.53: 49224+ A? nginx-0.nginx. (31)
18:07:24.546382 eth0 Out IP (tos 0x0, ttl 64, id 42319, offset 0, flags [DF], proto UDP (17), length 59)
172.16.0.67.57526 > 10.96.0.10.53: 49432+ AAAA? nginx-0.nginx. (31)
18:07:24.572436 eth0 In IP (tos 0x0, ttl 64, id 60868, offset 0, flags [DF], proto UDP (17), length 134)
10.96.0.10.53 > 172.16.0.67.57526: 49224 NXDomain 0/1/0 (106)
18:07:24.882381 eth0 In IP (tos 0x0, ttl 64, id 60885, offset 0, flags [DF], proto UDP (17), length 134)
10.96.0.10.53 > 172.16.0.67.57526: 49432 NXDomain 0/1/0 (106)
# 解析nginx-0.nginx.monitor(通常用于夸命名空间通信)
/ # nslookup nginx-0.nginx.monitor
Server: 10.96.0.10
Address: 10.96.0.10:53
** server can't find nginx-0.nginx.monitor: NXDOMAIN
** server can't find nginx-0.nginx.monitor: NXDOMAIN
# 其抓包如下（我们可以发现alpine镜像并未帮助我们正常拼接dns）
[root@k8s-master-1 ~]# nsenter -t 6425 -n tcpdump -i any port domain -Nnnvl
tcpdump: data link type LINUX_SLL2
dropped privs to tcpdump
tcpdump: listening on any, link-type LINUX_SLL2 (Linux cooked v2), snapshot length 262144 bytes
18:09:59.491224 eth0 Out IP (tos 0x0, ttl 64, id 48128, offset 0, flags [DF], proto UDP (17), length 67)
172.16.0.67.40109 > 10.96.0.10.53: 29347+ A? nginx-0.nginx.monitor. (39)
18:09:59.491424 eth0 Out IP (tos 0x0, ttl 64, id 48129, offset 0, flags [DF], proto UDP (17), length 67)
172.16.0.67.40109 > 10.96.0.10.53: 29639+ AAAA? nginx-0.nginx.monitor. (39)
18:09:59.539390 eth0 In IP (tos 0x0, ttl 64, id 1427, offset 0, flags [DF], proto UDP (17), length 142)
10.96.0.10.53 > 172.16.0.67.40109: 29347 NXDomain 0/1/0 (114)
18:10:00.738049 eth0 In IP (tos 0x0, ttl 64, id 1436, offset 0, flags [DF], proto UDP (17), length 142)
10.96.0.10.53 > 172.16.0.67.40109: 29639 NXDomain 0/1/0 (114)
# 解析nginx-0.nginx.monitor.svc.cluster.local
/ # nslookup nginx-0.nginx.monitor.svc.cluster.local
Server: 10.96.0.10
Address: 10.96.0.10:53
Name: nginx-0.nginx.monitor.svc.cluster.local
Address: 172.16.1.64
结论
- 如果使用alpine镜像作为业务镜像，尽量不要使用短域写法，手动补全
svc.cluster.local，这种写法虽然会多查询很多次dns，但至少是能解析出来 - 将业务镜像替换成centos/debian/ubuntu等其他发行版本基础镜像，即可使用短域写法，提高DNS查询速度