POD使用DNS工作原理

tag: k8s coredns

---

一、前言

有个同学不小心将CoreDNS干掉了，直接使用helm安装，但是DNS SVC的IP会重新分配一个。部署的POD的dns服务器地址不会变成新的（老的也不会改变）。

二、集群示例

kubelet 通过--cluster-dns= 传递dns的地址。当创建POD时，如果使用ClusterDNS，则/etc/resolv.conf文件里的地址就使用这个。参考官网

kubelet状态

查看kubelet的PID，及启动配置。

# systemctl status kubelet
● kubelet.service - kubelet: The Kubernetes Node Agent
   Loaded: loaded (/etc/systemd/system/kubelet.service; enabled; vendor preset: disabled)
  Drop-In: /etc/systemd/system/kubelet.service.d
           └─10-node-kubeadm.conf
   Active: active (running) since Wed 2020-04-15 22:37:12 CST; 1 months 24 days ago
     Docs: http://kubernetes.io/docs/
 Main PID: 1181 (kubelet)
   Memory: 354.7M
   CGroup: /system.slice/kubelet.service
           └─1181 /usr/bin/kubelet --bootstrap-kubeconfig=/etc/kubernetes/node-bootstrap-kubelet.conf --kubeconfig=/etc/kubernetes/kubelet.conf --config=/etc/kubelet/no...

kubelet启动参数

--config=/etc/kubelet/node-config.yaml 节点配置，里面配置了dns的地址。

[root@k8s-node-vm6fqz-77jtilv0tc ~]# cat /proc/1181/cmdline  | strings -1
/usr/bin/kubelet
--bootstrap-kubeconfig=/etc/kubernetes/node-bootstrap-kubelet.conf
--kubeconfig=/etc/kubernetes/kubelet.conf
--config=/etc/kubelet/node-config.yaml
--network-plugin=cni
--pod-infra-container-image=jdcloud-cn-south-1.jcr.service.jdcloud.com/k8s/pause-amd64:3.1
--kube-reserved=cpu=80m,memory=2562Mi
--node-labels=group=default,failure-domain.beta.kubernetes.io/zone=cn-south-1b,failure-domain.beta.kubernetes.io/region=cn-south-1
--cloud-provider=external

clusterDNS配置

默认dns地址为：172.16.56.10

# cat /etc/kubelet/node-config.yaml 
address: 0.0.0.0
apiVersion: kubelet.config.k8s.io/v1beta1
cgroupDriver: cgroupfs
cgroupsPerQOS: true
clusterDNS:
- 172.16.56.10
clusterDomain: cluster.local
configMapAndSecretChangeDetectionStrategy: Watch

三、DNS地址由来

以kubeadm部署集群为例，kubeadm默认获取svc网段下的第10个IP作为DNS的地址。

dns地址

• CoreDNS在创建SVC时调用GetDNSIP，显示的将ClusterIP字段进行设置。
• kubelet初始化时，调用GetDNSIP将地址传入到启动参数里。

cmd/kubeadm/app/constants/constants.go:GetDNSIP

// GetDNSIP returns a dnsIP, which is 10th IP in svcSubnet CIDR range
func GetDNSIP(svcSubnetList string, isDualStack bool) (net.IP, error) {
    // Get the service subnet CIDR
    svcSubnetCIDR, err := GetKubernetesServiceCIDR(svcSubnetList, isDualStack)
    if err != nil {
        return nil, errors.Wrapf(err, "unable to get internal Kubernetes Service IP from the given service CIDR (%s)", svcSubnetList)
    }

    // Selects the 10th IP in service subnet CIDR range as dnsIP
    dnsIP, err := utilnet.GetIndexedIP(svcSubnetCIDR, 10)
    if err != nil {
        return nil, errors.Wrap(err, "unable to get internal Kubernetes Service IP from the given service CIDR")
    }

    return dnsIP, nil
}

image-20200609120618743

四、POD DNS配置

dns内部类型

用户对pod的配置，会在内部进行转换，转为以下3种。

podDNSCluster k8s集群内部的DNS
podDNSHost 主机节点的DNS
podDNSNone 不配置DNS

dns配置转换

• “Default”: Pod从运行所在的节点继承名称解析配置。
• “ClusterFirst”: dnsPolicy的默认配置。与配置的群集域后缀不匹配的任何DNS查询(例如 “www.kubernetes.io” )都将转发到从节点继承的上游名称服务器。 群集管理员可能配置了额外的存根域和上游DNS服务器。
• “ClusterFirstWithHostNet”: hostNetwork=true的 Pod，应显式设置其DNS策略 “ClusterFirstWithHostNet”。
• “None”: 它允许 Pod 忽略 Kubernetes 环境中的 DN S设置。 应该使用 Pod Spec 中的 dnsConfig 字段提供所有 DNS 设置。

pkg/kubelet/network/dns/dns.go:getPodDNSType

func getPodDNSType(pod *v1.Pod) (podDNSType, error) {
    dnsPolicy := pod.Spec.DNSPolicy
    switch dnsPolicy {
    case v1.DNSNone:
        return podDNSNone, nil
    case v1.DNSClusterFirstWithHostNet:
        return podDNSCluster, nil
    case v1.DNSClusterFirst:
        if !kubecontainer.IsHostNetworkPod(pod) {
            return podDNSCluster, nil
        }
        // Fallback to DNSDefault for pod on hostnetowrk.
        fallthrough
    case v1.DNSDefault:
        return podDNSHost, nil
    }
    // This should not happen as kube-apiserver should have rejected
    // invalid dnsPolicy.
    return podDNSCluster, fmt.Errorf(fmt.Sprintf("invalid DNSPolicy=%v", dnsPolicy))
}

https://kubernetes.io/zh/docs/concepts/services-networking/dns-pod-service/

dns地址

pkg/kubelet/network/dns/dns.go:331

func (c *Configurer) GetPodDNS(pod *v1.Pod) (*runtimeapi.DNSConfig, error) {
    dnsConfig, err := c.getHostDNSConfig()

    dnsType, err := getPodDNSType(pod)

    switch dnsType {
    case podDNSNone:
        dnsConfig = &runtimeapi.DNSConfig{}
    case podDNSCluster:
        // 从c.clusterDNS里获取dns地址
        if len(c.clusterDNS) != 0 {
            dnsConfig.Servers = []string{}
            for _, ip := range c.clusterDNS {
                dnsConfig.Servers = append(dnsConfig.Servers, ip.String())
            }
            dnsConfig.Searches = c.generateSearchesForDNSClusterFirst(dnsConfig.Searches, pod)
            dnsConfig.Options = defaultDNSOptions
            break
        }
        fallthrough
    case podDNSHost:
        if c.ResolverConfig == "" {
            switch {
            case c.nodeIP == nil || c.nodeIP.To4() != nil:
                dnsConfig.Servers = []string{"127.0.0.1"}
            case c.nodeIP.To16() != nil:
                dnsConfig.Servers = []string{"::1"}
            }
            dnsConfig.Searches = []string{"."}
        }
    }

    if pod.Spec.DNSConfig != nil {
        dnsConfig = appendDNSConfig(dnsConfig, pod.Spec.DNSConfig)
    }
    return c.formDNSConfigFitsLimits(dnsConfig, pod), nil
}

五、DNS修复

1）重新创建， svc的IP设置为之前的地址。

helm install coredns -n kube-system stable/coredns --set service.clusterIP=10.0.56.10

2）更换DNS地址，需要修改kubelet配置，重启kubelet。