查看iptables
sudo iptables-save > ./iptables.init.rules
k8s的DNS
1.在每个容器里面，有resolve.conf，指向默认的k8s-dns，但是IP是clusterIP。
resolve.png
[root@192-168-124-65 ~]# kube get svc --all-namespaces -o wide
NAMESPACE NAME CLUSTER-IP EXTERNAL-IP PORT(S) AGE SELECTOR
default bbbb-benchmark-tools 10.106.48.150 8080:31268/TCP 1h app=bbbb-benchmark-tools
default kubernetes 10.96.0.1 443/TCP 8d
kube-system kube-dns 10.96.0.2 53/UDP,53/TCP 8d k8s-app=kube-dns
2.但是只是clusterIP，该IP是虚拟的，完全由iptables重定向
-A KUBE-SERVICES -d 10.96.0.2/32 -p udp -m comment --comment "kube-system/kube-dns:dns cluster IP" -m udp --dport 53 -j KUBE-SVC-TCOU7JCQXEZGVUNU
-A KUBE-SVC-TCOU7JCQXEZGVUNU -m comment --comment "kube-system/kube-dns:dns" -j KUBE-SEP-ZZNQVAV2FG6QK37R
-A KUBE-SEP-ZZNQVAV2FG6QK37R -p udp -m comment --comment "kube-system/kube-dns:dns" -m udp -j DNAT --to-destination 172.28.217.133:53
最终转到k8s-dns的pod
[root@192-168-124-65 ~]# kube get pod --all-namespaces -o wide
NAMESPACE NAME READY STATUS RESTARTS AGE IP NODE
default bbbb-benchmark-tools-2280011006-m1zh0 1/1 Running 0 1h 172.28.246.4 192-168-124-64
kube-system calico-kube-controllers-2897584769-wh77q 1/1 Running 0 23h 192.168.124.65 192-168-124-65
kube-system calico-node-2kp5p 2/2 Running 2 23h 192.168.124.64 192-168-124-64
kube-system calico-node-65p73 2/2 Running 0 23h 192.168.124.65 192-168-124-65
kube-system kube-dns-2356124473-ft5n9 3/3 Running 0 23h 172.28.217.133 192-168-124-65
kube-system kube-dns-2356124473-m1m6d 3/3 Running 0 23h 172.28.217.132 192-168-124-65
kube-system kube-proxy-vq8q1 1/1 Running 18 8d 192.168.124.64 192-168-124-64
kube-system kube-proxy-w5cv3 1/1 Running 0 8d 192.168.124.65 192-168-124-65
3.验证，进入容器内部，使用nslookup
nslookup.png