Skip to content

Commit 8251c73

Browse files
jmgao1983jmgao1983
committed
更新kubedns文档
1 parent 2d26c01 commit 8251c73

File tree

5 files changed

+255
-6
lines changed

5 files changed

+255
-6
lines changed

‎90.setup.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
# 在deploy节点生成CA相关证书，以供整个集群使用
22
- hosts: deploy
33
roles:
4-
- ca
4+
- deploy
55

66
# 集群节点的公共配置任务
77
- hosts:

‎docs/05-安装calico网络组件.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -162,7 +162,7 @@ spec:
162162

163163
### 验证calico网络
164164

165-
执行calico安装 `ansible-playbook 05.calico.yml` 成功后可以验证如下：需要等待一会儿
165+
执行calico安装 `ansible-playbook 05.calico.yml` 成功后可以验证如下：(需要等待calico/node:v2.6.2 镜像下载完成，有时候即便上一步已经配置了docker国内加速，还是可能比较慢，建议确认以下容器运行起来以后，再执行后续步骤)
166166

167167
``` bash
168168
docker ps

‎docs/guide/kubedns.md

+52-1
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,58 @@ kubedns 是 k8s 集群首先需要部署的，集群中的其他 pods 使用它
66

77
### 安装
88

9-
kubectl create -f /etc/ansible/manifests/kubedns/[kubedns.yaml](../../manifests/kubedns/kubedns.yaml)
9+
**kubectl create -f /etc/ansible/manifests/kubedns/[kubedns.yaml](../../manifests/kubedns/kubedns.yaml)**
10+
11+
+ 注意deploy中使用的 serviceAccount `kube-dns`，该预定义的 ClusterRoleBinding system:kube-dns 将 kube-system 命名空间的 kube-dns ServiceAccount 与 system:kube-dns ClusterRole 绑定， 因此POD 具有访问 kube-apiserver DNS 相关 API 的权限；
12+
+ 集群 pod默认继承 node的dns 解析，修改 kubelet服务启动参数 --resolv-conf=""，可以更改这个特性，详见 kubelet 启动参数
13+
14+
### 验证 kubedns
15+
16+
新建一个测试nginx服务
17+
18+
`kubectl run nginx --image=nginx --expose --port=80`
19+
20+
确认nginx服务
21+
22+
``` bash
23+
kubectl get pod|grep nginx
24+
nginx-7cbc4b4d9c-fl46v 1/1 Running 0 1m
25+
kubectl get svc|grep nginx
26+
nginx ClusterIP 10.68.33.167 <none> 80/TCP 1m
27+
```
28+
29+
测试pod busybox
30+
31+
``` bash
32+
kubectl run busybox --rm -it --image=busybox /bin/sh
33+
If you don't see a command prompt, try pressing enter.
34+
/ # cat /etc/resolv.conf
35+
nameserver 10.68.0.2
36+
search default.svc.cluster.local. svc.cluster.local. cluster.local.
37+
options ndots:5
38+
# 测试集群内部服务解析
39+
/ # nslookup nginx
40+
Server: 10.68.0.2
41+
Address 1: 10.68.0.2 kube-dns.kube-system.svc.cluster.local
42+
43+
Name: nginx
44+
Address 1: 10.68.33.167 nginx.default.svc.cluster.local
45+
/ # nslookup kubernetes
46+
Server: 10.68.0.2
47+
Address 1: 10.68.0.2 kube-dns.kube-system.svc.cluster.local
48+
49+
Name: kubernetes
50+
Address 1: 10.68.0.1 kubernetes.default.svc.cluster.local
51+
# 测试外部域名的解析，默认集成node的dns解析
52+
/ # nslookup www.baidu.com
53+
Server: 10.68.0.2
54+
Address 1: 10.68.0.2 kube-dns.kube-system.svc.cluster.local
55+
56+
Name: www.baidu.com
57+
Address 1: 180.97.33.108
58+
Address 2: 180.97.33.107
59+
/ #
60+
```
1061
1162
1263

‎manifests/kubedns/kubedns.yaml

+198
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,198 @@
1+
---
2+
apiVersion: v1
3+
kind: ConfigMap
4+
metadata:
5+
name: kube-dns
6+
namespace: kube-system
7+
labels:
8+
addonmanager.kubernetes.io/mode: EnsureExists
9+
10+
---
11+
apiVersion: v1
12+
kind: ServiceAccount
13+
metadata:
14+
name: kube-dns
15+
namespace: kube-system
16+
labels:
17+
kubernetes.io/cluster-service: "true"
18+
addonmanager.kubernetes.io/mode: Reconcile
19+
20+
---
21+
apiVersion: v1
22+
kind: Service
23+
metadata:
24+
name: kube-dns
25+
namespace: kube-system
26+
labels:
27+
k8s-app: kube-dns
28+
kubernetes.io/cluster-service: "true"
29+
addonmanager.kubernetes.io/mode: Reconcile
30+
kubernetes.io/name: "KubeDNS"
31+
spec:
32+
selector:
33+
k8s-app: kube-dns
34+
clusterIP: 10.68.0.2
35+
ports:
36+
- name: dns
37+
port: 53
38+
protocol: UDP
39+
- name: dns-tcp
40+
port: 53
41+
protocol: TCP
42+
43+
---
44+
apiVersion: extensions/v1beta1
45+
kind: Deployment
46+
metadata:
47+
name: kube-dns
48+
namespace: kube-system
49+
labels:
50+
k8s-app: kube-dns
51+
kubernetes.io/cluster-service: "true"
52+
addonmanager.kubernetes.io/mode: Reconcile
53+
spec:
54+
# replicas: not specified here:
55+
# 1. In order to make Addon Manager do not reconcile this replicas parameter.
56+
# 2. Default is 1.
57+
# 3. Will be tuned in real time if DNS horizontal auto-scaling is turned on.
58+
strategy:
59+
rollingUpdate:
60+
maxSurge: 10%
61+
maxUnavailable: 0
62+
selector:
63+
matchLabels:
64+
k8s-app: kube-dns
65+
template:
66+
metadata:
67+
labels:
68+
k8s-app: kube-dns
69+
annotations:
70+
scheduler.alpha.kubernetes.io/critical-pod: ''
71+
spec:
72+
tolerations:
73+
- key: "CriticalAddonsOnly"
74+
operator: "Exists"
75+
volumes:
76+
- name: kube-dns-config
77+
configMap:
78+
name: kube-dns
79+
optional: true
80+
containers:
81+
- name: kubedns
82+
#image: gcr.io/google_containers/k8s-dns-kube-dns-amd64:1.14.5
83+
image: mirrorgooglecontainers/k8s-dns-kube-dns-amd64:1.14.5
84+
resources:
85+
# TODO: Set memory limits when we've profiled the container for large
86+
# clusters, then set request = limit to keep this container in
87+
# guaranteed class. Currently, this container falls into the
88+
# "burstable" category so the kubelet doesn't backoff from restarting it.
89+
limits:
90+
memory: 170Mi
91+
requests:
92+
cpu: 100m
93+
memory: 70Mi
94+
livenessProbe:
95+
httpGet:
96+
path: /healthcheck/kubedns
97+
port: 10054
98+
scheme: HTTP
99+
initialDelaySeconds: 60
100+
timeoutSeconds: 5
101+
successThreshold: 1
102+
failureThreshold: 5
103+
readinessProbe:
104+
httpGet:
105+
path: /readiness
106+
port: 8081
107+
scheme: HTTP
108+
# we poll on pod startup for the Kubernetes master service and
109+
# only setup the /readiness HTTP server once that's available.
110+
initialDelaySeconds: 3
111+
timeoutSeconds: 5
112+
args:
113+
- --domain=cluster.local.
114+
- --dns-port=10053
115+
- --config-dir=/kube-dns-config
116+
- --v=2
117+
env:
118+
- name: PROMETHEUS_PORT
119+
value: "10055"
120+
ports:
121+
- containerPort: 10053
122+
name: dns-local
123+
protocol: UDP
124+
- containerPort: 10053
125+
name: dns-tcp-local
126+
protocol: TCP
127+
- containerPort: 10055
128+
name: metrics
129+
protocol: TCP
130+
volumeMounts:
131+
- name: kube-dns-config
132+
mountPath: /kube-dns-config
133+
- name: dnsmasq
134+
#image: gcr.io/google_containers/k8s-dns-dnsmasq-nanny-amd64:1.14.5
135+
image: mirrorgooglecontainers/k8s-dns-dnsmasq-nanny-amd64:1.14.5
136+
livenessProbe:
137+
httpGet:
138+
path: /healthcheck/dnsmasq
139+
port: 10054
140+
scheme: HTTP
141+
initialDelaySeconds: 60
142+
timeoutSeconds: 5
143+
successThreshold: 1
144+
failureThreshold: 5
145+
args:
146+
- -v=2
147+
- -logtostderr
148+
- -configDir=/etc/k8s/dns/dnsmasq-nanny
149+
- -restartDnsmasq=true
150+
- --
151+
- -k
152+
- --cache-size=1000
153+
- --log-facility=-
154+
- --server=/cluster.local./127.0.0.1#10053
155+
- --server=/in-addr.arpa/127.0.0.1#10053
156+
- --server=/ip6.arpa/127.0.0.1#10053
157+
ports:
158+
- containerPort: 53
159+
name: dns
160+
protocol: UDP
161+
- containerPort: 53
162+
name: dns-tcp
163+
protocol: TCP
164+
# see: https://github.com/kubernetes/kubernetes/issues/29055 for details
165+
resources:
166+
requests:
167+
cpu: 150m
168+
memory: 20Mi
169+
volumeMounts:
170+
- name: kube-dns-config
171+
mountPath: /etc/k8s/dns/dnsmasq-nanny
172+
- name: sidecar
173+
#image: gcr.io/google_containers/k8s-dns-sidecar-amd64:1.14.5
174+
image: mirrorgooglecontainers/k8s-dns-sidecar-amd64:1.14.5
175+
livenessProbe:
176+
httpGet:
177+
path: /metrics
178+
port: 10054
179+
scheme: HTTP
180+
initialDelaySeconds: 60
181+
timeoutSeconds: 5
182+
successThreshold: 1
183+
failureThreshold: 5
184+
args:
185+
- --v=2
186+
- --logtostderr
187+
- --probe=kubedns,127.0.0.1:10053,kubernetes.default.svc.cluster.local.,5,A
188+
- --probe=dnsmasq,127.0.0.1:53,kubernetes.default.svc.cluster.local.,5,A
189+
ports:
190+
- containerPort: 10054
191+
name: metrics
192+
protocol: TCP
193+
resources:
194+
requests:
195+
memory: 20Mi
196+
cpu: 10m
197+
dnsPolicy: Default # Don't use cluster DNS.
198+
serviceAccountName: kube-dns

‎manifests/kubedns/readme.md

+3-3
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
### 说明
22

3-
+ 本目录为k8s集群的插件 kube-dns的配置目录，初始时本目录为空
3+
+ 本目录为k8s集群的插件 kube-dns的配置目录
44
+ 因kubedns.yaml文件中参数(CLUSTER_DNS_SVC_IP, CLUSTER_DNS_DOMAIN)根据hosts文件设置而定，需要使用ansible template模块替换参数后生成
5-
+ 运行 `ansible-playbook 01.prepare.yml`后该目录下生成kubedns.yaml 文件
6-
+ kubedns.yaml [模板文件](../../roles/deploy/template/kubedns.yaml.j2)
5+
+ 运行 `ansible-playbook 01.prepare.yml`后会重新生成该目录下的kubedns.yaml 文件
6+
+ kubedns.yaml [模板文件](../../roles/deploy/templates/kubedns.yaml.j2)

0 commit comments

Comments
 (0)