部署DNS服務

kubedns負責從KUBERNETES_SERVICE_HOST收集service+namespace與clusterIP的對映關係；
dnsmasq根據kubedns收集的資訊，提供名稱解析服務。

下載映象到本地倉庫

kubedns-amd64:1.8
kube-dnsmasq-amd64:1.4
exechealthz-amd64:1.2
這三個映象無法從gcr.io下載的話，可從阿里雲提供的映象倉庫下載。
本地映象倉庫的搭建方法詳見之前的博文。

docker pull registry.cn-hangzhou.aliyuncs.com/google-containers
 
/exechealthz-amd64:1.2
docker tag registry.cn-hangzhou.aliyuncs.com/google-containers/exechealthz-amd64:1.2 centos-master:5000/exechealthz-amd64:1.2
docker rmi registry.cn-hangzhou.aliyuncs.com/google-containers/exechealthz-amd64:1.2
docker push centos-master:5000/exechealthz-amd64:1.2

部署服務

kube-dns服務的clusterIP明確指定為clusterIP可用值的第二個值10.254.0.2，第一個clusterIP值10.254.0.1留給了k8s自動建立的kubernetes.default服務。
執行如下命令，生成kube-dns的deployment和service。
dnsmasq的啟動引數裡增加了--address配置，讓dnsmasq順便提供一下自用的本地泛域名解析服務。

cat <<EOF | kubectl apply -f -
apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  name: kube-dns
  namespace: kube-system
  labels:
    k8s-app: kube-dns
    version: v20
    kubernetes.io/cluster-service: "true"
spec:
  replicas: 1
  template:
    metadata:
      labels:
        k8s-app: kube-dns
        version: v20
      annotations:
        scheduler.alpha.kubernetes.io/critical-pod: ''
        scheduler.alpha.kubernetes.io/tolerations: '[{"key":"CriticalAddonsOnly", "operator":"Exists"}]'
    spec:
      containers:
      - name:
 
 kubedns
        image: centos-master:5000/kubedns-amd64:1.8
        resources:
          limits:
            memory: 170Mi
          requests:
            cpu: 100m
            memory: 70Mi
        livenessProbe:
          httpGet:
            path: /healthz-kubedns
            port: 8080
            scheme: HTTP
          initialDelaySeconds: 60
          timeoutSeconds: 5
          successThreshold: 1
          failureThreshold: 5
        readinessProbe:
          httpGet:
            path: /readiness
            port: 8081
            scheme: HTTP
          initialDelaySeconds: 3
          timeoutSeconds: 5
        args:
        - --domain=cluster.local.
        - --dns-port=10053
        ports:
        - containerPort: 10053
          name: dns-local
          protocol: UDP
        - containerPort: 10053
          name: dns-tcp-local
          protocol: TCP
      - name: dnsmasq
        image: centos-master:5000/kube-dnsmasq-amd64:1.4
        livenessProbe:
          httpGet:
            path: /healthz-dnsmasq
            port: 8080
            scheme: HTTP
          initialDelaySeconds: 60
          timeoutSeconds: 5
          successThreshold: 1
          failureThreshold: 5
        args:
        - --cache-size=1000
        - --no-resolv
        - --server=127.0.0.1#10053
        - --address=/wzp.local/192.168.137.75
        - --log-facility=-
        ports:
        - containerPort: 53
          name: dns
          protocol: UDP
        - containerPort: 53
          name: dns-tcp
          protocol: TCP
      - name: healthz
        image: centos-master:5000/exechealthz-amd64:1.2
        resources:
          limits:
            memory: 50Mi
          requests:
            cpu: 10m
            memory: 50Mi
        args:
        - --cmd=nslookup kubernetes.default.svc.cluster.local 127.0.0.1 >/dev/null
        - --url=/healthz-dnsmasq
        - --cmd=nslookup kubernetes.default.svc.cluster.local 127.0.0.1:10053 >/dev/null
        - --url=/healthz-kubedns
        - --port=8080
        - --quiet
        ports:
        - containerPort: 8080
          protocol: TCP
      dnsPolicy: Default
---
apiVersion: v1
kind: Service
metadata:
  name: kube-dns
  namespace: kube-system
  labels:
    k8s-app: kube-dns
    kubernetes.io/cluster-service: "true"
    kubernetes.io/name: "KubeDNS"
spec:
  selector:
    k8s-app: kube-dns
  clusterIP: 10.254.0.2
  ports:
  - name: dns
    port: 53
    protocol: UDP
  - name: dns-tcp
    port: 53
    protocol: TCP
EOF

確認kubedns容器能正常從apiServer獲取service資訊

kubectl logs $(kubectl get pods --namespace=kube-system -l k8s-app=kube-dns -o name) -c kubedns -n kube-system

讓kubelet修改每個pod的預設DNS

修改kubelet引數

修改引數檔案/etc/kubernetes/kubelet

KUBELET_ARGS="--cluster_dns=10.254.0.2 --cluster_domain=cluster.local --kubeconfig=/etc/kubernetes/kube-admin-context.yaml --pod-infra-container-image=centos-master:5000/pause-amd64:3.0"

重啟node

停止node上的元件，清理node已有的iptables設定
重啟node上的元件，讓每個pod都用10.254.0.2作為預設DNS

for SERVICES in kube-proxy kubelet flanneld docker; do
    systemctl stop $SERVICES
done

iptables --flush
iptables -tnat --flush

for SERVICES in kube-proxy kubelet flanneld docker; do
    systemctl restart $SERVICES
    systemctl enable $SERVICES
    systemctl status $SERVICES
done

DNS查詢測試

登入一個容器，檢視預設的dns

kubectl exec -ti busybox -- cat /etc/resolv.conf

登入一個容器，進行dns查詢

kubectl exec -ti busybox -- nslookup kubernetes.default