K8s中的DNS、API资源对象ingress、搞懂kubernetes调度、节点选择器NodeSelector和节点亲和性NodeAffinity

一、Kubernetes里的DNS

K8s集群内的DNS：

kubectl get svc -n kube-system |grep dns

[root@aminglinux01 ~]# kubectl get svc -n kube-system |grep dns
kube-dns   ClusterIP   10.15.0.10   <none>        53/UDP,53/TCP,9153/TCP   10d
[root@aminglinux01 ~]#

 测试：

在aminglinux01上安装bind-utils,目的是安装dig命令
yum install -y bind-utils
解析外网域名
dig @10.15.0.10 www.baidu.com

[root@aminglinux01 ~]# dig @10.15.0.10 www.baidu.com

; <<>> DiG 9.11.36-RedHat-9.11.36-14.el8_10 <<>> @10.15.0.10 www.baidu.com
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 39465
;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
; COOKIE: 1441cb1e9ce39e75 (echoed)
;; QUESTION SECTION:
;www.baidu.com.			IN	A

;; ANSWER SECTION:
www.baidu.com.		30	IN	CNAME	www.a.shifen.com.
www.a.shifen.com.	30	IN	A	110.242.68.3
www.a.shifen.com.	30	IN	A	110.242.68.4

;; Query time: 13 msec
;; SERVER: 10.15.0.10#53(10.15.0.10)
;; WHEN: Mon Jul 15 03:27:29 CST 2024
;; MSG SIZE  rcvd: 161

[root@aminglinux01 ~]# 

解析内部域名dig @10.15.0.10 ngx-svc.default.svc.cluster.local

完整的service域名解析是：<servicename>.<namespace>.svc.<clusterdomain> 其中，servicename为service名称，namespace为service所处的命名空间，clusterdomain是k8s集群设计的域名后缀，默认为cluster.local。

[root@aminglinux01 ~]# dig @10.15.0.10 ngx-svc.default.svc.cluster.local

; <<>> DiG 9.11.36-RedHat-9.11.36-14.el8_10 <<>> @10.15.0.10 ngx-svc.default.svc.cluster.local
; (1 server found)
;; global options: +cmd
;; Got answer:
;; WARNING: .local is reserved for Multicast DNS
;; You are currently testing what happens when an mDNS query is leaked to DNS
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 40305
;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
;; WARNING: recursion requested but not available

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
; COOKIE: 46e55f77a8dd5366 (echoed)
;; QUESTION SECTION:
;ngx-svc.default.svc.cluster.local. IN	A

;; ANSWER SECTION:
ngx-svc.default.svc.cluster.local. 30 IN A	10.15.157.72

;; Query time: 0 msec
;; SERVER: 10.15.0.10#53(10.15.0.10)
;; WHEN: Mon Jul 15 03:32:40 CST 2024
;; MSG SIZE  rcvd: 123

[root@aminglinux01 ~]# 

  还可以解析Pod，Pod的域名有点特殊，格式为<pod-ip>.<namespace>.pod.<cluster-domain>，例如其中Pod IP部分需要用 “-” 替换 “.” 符号，例如下面Pod的IP地址为10.18.68.140：，系统为这个Pod设置的DNS域名为10.18.68.140.default.pod.cluster.local，用 nslookup进行验证，便可以成功解析该域名的IP地址为10.18.68.140：

dig@10.15.0.10 10-18-68-140.default.pod.cluster.local

[root@aminglinux01 ~]# dig @10.15.0.10 10-18-68-140.default.pod.cluster.local

; <<>> DiG 9.11.36-RedHat-9.11.36-14.el8_10 <<>> @10.15.0.10 10-18-68-140.default.pod.cluster.local
; (1 server found)
;; global options: +cmd
;; Got answer:
;; WARNING: .local is reserved for Multicast DNS
;; You are currently testing what happens when an mDNS query is leaked to DNS
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 21202
;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
;; WARNING: recursion requested but not available

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
; COOKIE: 2b2d4dded38ef1c3 (echoed)
;; QUESTION SECTION:
;10-18-68-140.default.pod.cluster.local.	IN A

;; ANSWER SECTION:
10-18-68-140.default.pod.cluster.local.	30 IN A	10.18.68.140

;; Query time: 0 msec
;; SERVER: 10.15.0.10#53(10.15.0.10)
;; WHEN: Mon Jul 15 03:40:20 CST 2024
;; MSG SIZE  rcvd: 133

[root@aminglinux01 ~]# 

对应的Pod为coredns：

kubectl get po coredns -n kube-system

[root@aminglinux01 ~]# kubectl get pod -n kube-system
NAME                                      READY   STATUS    RESTARTS       AGE
calico-kube-controllers-57b57c56f-h2znw   1/1     Running   4 (2d2h ago)   6d6h
calico-node-6tnmp                         1/1     Running   0              100m
calico-node-gf6vm                         1/1     Running   0              99m
calico-node-gzxh9                         1/1     Running   0              100m
coredns-567c556887-pqv8h                  1/1     Running   8 (2d2h ago)   10d
coredns-567c556887-vgsth                  1/1     Running   8 (2d2h ago)   10d
etcd-aminglinux01                         1/1     Running   8 (2d2h ago)   10d
kube-apiserver-aminglinux01               1/1     Running   8 (2d2h ago)   10d
kube-controller-manager-aminglinux01      1/1     Running   8 (2d2h ago)   10d
kube-proxy-fbzxg                          1/1     Running   8 (2d2h ago)   10d
kube-proxy-k82tm                          1/1     Running   4 (6d2h ago)   10d
kube-proxy-zl2dc                          1/1     Running   3 (6d2h ago)   10d
kube-scheduler-aminglinux01               1/1     Running   8 (2d2h ago)   10d
nfs-client-provisioner-d79cfd7f6-q2n4z    1/1     Running   0              5d23h
[root@aminglinux01 ~]# 

查看defalut命名空间Pod里的/etc/resolv.conf

[root@aminglinux01 ~]# kubectl exec -it ng-deploy-6d94878b66-8t2hq -- cat /etc/resolv.conf 
search default.svc.cluster.local svc.cluster.local cluster.local
nameserver 10.15.0.10
options ndots:5
[root@aminglinux01 ~]# 

查看yeyunyi命名空间Pod里的/etc/resolv.conf 

kubectl exec -it quota-pod -n yeyunyi  -- cat /etc/resolv.conf

[root@aminglinux01 ~]# kubectl exec -it quota-pod -n yeyunyi  -- cat /etc/resolv.conf 
search yeyunyi.svc.cluster.local svc.cluster.local cluster.local
nameserver 10.15.0.10
options ndots:5
[root@aminglinux01 ~]#

解释：

• nameserver: 定义DNS服务器的IP，其实就是kube-dns那个service的IP。
• search: 定义域名的查找后缀规则，查找配置越多，说明域名解析查找匹配次数越多。集群匹配有 default.svc.cluster.local、svc.cluster.local、cluster.local 3个后缀，最多进行8次查询 (IPV4和IPV6查询各四次) 才能得到正确解析结果。不同命名空间，这个参数的值也不同。
• option: 定义域名解析配置文件选项，支持多个KV值。例如该参数设置成ndots:5，说明如果访问的域名字符串内的点字符数量超过ndots值，则认为是完整域名，并被直接解析；如果不足ndots值，则追加search段后缀再进行查询。

DNS配置

可以通过查看coredns的configmap来获取DNS的配置信息：

[root@aminglinux01 ~]# kubectl describe cm coredns -n kube-system
Name:         core