尧图网站建设 
K8s集群云原生CoreDNS自定义配置安装部署部署实操技术栈CoreDNS v1.11.x Kubernetes v1.32.13 Rocky Linux 8.6 Containerd 1.7.x操作环境 / 对接原理 / 详细步骤 / 完整命令 / 配置文件 / 验证流程 / 排错方案K8s集群云原生CoreDNS自定义配置安装部署部署实操操作环境CoreDNS v1.11.x部署在 kube-system 命名空间K8s 集群 v1.32.13Rocky Linux 8.6CoreDNS ConfigMap 已配置默认 cluster.local 域CoreDNS 2副本Service IP 10.96.0.10上游DNS8.8.8.8 / 114.114.114.114Pod dnsPolicyClusterFirstresolv.conf 指向 CoreDNSkubectl v1.32.13cluster-admin 权限对接原理CoreDNS 是 K8s 默认 DNS 服务器通过 ConfigMap 配置 Corefile采用插件链Plugin Chain架构处理 DNS 查询。核心插件kubernetesK8s 服务发现监听 Service/Endpoint 生成 DNS 记录、forward转发到上游 DNS、cache缓存响应默认3600s、rewrite重写查询名/响应、hosts读取 hosts 文件、file读取 zone 文件、template模板生成响应、loadbalance轮询A记录、log/errors日志、health/ready健康检查、prometheus指标。Corefile 结构. { ... } 处理所有查询cluster.local { kubernetes ... } 处理集群内部域名自定义域 { ... } 处理特定域名。查询流程CoreDNS 接收查询 - 匹配 server block - 按插件顺序处理 - kubernetes 插件先查集群服务 - 未命中则 forward 到上游 - cache 缓存 - 返回响应。高可用多副本 CoreDNSPod 反亲和分布Service 负载均衡NodeLocal DNSCache 减少跨节点查询。详细步骤1. CoreDNS安装与部署# 查看当前CoreDNS kubectl get pods -n kube-system -l k8s-appkube-dns kubectl get svc kube-dns -n kube-system # 手动部署CoreDNS如未安装 cat coredns.yaml EOF apiVersion: v1 kind: ConfigMap metadata: name: coredns namespace: kube-system data: Corefile: | .:53 { errors health { lameduck 5s } ready kubernetes cluster.local in-addr.arpa ip6.arpa { pods insecure fallthrough in-addr.arpa ip6.arpa ttl 30 } prometheus :9153 forward . /etc/resolv.conf { max_concurrent 1000 } cache 30 loop reload loadbalance } --- apiVersion: apps/v1 kind: Deployment metadata: name: coredns namespace: kube-system labels: k8s-app: kube-dns spec: replicas: 2 selector: matchLabels: k8s-app: kube-dns template: metadata: labels: k8s-app: kube-dns spec: affinity: podAntiAffinity: requiredDuringSchedulingIgnoredDuringExecution: - labelSelector: {matchLabels: {k8s-app: kube-dns}} topologyKey: kubernetes.io/hostname containers: - name: coredns image: registry.k8s.io/coredns/coredns:v1.11.1 args: [-conf, /etc/coredns/Corefile] volumeMounts: - name: config-volume mountPath: /etc/coredns ports: - {containerPort: 53, name: dns, protocol: UDP} - {containerPort: 53, name: dns-tcp, protocol: TCP} - {containerPort: 9153, name: metrics} livenessProbe: httpGet: {path: /health, port: 8080} initialDelaySeconds: 60 readinessProbe: httpGet: {path: /ready, port: 8181} volumes: - name: config-volume configMap: name: coredns items: - key: Corefile path: Corefile --- apiVersion: v1 kind: Service metadata: name: kube-dns namespace: kube-system labels: {k8s-app: kube-dns} spec: selector: {k8s-app: kube-dns} clusterIP: 10.96.0.10 ports: - {name: dns, port: 53, protocol: UDP} - {name: dns-tcp, port: 53, protocol: TCP} EOF kubectl apply -f coredns.yaml # 验证 kubectl get pods -n kube-system -l k8s-appkube-dns kubectl get svc kube-dns -n kube-system验证流程# 1. 验证CoreDNS运行 kubectl get pods -n kube-system -l k8s-appkube-dns # Running # 2. 验证配置加载 kubectl logs -n kube-system deploy/coredns | grep -i Corefile # 无错误 # 3. 验证集群内解析 kubectl run dns-test --imagebusybox:1.28 --rm -it -- nslookup kubernetes.default.svc.cluster.local # 返回10.96.0.1 # 4. 验证外部解析 kubectl run dns-test --imagebusybox:1.28 --rm -it -- nslookup www.baidu.com # 5. 验证自定义域 kubectl run dns-test --imagebusybox:1.28 --rm -it -- nslookup gitlab.example.com # 6. 验证健康检查 kubectl exec -n kube-system deploy/coredns -- wget -qO- http://localhost:8080/health # OK # 7. 验证指标 curl http://coredns:9153/metrics | grep coredns_dns_requests_total排错方案CoreDNS CrashLoopBackOff检查Corefile语法coredns -conf Corefile -dryrun插件是否存在端口53是否被占用镜像是否可拉取查看日志错误行号集群内域名解析失败检查CoreDNS是否RunningService kube-dns是否存在Pod的resolv.conf nameserver是否为10.96.0.10kubernetes插件配置Endpoint是否更新外部域名解析失败检查forward插件上游DNS地址上游是否可达网络/防火墙max_concurrent限制上游健康检查状态节点DNS配置配置不生效检查reload插件是否启用ConfigMap更新后CoreDNS日志是否显示reload强制rollout restartCorefile语法错误会导致旧配置继续运行解析慢检查缓存命中率prometheus指标上游DNS延迟CoreDNS副本数NodeLocal DNSCache网络延迟forward policy配置缓存污染否定缓存(NXDOMAIN)时间过长导致服务不可用调整denial缓存时间重启CoreDNS清缓存检查服务是否真的不存在rewrite不生效检查rewrite位置应在kubernetes之前正则表达式是否正确answer name反向重写fallthrough配置日志查看重写过程高可用问题CoreDNS单副本故障导致全集群DNS失败增加副本数配置podAntiAffinityNodeLocal DNSCachePodDisruptionBudget健康检查 K8s集群云原生CoreDNS自定义配置安装部署部署实操
K8s集群云原生CoreDNS自定义配置安装部署部署实操技术栈CoreDNS v1.11.x Kubernetes v1.32.13 Rocky Linux 8.6 Containerd 1.7.x操作环境 / 对接原理 / 详细步骤 / 完整命令 / 配置文件 / 验证流程 / 排错方案K8s集群云原生CoreDNS自定义配置安装部署部署实操操作环境CoreDNS v1.11.x部署在 kube-system 命名空间K8s 集群 v1.32.13Rocky Linux 8.6CoreDNS ConfigMap 已配置默认 cluster.local 域CoreDNS 2副本Service IP 10.96.0.10上游DNS8.8.8.8 / 114.114.114.114Pod dnsPolicyClusterFirstresolv.conf 指向 CoreDNSkubectl v1.32.13cluster-admin 权限对接原理CoreDNS 是 K8s 默认 DNS 服务器通过 ConfigMap 配置 Corefile采用插件链Plugin Chain架构处理 DNS 查询。核心插件kubernetesK8s 服务发现监听 Service/Endpoint 生成 DNS 记录、forward转发到上游 DNS、cache缓存响应默认3600s、rewrite重写查询名/响应、hosts读取 hosts 文件、file读取 zone 文件、template模板生成响应、loadbalance轮询A记录、log/errors日志、health/ready健康检查、prometheus指标。Corefile 结构. { ... } 处理所有查询cluster.local { kubernetes ... } 处理集群内部域名自定义域 { ... } 处理特定域名。查询流程CoreDNS 接收查询 - 匹配 server block - 按插件顺序处理 - kubernetes 插件先查集群服务 - 未命中则 forward 到上游 - cache 缓存 - 返回响应。高可用多副本 CoreDNSPod 反亲和分布Service 负载均衡NodeLocal DNSCache 减少跨节点查询。详细步骤1. CoreDNS安装与部署# 查看当前CoreDNS kubectl get pods -n kube-system -l k8s-appkube-dns kubectl get svc kube-dns -n kube-system # 手动部署CoreDNS如未安装 cat coredns.yaml EOF apiVersion: v1 kind: ConfigMap metadata: name: coredns namespace: kube-system data: Corefile: | .:53 { errors health { lameduck 5s } ready kubernetes cluster.local in-addr.arpa ip6.arpa { pods insecure fallthrough in-addr.arpa ip6.arpa ttl 30 } prometheus :9153 forward . /etc/resolv.conf { max_concurrent 1000 } cache 30 loop reload loadbalance } --- apiVersion: apps/v1 kind: Deployment metadata: name: coredns namespace: kube-system labels: k8s-app: kube-dns spec: replicas: 2 selector: matchLabels: k8s-app: kube-dns template: metadata: labels: k8s-app: kube-dns spec: affinity: podAntiAffinity: requiredDuringSchedulingIgnoredDuringExecution: - labelSelector: {matchLabels: {k8s-app: kube-dns}} topologyKey: kubernetes.io/hostname containers: - name: coredns image: registry.k8s.io/coredns/coredns:v1.11.1 args: [-conf, /etc/coredns/Corefile] volumeMounts: - name: config-volume mountPath: /etc/coredns ports: - {containerPort: 53, name: dns, protocol: UDP} - {containerPort: 53, name: dns-tcp, protocol: TCP} - {containerPort: 9153, name: metrics} livenessProbe: httpGet: {path: /health, port: 8080} initialDelaySeconds: 60 readinessProbe: httpGet: {path: /ready, port: 8181} volumes: - name: config-volume configMap: name: coredns items: - key: Corefile path: Corefile --- apiVersion: v1 kind: Service metadata: name: kube-dns namespace: kube-system labels: {k8s-app: kube-dns} spec: selector: {k8s-app: kube-dns} clusterIP: 10.96.0.10 ports: - {name: dns, port: 53, protocol: UDP} - {name: dns-tcp, port: 53, protocol: TCP} EOF kubectl apply -f coredns.yaml # 验证 kubectl get pods -n kube-system -l k8s-appkube-dns kubectl get svc kube-dns -n kube-system验证流程# 1. 验证CoreDNS运行 kubectl get pods -n kube-system -l k8s-appkube-dns # Running # 2. 验证配置加载 kubectl logs -n kube-system deploy/coredns | grep -i Corefile # 无错误 # 3. 验证集群内解析 kubectl run dns-test --imagebusybox:1.28 --rm -it -- nslookup kubernetes.default.svc.cluster.local # 返回10.96.0.1 # 4. 验证外部解析 kubectl run dns-test --imagebusybox:1.28 --rm -it -- nslookup www.baidu.com # 5. 验证自定义域 kubectl run dns-test --imagebusybox:1.28 --rm -it -- nslookup gitlab.example.com # 6. 验证健康检查 kubectl exec -n kube-system deploy/coredns -- wget -qO- http://localhost:8080/health # OK # 7. 验证指标 curl http://coredns:9153/metrics | grep coredns_dns_requests_total排错方案CoreDNS CrashLoopBackOff检查Corefile语法coredns -conf Corefile -dryrun插件是否存在端口53是否被占用镜像是否可拉取查看日志错误行号集群内域名解析失败检查CoreDNS是否RunningService kube-dns是否存在Pod的resolv.conf nameserver是否为10.96.0.10kubernetes插件配置Endpoint是否更新外部域名解析失败检查forward插件上游DNS地址上游是否可达网络/防火墙max_concurrent限制上游健康检查状态节点DNS配置配置不生效检查reload插件是否启用ConfigMap更新后CoreDNS日志是否显示reload强制rollout restartCorefile语法错误会导致旧配置继续运行解析慢检查缓存命中率prometheus指标上游DNS延迟CoreDNS副本数NodeLocal DNSCache网络延迟forward policy配置缓存污染否定缓存(NXDOMAIN)时间过长导致服务不可用调整denial缓存时间重启CoreDNS清缓存检查服务是否真的不存在rewrite不生效检查rewrite位置应在kubernetes之前正则表达式是否正确answer name反向重写fallthrough配置日志查看重写过程高可用问题CoreDNS单副本故障导致全集群DNS失败增加副本数配置podAntiAffinityNodeLocal DNSCachePodDisruptionBudget健康检查