无法在Kubernetes群集中设置服务DNS_Dns_Kubernetes_Skydns

无法在Kubernetes群集中设置服务DNS

dns kubernetes

无法在Kubernetes群集中设置服务DNS,dns,kubernetes,skydns,Dns,Kubernetes,Skydns,Kubernetes版本-->1.5.2 我第一次为Kubernetes服务设置DNS，我遇到了SkyDNS。因此，在下面的文档中，我的skydns svc.yaml文件是： apiVersion: v1 kind: Service spec: clusterIP: 10.100.0.100 ports: - name: dns port: 53 protocol: UDP targetPort: 53 - name: dns-tcp port:

Kubernetes版本-->1.5.2

我第一次为Kubernetes服务设置DNS，我遇到了SkyDNS。因此，在下面的文档中，我的

skydns svc.yaml

文件是：

apiVersion: v1
kind: Service
spec:
  clusterIP: 10.100.0.100
  ports:
  - name: dns
    port: 53
    protocol: UDP
    targetPort: 53
  - name: dns-tcp
    port: 53
    protocol: TCP
    targetPort: 53
  selector:
    k8s-app: kube-dns
  sessionAffinity: None
  type: ClusterIP

apiVersion: v1
kind: ReplicationController
spec:
  replicas: 1
  selector:
    k8s-app: kube-dns
    version: v18
  template:
    metadata:
      creationTimestamp: null
      labels:
        k8s-app: kube-dns
        kubernetes.io/cluster-service: "true"
        version: v18
    spec:
      containers:
      - args:
        - --domain=kube.local
        - --dns-port=10053
        image: gcr.io/google_containers/kubedns-amd64:1.6
        imagePullPolicy: IfNotPresent
        name: kubedns
        ports:
        - containerPort: 10053
          name: dns-local
          protocol: UDP
        - containerPort: 10053
          name: dns-tcp-local
          protocol: TCP
        resources:
          limits:
            cpu: 100m
            memory: 200Mi
          requests:
            cpu: 100m
            memory: 100Mi
        terminationMessagePath: /dev/termination-log
      - args:
        - --cache-size=1000
        - --no-resolv
        - --server=127.0.0.1#10053
        image: gcr.io/google_containers/kube-dnsmasq-amd64:1.3
        imagePullPolicy: IfNotPresent
        name: dnsmasq
        ports:
        - containerPort: 53
          name: dns
          protocol: UDP
        - containerPort: 53
          name: dns-tcp
          protocol: TCP
        resources: {}
        terminationMessagePath: /dev/termination-log
      - args:
        - -cmd=nslookup kubernetes.default.svc.kube.local 127.0.0.1 >/dev/null &&
          nslookup kubernetes.default.svc.kube.local 127.0.0.1:10053 >/dev/null
        - -port=8080
        - -quiet
        image: gcr.io/google_containers/exechealthz-amd64:1.0
        imagePullPolicy: IfNotPresent
        name: healthz
        ports:
        - containerPort: 8080
          protocol: TCP
        resources:
          limits:
            cpu: 10m
            memory: 20Mi
          requests:
            cpu: 10m
            memory: 20Mi

我的

skydns rc.yaml

文件是：

apiVersion: v1
kind: Service
spec:
  clusterIP: 10.100.0.100
  ports:
  - name: dns
    port: 53
    protocol: UDP
    targetPort: 53
  - name: dns-tcp
    port: 53
    protocol: TCP
    targetPort: 53
  selector:
    k8s-app: kube-dns
  sessionAffinity: None
  type: ClusterIP

apiVersion: v1
kind: ReplicationController
spec:
  replicas: 1
  selector:
    k8s-app: kube-dns
    version: v18
  template:
    metadata:
      creationTimestamp: null
      labels:
        k8s-app: kube-dns
        kubernetes.io/cluster-service: "true"
        version: v18
    spec:
      containers:
      - args:
        - --domain=kube.local
        - --dns-port=10053
        image: gcr.io/google_containers/kubedns-amd64:1.6
        imagePullPolicy: IfNotPresent
        name: kubedns
        ports:
        - containerPort: 10053
          name: dns-local
          protocol: UDP
        - containerPort: 10053
          name: dns-tcp-local
          protocol: TCP
        resources:
          limits:
            cpu: 100m
            memory: 200Mi
          requests:
            cpu: 100m
            memory: 100Mi
        terminationMessagePath: /dev/termination-log
      - args:
        - --cache-size=1000
        - --no-resolv
        - --server=127.0.0.1#10053
        image: gcr.io/google_containers/kube-dnsmasq-amd64:1.3
        imagePullPolicy: IfNotPresent
        name: dnsmasq
        ports:
        - containerPort: 53
          name: dns
          protocol: UDP
        - containerPort: 53
          name: dns-tcp
          protocol: TCP
        resources: {}
        terminationMessagePath: /dev/termination-log
      - args:
        - -cmd=nslookup kubernetes.default.svc.kube.local 127.0.0.1 >/dev/null &&
          nslookup kubernetes.default.svc.kube.local 127.0.0.1:10053 >/dev/null
        - -port=8080
        - -quiet
        image: gcr.io/google_containers/exechealthz-amd64:1.0
        imagePullPolicy: IfNotPresent
        name: healthz
        ports:
        - containerPort: 8080
          protocol: TCP
        resources:
          limits:
            cpu: 10m
            memory: 20Mi
          requests:
            cpu: 10m
            memory: 20Mi

同样在我的手下，我更新了

/etc/systemd/system/multi-user.target.wants/kubelet.service

文件，并在

ExecStart

部分添加了以下内容：

ExecStart=/usr/bin/kubelet \
        $KUBE_LOGTOSTDERR \
        $KUBE_LOG_LEVEL \
        $KUBELET_API_SERVER \
        $KUBELET_ADDRESS \
        $KUBELET_PORT \
        $KUBELET_HOSTNAME \
        $KUBE_ALLOW_PRIV \
        $KUBELET_POD_INFRA_CONTAINER \
        $KUBELET_ARGS \
            --cluster-dns=10.100.0.100 \
            --cluster-domain=kubernetes \

完成所有这些工作并成功启动了

rc

svc

：

[root@kubernetes-master DNS]# kubectl get po | grep dns
kube-dns-v18-hl8z6                                                3/3       Running             0          6s
[root@kubernetes-master DNS]# kubectl get svc | grep dns
kube-dns                            10.100.0.100     <none>        53/UDP,53/TCP                                                    20m

有什么我错过的吗

编辑：：

通过查看日志，我看到了一些可以解释为什么这不起作用的东西：

kubectl logs $(kubectl get pods -l k8s-app=kube-dns -o name) -c kubedns
.
.
.
E1220 17:44:48.403976       1 reflector.go:216] pkg/dns/dns.go:154: Failed to list *api.Endpoints: Get https://10.100.0.1:443/api/v1/endpoints?resourceVersion=0: x509: failed to load system roots and no roots provided
E1220 17:44:48.487169       1 reflector.go:216] pkg/dns/dns.go:155: Failed to list *api.Service: Get https://10.100.0.1:443/api/v1/services?resourceVersion=0: x509: failed to load system roots and no roots provided
I1220 17:44:48.487716       1 dns.go:172] Ignoring error while waiting for service default/kubernetes: Get https://10.100.0.1:443/api/v1/namespaces/default/services/kubernetes: x509: failed to load system roots and no roots provided. Sleeping 1s before retrying.
E1220 17:44:49.410311       1 reflector.go:216] pkg/dns/dns.go:154: Failed to list *api.Endpoints: Get https://10.100.0.1:443/api/v1/endpoints?resourceVersion=0: x509: failed to load system roots and no roots provided
I1220 17:44:49.492338       1 dns.go:172] Ignoring error while waiting for service default/kubernetes: Get https://10.100.0.1:443/api/v1/namespaces/default/services/kubernetes: x509: failed to load system roots and no roots provided. Sleeping 1s before retrying.
E1220 17:44:49.493429       1 reflector.go:216] pkg/dns/dns.go:155: Failed to list *api.Service: Get https://10.100.0.1:443/api/v1/services?resourceVersion=0: x509: failed to load system roots and no roots provided
.
.
.

看起来

kubedns

无法针对K8S主节点进行授权。我甚至试着手动打电话：

curl -k https://10.100.0.1:443/api/v1/endpoints?resourceVersion=0
Unauthorized

看起来kube dnspod无法通过kubernetes api服务器进行身份验证。在

kube dns

pod的YAML文件中，我没有看到任何

secret

和

servicecomport

我建议采取以下措施：

使用

kubectl Create secret

为

kube dns

pod创建k8s

secret

，并使用正确的证书文件

ca.crt

和

令牌

：

$ kubectl get secrets -n=kube-system | grep dns
kube-dns-token-66tfx     kubernetes.io/service-account-token   3      1d

使用

kubectl Create servicecomport

为

kube dns

pod创建k8s

servicecomport

：

$ kubectl get serviceaccounts -n=kube-system | grep dns
kube-dns               1         1d`

在YAML文件的

kube dns

容器中的

/var/run/secrets/kubernetes.io/servicecount

处装载

secret

：

...
kind: Pod
...
spec:
  ...
  containers:
    ...
    volumeMounts:
    - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
      name: kube-dns-token-66tfx
      readOnly: true
  ...
  volumes:
  - name: kube-dns-token-66tfx
    secret:
      defaultMode: 420
      secretName: kube-dns-token-66tfx

以下是有关为POD创建serviceaccounts的链接：

你可能想试一试，它在我的一个集群上就像魅力一样。除此之外，您的部署似乎遗漏了一些细节，请查看这一点，以获得一个良好的起点。是的，它正在所有（主设备和辅助设备）上运行=http://master:8080我想我找到了问题所在。请阅读我的编辑。但是我不知道现在该怎么做，因为

kubedns

需要授权。有什么想法吗？