CoreDNS 服务发现

# CoreDNS Deployment
apiVersion: apps/v1
kind: Deployment
metadata:
  name: coredns
  namespace: kube-system
spec:
  replicas: 2
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxUnavailable: 1
  selector:
    matchLabels:
      k8s-app: kube-dns
  template:
    metadata:
      labels:
        k8s-app: kube-dns
    spec:
      priorityClassName: system-cluster-critical
      serviceAccountName: coredns
      tolerations:
        - key: "CriticalAddonsOnly"
          operator: "Exists"
      containers:
        - name: coredns
          image: registry.k8s.io/coredns/coredns:v1.11.1
          imagePullPolicy: IfNotPresent
          resources:
            limits:
              memory: 170Mi
            requests:
              cpu: 100m
              memory: 70Mi
          args: ["-conf", "/etc/coredns/Corefile"]
          volumeMounts:
            - name: config-volume
              mountPath: /etc/coredns
              readOnly: true
          ports:
            - containerPort: 53
              name: dns
              protocol: UDP
            - containerPort: 53
              name: dns-tcp
              protocol: TCP
            - containerPort: 9153
              name: metrics
              protocol: TCP
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              add:
                - NET_BIND_SERVICE
              drop:
                - all
            readOnlyRootFilesystem: true
          livenessProbe:
            httpGet:
              path: /health
              port: 8080
              scheme: HTTP
            initialDelaySeconds: 60
            timeoutSeconds: 5
          readinessProbe:
            httpGet:
              path: /ready
              port: 8181
              scheme: HTTP
      volumes:
        - name: config-volume
          configMap:
            name: coredns
            items:
              - key: Corefile
                path: Corefile
---
# CoreDNS Service
apiVersion: v1
kind: Service
metadata:
  name: kube-dns
  namespace: kube-system
  labels:
    k8s-app: kube-dns
spec:
  selector:
    k8s-app: kube-dns
  clusterIP: 10.96.0.10  # 固定 ClusterIP
  ports:
    - name: dns
      port: 53
      protocol: UDP
    - name: dns-tcp
      port: 53
      protocol: TCP
    - name: metrics
      port: 9153
      protocol: TCP

// plugin/kubernetes/kubernetes.go

// Kubernetes 插件
type Kubernetes struct {
    Next          plugin.Handler
    Zones         []string
    Upstream      *upstream.Upstream
    APIServer     string
    APICertAuth   string
    APIClientCert string
    APIClientKey  string
    APIConn       dnsController
    Namespaces    map[string]struct{}
    podMode       string
    TTL           uint32
}

// ServeDNS 处理 DNS 请求
func (k Kubernetes) ServeDNS(ctx context.Context, w dns.ResponseWriter, r *dns.Msg) (int, error) {
    state := request.Request{W: w, Req: r}

    // 检查是否属于管理的区域
    zone := plugin.Zones(k.Zones).Matches(state.Name())
    if zone == "" {
        return plugin.NextOrFailure(k.Name(), k.Next, ctx, w, r)
    }

    // 解析查询名称
    qname := state.Name()
    qtype := state.QType()

    // 处理不同类型的查询
    switch qtype {
    case dns.TypeA, dns.TypeAAAA:
        return k.resolveA(ctx, state, zone)
    case dns.TypeSRV:
        return k.resolveSRV(ctx, state, zone)
    case dns.TypePTR:
        return k.resolvePTR(ctx, state, zone)
    }

    return dns.RcodeNameError, nil
}

// resolveA 解析 A 记录
func (k Kubernetes) resolveA(ctx context.Context, state request.Request, zone string) (int, error) {
    // 解析查询名称
    // 格式: <service>.<namespace>.svc.<zone>
    // 或: <pod>.<service>.<namespace>.svc.<zone>

    segments := dns.SplitDomainName(state.Name())
    if len(segments) < 4 {
        return dns.RcodeNameError, nil
    }

    // 提取 service 和 namespace
    service := segments[0]
    namespace := segments[1]

    // 查询 Service
    svc, err := k.APIConn.SvcIndex(object.ServiceKey(service, namespace))
    if err != nil {
        return dns.RcodeServerFailure, err
    }
    if svc == nil {
        return dns.RcodeNameError, nil
    }

    // 构建响应
    m := new(dns.Msg)
    m.SetReply(state.Req)

    if svc.ClusterIP == v1.ClusterIPNone {
        // Headless Service：返回所有 Pod IP
        endpoints := k.APIConn.EpIndex(object.EndpointsKey(service, namespace))
        for _, ep := range endpoints {
            for _, addr := range ep.Addresses {
                m.Answer = append(m.Answer, &dns.A{
                    Hdr: dns.RR_Header{
                        Name:   state.QName(),
                        Rrtype: dns.TypeA,
                        Class:  dns.ClassINET,
                        Ttl:    k.TTL,
                    },
                    A: net.ParseIP(addr),
                })
            }
        }
    } else {
        // 普通 Service：返回 ClusterIP
        m.Answer = append(m.Answer, &dns.A{
            Hdr: dns.RR_Header{
                Name:   state.QName(),
                Rrtype: dns.TypeA,
                Class:  dns.ClassINET,
                Ttl:    k.TTL,
            },
            A: net.ParseIP(svc.ClusterIP),
        })
    }

    w.WriteMsg(m)
    return dns.RcodeSuccess, nil
}

apiVersion: v1
kind: Pod
metadata:
  name: dns-example
spec:
  containers:
    - name: test
      image: nginx
  # DNS 策略
  dnsPolicy: ClusterFirst  # 默认

apiVersion: v1
kind: Pod
metadata:
  name: custom-dns
spec:
  containers:
    - name: test
      image: nginx
  dnsPolicy: None
  dnsConfig:
    # 自定义 DNS 服务器
    nameservers:
      - 10.96.0.10    # CoreDNS
      - 8.8.8.8       # Google DNS
    # 搜索域
    searches:
      - default.svc.cluster.local
      - svc.cluster.local
      - cluster.local
    # DNS 选项
    options:
      - name: ndots
        value: "5"
      - name: timeout
        value: "2"
      - name: attempts
        value: "3"

// pkg/kubelet/network/dns/dns.go

// GetPodDNS 获取 Pod DNS 配置
func (c *Configurer) GetPodDNS(pod *v1.Pod) (*runtimeapi.DNSConfig, error) {
    dnsConfig := &runtimeapi.DNSConfig{}

    switch pod.Spec.DNSPolicy {
    case v1.DNSClusterFirstWithHostNet:
        fallthrough
    case v1.DNSClusterFirst:
        // 使用集群 DNS
        dnsConfig.Servers = []string{c.clusterDNS.String()}
        dnsConfig.Searches = c.generateSearches(pod.Namespace)
        dnsConfig.Options = c.defaultDNSOptions()

    case v1.DNSDefault:
        // 使用节点 DNS
        dnsConfig = c.getHostDNSConfig()

    case v1.DNSNone:
        // 只使用 dnsConfig
    }

    // 合并用户自定义配置
    if pod.Spec.DNSConfig != nil {
        dnsConfig = mergeDNSConfig(dnsConfig, pod.Spec.DNSConfig)
    }

    return dnsConfig, nil
}

// generateSearches 生成搜索域
func (c *Configurer) generateSearches(namespace string) []string {
    // 搜索域顺序：
    // 1. <namespace>.svc.<cluster-domain>
    // 2. svc.<cluster-domain>
    // 3. <cluster-domain>
    // 4. 节点搜索域（可选）

    searches := []string{
        fmt.Sprintf("%s.svc.%s", namespace, c.clusterDomain),
        fmt.Sprintf("svc.%s", c.clusterDomain),
        c.clusterDomain,
    }

    return searches
}

apiVersion: v1
kind: ConfigMap
metadata:
  name: coredns
  namespace: kube-system
data:
  Corefile: |
    .:53 {
        kubernetes cluster.local
        forward . /etc/resolv.conf
        cache 30
    }
    # Stub domain for internal services
    corp.example.com:53 {
        forward . 10.10.0.53
    }

# NodeLocal DNSCache DaemonSet
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: node-local-dns
  namespace: kube-system
spec:
  selector:
    matchLabels:
      k8s-app: node-local-dns
  template:
    metadata:
      labels:
        k8s-app: node-local-dns
    spec:
      hostNetwork: true
      dnsPolicy: Default
      containers:
        - name: node-cache
          image: registry.k8s.io/dns/k8s-dns-node-cache:1.22.20
          args:
            - "-localip"
            - "169.254.20.10"  # 本地 DNS 缓存 IP
            - "-conf"
            - "/etc/Corefile"
            - "-upstreamsvc"
            - "kube-dns"

# 减少 ndots 值以减少不必要的搜索
apiVersion: v1
kind: Pod
spec:
  dnsConfig:
    options:
      - name: ndots
        value: "2"  # 默认是 5

# 关键指标
- coredns_dns_requests_total           # DNS 请求总数
- coredns_dns_responses_total          # DNS 响应总数（按 rcode）
- coredns_dns_request_duration_seconds # 请求延迟
- coredns_cache_hits_total             # 缓存命中
- coredns_cache_misses_total           # 缓存未命中
- coredns_forward_requests_total       # 转发请求数
- coredns_forward_responses_total      # 转发响应数