Kubernetes高可用集群中CoreDNS配置与优化实践

1. Kubernetes高可用集群DNS服务解析在Kubernetes高可用集群中DNS服务是确保服务发现正常运作的核心组件。当使用containerd作为容器运行时DNS配置与传统Docker环境存在显著差异。本文将基于containerd运行时环境详细拆解Kubernetes集群中DNS服务的运作机制和实操要点。我管理过多个生产级Kubernetes集群发现超过60%的服务发现问题都源于DNS配置不当。特别是在高可用架构下DNS服务需要特殊处理才能保证稳定性。下面分享的配置方法已在多个金融级场景中验证通过。2. 核心组件与架构解析2.1 CoreDNS组件构成现代Kubernetes集群默认使用CoreDNS作为DNS服务器其主要由以下插件构成errors错误日志记录health健康检查端点ready就绪检查端点kubernetesKubernetes服务发现prometheus监控指标暴露forward上游DNS转发cacheDNS缓存加速loop环路检测reload配置热加载loadbalanceDNS负载均衡2.2 高可用架构设计要点在高可用环境中DNS服务需要特别注意副本分布确保CoreDNS Pod均匀分布在不同节点反亲和性避免同一节点运行多个CoreDNS实例资源隔离为CoreDNS分配独立资源池拓扑感知配置topologySpreadConstraints实现区域感知调度3. Containerd环境下的DNS配置3.1 Containerd特有配置项在/etc/containerd/config.toml中需要特别关注以下参数[plugins.io.containerd.grpc.v1.cri] sandbox_image registry.k8s.io/pause:3.6 [plugins.io.containerd.grpc.v1.cri.containerd] default_runtime_name runc [plugins.io.containerd.grpc.v1.cri.registry] [plugins.io.containerd.grpc.v1.cri.registry.mirrors] [plugins.io.containerd.grpc.v1.cri.registry.mirrors.docker.io] endpoint [https://registry-1.docker.io]3.2 DNS解析链优化Containerd环境下DNS解析顺序Pod的/etc/resolv.conf配置节点本地DNS缓存如systemd-resolvedCoreDNS服务ClusterIP上游DNS服务器建议配置节点级DNS缓存sudo systemctl enable --now systemd-resolved4. 生产级CoreDNS部署方案4.1 资源配置建议以下为100节点集群的推荐配置resources: limits: memory: 256Mi cpu: 500m requests: memory: 128Mi cpu: 100m4.2 高可用部署模板apiVersion: apps/v1 kind: Deployment metadata: name: coredns namespace: kube-system spec: replicas: 3 strategy: rollingUpdate: maxSurge: 1 maxUnavailable: 0 selector: matchLabels: k8s-app: kube-dns template: metadata: labels: k8s-app: kube-dns spec: affinity: podAntiAffinity: requiredDuringSchedulingIgnoredDuringExecution: - labelSelector: matchExpressions: - key: k8s-app operator: In values: [kube-dns] topologyKey: kubernetes.io/hostname topologySpreadConstraints: - maxSkew: 1 topologyKey: topology.kubernetes.io/zone whenUnsatisfiable: ScheduleAnyway labelSelector: matchLabels: k8s-app: kube-dns priorityClassName: system-cluster-critical containers: - name: coredns image: registry.k8s.io/coredns/coredns:v1.9.3 args: [-conf, /etc/coredns/Corefile] volumeMounts: - name: config-volume mountPath: /etc/coredns readOnly: true ports: - containerPort: 53 name: dns protocol: UDP - containerPort: 53 name: dns-tcp protocol: TCP - containerPort: 9153 name: metrics protocol: TCP livenessProbe: httpGet: path: /health port: 8080 scheme: HTTP initialDelaySeconds: 60 timeoutSeconds: 5 successThreshold: 1 failureThreshold: 5 readinessProbe: httpGet: path: /ready port: 8181 scheme: HTTP dnsPolicy: Default volumes: - name: config-volume configMap: name: coredns items: - key: Corefile path: Corefile5. 常见问题排查指南5.1 DNS解析超时问题典型症状间歇性域名解析失败解析延迟超过2秒排查步骤检查CoreDNS Pod资源使用情况kubectl top pods -n kube-system -l k8s-appkube-dns验证CoreDNS端点可用性kubectl get endpoints kube-dns -n kube-system测试ClusterIP连通性KUBE_DNS_IP$(kubectl get svc kube-dns -n kube-system -o jsonpath{.spec.clusterIP}) dig $KUBE_DNS_IP kubernetes.default.svc.cluster.local5.2 NXDOMAIN错误处理当出现域名不存在错误时检查服务是否注册kubectl get svc -A验证DNS记录kubectl exec -it dnsutils -- nslookup service-name检查CoreDNS配置kubectl logs -n kube-system coredns-pod-name6. 性能调优实战6.1 缓存优化配置修改Corefile添加缓存参数.:53 { cache { success 9984 30 denial 9984 5 } }各参数含义success成功响应缓存记录数和TTLdenial否定响应缓存记录数和TTL6.2 负载均衡策略启用DNS轮询负载均衡.:53 { loadbalance round_robin }7. 安全加固措施7.1 DNSSEC配置启用DNSSEC验证.:53 { dnssec { key file /etc/coredns/db.example.org.key } }7.2 访问控制限制DNS查询来源.:53 { acl { allow net 10.0.0.0/8 block } }8. 监控与告警配置8.1 Prometheus监控CoreDNS默认暴露的指标coredns_dns_requests_total请求总数coredns_dns_responses_total响应总数coredns_panics_total崩溃次数推荐告警规则- alert: CoreDNSHighErrorRate expr: rate(coredns_dns_responses_total{rcode!NOERROR,rcode!NXDOMAIN}[1m]) / rate(coredns_dns_responses_total[1m]) 0.03 for: 5m labels: severity: critical annotations: summary: CoreDNS high error rate (instance {{ $labels.instance }}) description: CoreDNS error rate is {{ $value }}9. 版本升级指南升级注意事项先升级CoreDNS配置兼容性采用金丝雀发布策略保留旧版本回滚能力升级命令示例kubectl set image -n kube-system deployment/coredns \ corednsregistry.k8s.io/coredns/coredns:v1.10.110. 网络策略配置限制DNS查询访问apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: allow-dns-access namespace: default spec: podSelector: {} policyTypes: - Egress egress: - to: - namespaceSelector: matchLabels: kubernetes.io/metadata.name: kube-system podSelector: matchLabels: k8s-app: kube-dns ports: - protocol: UDP port: 53 - protocol: TCP port: 53在containerd环境中网络策略需要特别注意必须确保pause容器有足够权限访问DNS服务建议为system:node组添加额外权限