本頁說明如何為 Google Kubernetes Engine (GKE) 標準模式叢集執行 kube-dns 的自訂 Deployment。本頁面不適用於 GKE Autopilot,因為 Google 會管理 kube-dns。
總覽
如要設定 kube-dns CPU、記憶體和其他參數,您必須執行自訂 Deployment,並停用 GKE 提供的 Deployment。您也可以按照本頁的操作說明,執行 Core DNS 或任何其他 DNS 供應商的自訂部署作業,這些供應商都遵循 Kubernetes DNS 規格。
如要進一步瞭解 GKE 如何實作服務探索,請參閱「服務探索和 DNS」。
建立自訂部署作業
為 kube-dns、Core DNS 或其他 DNS 供應商建立 Deployment 資訊清單。
下列 kube-dns 資訊清單範例包含
-q
標記,可記錄查詢結果。將資訊清單儲存為custom-kube-dns.yaml
。apiVersion: apps/v1 kind: Deployment metadata: name: DNS_DEPLOYMENT_NAME namespace: kube-system annotations: deployment.kubernetes.io/revision: "1" k8s-app: kube-dns spec: selector: matchLabels: k8s-app: kube-dns strategy: rollingUpdate: maxSurge: 10% maxUnavailable: 0 type: RollingUpdate template: metadata: creationTimestamp: null labels: k8s-app: kube-dns spec: containers: - name: kubedns image: registry.k8s.io/dns/k8s-dns-kube-dns:1.17.3 resources: limits: memory: '170Mi' requests: cpu: 100m memory: '70Mi' livenessProbe: httpGet: path: /healthcheck/kubedns port: 10054 scheme: HTTP initialDelaySeconds: 60 timeoutSeconds: 5 successThreshold: 1 failureThreshold: 5 readinessProbe: httpGet: path: /readiness port: 8081 scheme: HTTP initialDelaySeconds: 3 timeoutSeconds: 5 args: - --domain=cluster.local. - --dns-port=10053 - --config-dir=/kube-dns-config - --v=2 env: - name: PROMETHEUS_PORT value: "10055" ports: - containerPort: 10053 name: dns-local protocol: UDP - containerPort: 10053 name: dns-tcp-local protocol: TCP - containerPort: 10055 name: metrics protocol: TCP volumeMounts: - name: kube-dns-config mountPath: /kube-dns-config securityContext: allowPrivilegeEscalation: false readOnlyRootFilesystem: true runAsUser: 1001 runAsGroup: 1001 - name: dnsmasq image: registry.k8s.io/dns/k8s-dns-dnsmasq-nanny:1.17.3 livenessProbe: httpGet: path: /healthcheck/dnsmasq port: 10054 scheme: HTTP initialDelaySeconds: 60 timeoutSeconds: 5 successThreshold: 1 failureThreshold: 5 args: - -v=2 - -logtostderr - -configDir=/etc/k8s/dns/dnsmasq-nanny - -restartDnsmasq=true - -- - -k - --cache-size=1000 - --no-negcache - --dns-forward-max=1500 - --log-facility=- - --server=/cluster.local/127.0.0.1#10053 - --server=/in-addr.arpa/127.0.0.1#10053 - --server=/ip6.arpa/127.0.0.1#10053 ports: - containerPort: 53 name: dns protocol: UDP - containerPort: 53 name: dns-tcp protocol: TCP resources: requests: cpu: 150m memory: 20Mi volumeMounts: - name: kube-dns-config mountPath: /etc/k8s/dns/dnsmasq-nanny securityContext: capabilities: drop: - all add: - NET_BIND_SERVICE - SETGID - name: sidecar image: registry.k8s.io/dns/k8s-dns-sidecar:1.17.3 livenessProbe: httpGet: path: /metrics port: 10054 scheme: HTTP initialDelaySeconds: 60 timeoutSeconds: 5 successThreshold: 1 failureThreshold: 5 args: - --v=2 - --logtostderr - --probe=kubedns,127.0.0.1:10053,kubernetes.default.svc.cluster.local,5,SRV - --probe=dnsmasq,127.0.0.1:53,kubernetes.default.svc.cluster.local,5,SRV ports: - containerPort: 10054 name: metrics protocol: TCP resources: requests: memory: 20Mi cpu: 10m securityContext: allowPrivilegeEscalation: false readOnlyRootFilesystem: true runAsUser: 1001 runAsGroup: 1001 dnsPolicy: Default restartPolicy: Always schedulerName: default-scheduler securityContext: {} serviceAccount: kube-dns serviceAccountName: kube-dns terminationGracePeriodSeconds: 30 tolerations: - key: CriticalAddonsOnly operator: Exists volumes: - configMap: defaultMode: 420 name: kube-dns optional: true name: kube-dns-config
將
DNS_DEPLOYMENT_NAME
替換為自訂 kube-dns Deployment 的名稱。將資訊清單套用至叢集:
kubectl create -f custom-kube-dns.yaml
確認 Pod 正在執行:
kubectl get pods -n kube-system -l=k8s-app=kube-dns
輸出內容會與下列內容類似,顯示自訂 kube-dns Pod:
NAME READY STATUS RESTARTS AGE custom-kube-dns-5685645b44-kzs8w 3/3 Running 0 22h
新的 Deployment 與 kube-dns 具有相同的選取器,這表示 Pod 會使用相同的 kube-dns 服務 IP 位址,與執行自訂 kube-dns Deployment 的 Pod 通訊。
完成這個步驟後,請按照下一節的步驟縮減 kube-dns。
縮減 kube-dns
使用下列指令將 kube-dns Deployment 和自動調度器縮放為零,即可停用 GKE 管理的 kube-dns:
kubectl scale deployment --replicas=0 kube-dns-autoscaler --namespace=kube-system
kubectl scale deployment --replicas=0 kube-dns --namespace=kube-system
建立自訂自動調度器
如果自訂 DNS 需要自動調度資源,您必須設定及部署個別的自動調度器。kube-dns-autoscaler 只會調度叢集上的預設 kube-dns Deployment。您也需要為自動配置器設定自訂 ClusterRole,並新增修改自訂 kube-dns 部署作業的權限。
為自動配置器建立 ClusterRole 和 Deployment 資訊清單,並將資訊清單儲存為
custom-dns-autoscaler.yaml
:apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: system:custom-dns-autoscaler roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: system:custom-dns-autoscaler subjects: - kind: ServiceAccount name: kube-dns-autoscaler namespace: kube-system --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: system:custom-dns-autoscaler rules: - apiGroups: - "" resources: - nodes verbs: - list - watch - apiGroups: - apps resourceNames: - DNS_DEPLOYMENT_NAME resources: - deployments/scale verbs: - get - update - apiGroups: - "" resources: - configmaps verbs: - get - create --- apiVersion: apps/v1 kind: Deployment metadata: name: custom-dns-autoscaler namespace: kube-system labels: k8s-app: custom-dns-autoscaler spec: selector: matchLabels: k8s-app: custom-dns-autoscaler template: metadata: labels: k8s-app: custom-dns-autoscaler annotations: seccomp.security.alpha.kubernetes.io/pod: 'docker/default' spec: priorityClassName: system-cluster-critical securityContext: supplementalGroups: [ 65534 ] fsGroup: 65534 nodeSelector: kubernetes.io/os: linux containers: - name: autoscaler image: registry.k8s.io/cluster-proportional-autoscaler-amd64:1.7.1 resources: requests: cpu: "20m" memory: "10Mi" command: - /cluster-proportional-autoscaler - --namespace=kube-system - --configmap=custom-dns-autoscaler - --target=Deployment/DNS_DEPLOYMENT_NAME - --default-params={"linear":{"coresPerReplica":256,"nodesPerReplica":16,"preventSinglePointFailure":true}} - --logtostderr=true - --v=2 tolerations: - key: "CriticalAddonsOnly" operator: "Exists" serviceAccountName: kube-dns-autoscaler
將資訊清單套用至叢集:
kubectl create -f custom-dns-autoscaler.yaml
後續步驟
- 閱讀總覽,瞭解 GKE 如何提供受管理 DNS。
- 如要瞭解 Kubernetes 叢集如何使用 DNS,請參閱「服務和 Pod 的 DNS」。