Indlela yokuhlukanisa i-DNS phakathi kwe-Kubernetes ne-OpenVPN sidecar

Ama-pod asebenza OpenVPN sidecar ehluleka ekuxazululeni amagama ngendlela ebonakalayo: amagama e-cluster ayaxhaxha, amagama akude aphendula kuze kuqale kabusha ipod, futhi ifayela le-resolver olilihlele libuyela emuva. Akukho okukulezi zinto okuwukwehluleka kwe-tunnel. Ipod inefayela elilodwa le-resolver nemikhakha emibili yamagama, futhi ifayela lingabala amaseva ngokulandelana kodwa alikwazi ukuchaza izifunda. Isixazululo esihlala njalo i-resolver esebenza ngaphakathi kwepod futhi ephethe ukuhlukaniswa, ngakho ifayela lihlala lilula futhi awukho umgomo onesizathu sokulibhala kabusha.

Kungani ushintsho olwenzile lulahleka njalo

Ifayela ngelika-kubelet, hhayi lakho. Ngaphansi kwe-dnsPolicy: ClusterFirst, i-kubelet ilakha ukuze likhombe ku-DNS ye-cluster, futhi ilakha kabusha njalo lapho i-container iqala. Konke okushintshayo nge-kubectl exec kuhlala kusendlalelo le-container elibhalekayo, ngakho ukuqala kabusha, ukuxoshwa noma i-rollout kukulahla. Incazelo yepod isahamba nawo lowo mgomo, yingakho lifayela elifanayo libuya.

Ukusetha i-dnsPolicy: None kumisa ukwakhiwa kabusha futhi kususa nokuxazululwa kwe-cluster. Uthola ifayela olilawulayo futhi ulahlekelwa amagama owawadinga. Lokhu kushintshana yiyo yonke inkinga: i-resolv.conf ayinalo umqondo wezifunda, inamaseva azanywayo ngokulandelana kuphela, ngakho ayikwazi ukuthumela i-cluster.local ekhelini elilodwa kanye nesifunda esiyimfihlo kwelinye.

Sebenzisa i-resolver eyodwa epodini, ku-loopback

Qondisa ipod kuseva yegama eyodwa ku-loopback, bese uvumela i-container ye-CoreDNS ehlanganyela isikhala samagama senethiwekhi yepod ukuthi iphendule ku-port 53. Setha umgomo ku-None, nika ipod lelo kheli lilodwa, futhi wengeze i-container ye-DNS eduze kwe-VPN kanye nohlelo lokusebenza:

spec:
  dnsPolicy: None
  dnsConfig:
    nameservers:
      - 127.0.0.1
    options:
      - name: ndots
        value: "5"
  containers:
    - name: dns
      image: coredns/coredns
      args: ["-conf", "/etc/coredns/Corefile"]
      volumeMounts:
        - {name: corefile, mountPath: /etc/coredns, readOnly: true}
    - name: vpn
      image: your-openvpn-client-image
    - name: app
      image: your-app-image
  volumes:
    - name: corefile
      configMap:
        name: split-dns-corefile

Zontathu iziqukathi zihlanganyela isikhala samagama senethiwekhi esisodwa, ngakho i-127.0.0.1:53 isuka ku-container yohlelo lokusebenza ifinyelela i-CoreDNS ngaphandle kwesevisi, ngaphandle kwe-port-forward nangaphandle kokuzungeza inethiwekhi ye-cluster. Ukufaka i-Corefile kusuka ku-ConfigMap kuyigcina iwukufaka okunenguqulo esikhundleni sefayela elihlelwa endaweni. I-resolv.conf ekhiqiziwe ibe isiqukethe iseva yegama eyodwa futhi akukho okunye, isimo ongacabanga ngaso.

Imininingwane emibili iyaluma lapha. Isithombe esisemthethweni sibopha i-port 53 njenge-root, futhi ezinye izinqubomgomo ze-cluster zidinga ukuthi ukubhale lokho ngokucacile. Zonke iziqukathi zepod manje zincike ekusebenzeni kwale container eyodwa, ngakho engeza i-readiness probe egameni elingenabungozi futhi uvumele uhlelo lokusebenza ukuthi lubekezelele ukwehluleka kokuqala.

Nikeza isifunda ngasinye esiyimfihlo i-upstream yaso

I-Corefile iwuhlu lwezifunda, ngasinye sisho iseva engasiphendula. Ibhlokhi elilodwa lihlanganisa isifunda se-tunnel, futhi ibhlokhi elibamba konke liza ekugcineni futhi lithatha konke okungafunwanga yibhlokhi elicacile. Ibhlokhi elibamba konke kufanele likhombe ku-upstream yangempela, hhayi ukubuyela epodini: i-.:53 { forward . 10.100.0.10 } iphinda isebenzise i-resolver ye-cluster ngoba isivele idlulisa amagama omphakathi kuma-resolver e-node ngokwayo. Akukho okunye epodini okudinga ukwazi ukuthi igama lingelenethiwekhi iphi.

.:53 {
  errors
  cache 30
  forward . 10.100.0.10
}

svc.acme.internal:53 {
  errors
  cache 30
  forward . 192.168.240.1
}

Funda ikheli le-cluster kusevisi ye-kube-dns kwi-kube-system esikhundleni sokukopisha kwelinye i-athikili, ngoba ama-CIDR esevisi ayahluka. Ikheli le-tunnel livela kunani le-dhcp-option DNS elithunyelwa iseva ye-OpenVPN, noma kuseva egunyaziwe yaleso sifunda. Uma i-resolver yakho ye-cluster ingaphenduli kumagama omphakathi, faka ikheli le-resolver ye-node kubhlokhi elibamba konke, lifundwe ku-node hhayi ngaphakathi kwepod.

Ungaqondisi ibhlokhi elibamba konke ku-/etc/resolv.conf, okuwumugqa owodwa ohehayo kanye nogibe kulesi sakhiwo esiqondile. Ngaphansi kwe-dnsPolicy: None, ifayela lepod ngokwalo liqukethe iseva yegama eyodwa 127.0.0.1, ngakho leyo nhloso iyi-CoreDNS ngokwayo futhi zonke izicelo ezingafani ziphindwa kuze kuphele isikhathi. Ibhlokhi ebizwa nge-svc.acme.internal ihambisana nalelo gama nawo wonke amagama ngaphansi kwalo, okuhlanganisa i-db.svc.acme.internal futhi kukhiphe i-svc.acme.internal.example.net. Iphuzu lokugcina lingokokubukeka, ngoba amagama ezifunda alungiswa abe yisimo esigcwele; umkhawulo wesijobelelo unquma ukuthi isicelo sihla kuphi.

Nquma ukuthi ukudlulisela kungokwe-resolver ye-cluster yini

Uma wonke umthwalo womsebenzi esikhaleni samagama udinga isifunda se-tunnel, ibhlokhi yokudlulisela ku-ConfigMap ye-CoreDNS ngaphansi kwe-kube-system ishibhile kune-sidecar yepod ngayinye. Lolo shintsho lusezingeni le-cluster: ludinga amalungelo omlawuli nokuqalisa kabusha ukusetshenziswa okuncike kukho wonke umuntu. Kukhawulele kuleso sifunda esisodwa, hhayi empandeni. Ikheli le-tunnel lomthwalo oyedwa liba i-resolver yepod ngayinye yaleso sifunda, futhi ngosuku lokuwa kwe-tunnel lonke i-cluster lilahlekelwa igama.

I-sidecar igcina indawo yokuqhuma ngaphakathi kwepod eyodwa, okuyisimo esingcono sokuzenzakalela lapho izinsizakalo ezimbalwa kuphela zidinga inethiwekhi ekude. Noma yini oyikhethayo, bhala ukuthi iyiphi i-resolver ephethe isifunda, ngoba umuntu olandelayo oxazulula i-timeout uzobuza.

Amagama axazululwayo ngenkathi ukuxhumana kusahluleka

Ukuxazulula kungenye yezinto ezimbili okufanele i-tunnel izithwale; enye indledlana yokubuyela emuva, futhi inethiwekhi yepod iyifihla kahle. Uma iseva ye-OpenVPN ngokwayo isebenza njengepod, imithetho oyengezayo kulelo qukathi ayilawuli ithrafikhi ephuma nge-node. Lokho kwehluleka kuncane: ama-pod ase-node eyayisebenzisa ne-seva kuphela athola izimpendulo, konke okunye kwaphelelwa isikhathi.

Ukusebenzisa iseva nge-hostNetwork: true kuyibuyisela esikhaleni samagama se-node, lapho umthetho we-FORWARD nokuhunyushwa komthombo kusebenza khona. Humusha ichibi lamakhasimende ekuphumeni, ngaphandle kwalokho alikho i-node ekude elinendlela yokubuyela ekhelini le-tunnel elifana ne-10.8.0.6. Hlola izinhlangothi zombili ngaphambi kokuthinta i-Corefile futhi. I-tunnel ethwala umbuzo kodwa hhayi impendulo ikhiqiza isikhathi esiphelele esifanayo njenge-resolver engakaze iluthole umbuzo.

Qinisekisa kusuka epodini entsha, hhayi kuseshini oyilungisile

Buza zombili izifunda ngokucacile, bese uphinda umbuzo ngemva kokuba ipod ishintshiwe. Isakhiwo esikhona kuphela ku-container esebenzayo akusiso isakhiwo:

kubectl exec -it deploy/app -- dig @127.0.0.1 kubernetes.default.svc.cluster.local +short
kubectl exec -it deploy/app -- dig @127.0.0.1 db.svc.acme.internal +short
kubectl delete pod -l app=your-app
kubectl wait --for=condition=Ready pod -l app=your-app --timeout=90s
kubectl exec -it deploy/app -- dig @127.0.0.1 db.svc.acme.internal +short

Uma ipheya lokuqala liphendula futhi ipheya ngemva kokushintshwa lingaphenduli, i-Corefile ilungile futhi incazelo yepod ayilungile. Uma zombili ziphendula kodwa uhlelo lokusebenza lusahluleka ukuxhuma, misa ukuxazulula i-DNS bese uhlola indlela ye-TCP nge-nc -vz db.svc.acme.internal 5432 ngaphakathi kwe-container. Gcina umphumela we-dig kuthikithi, ngoba iwubufakazi obuhlukanisa inkinga yegama nenkinga yomzila.