一、背景

客户程序里调用服务目标地址是公司系统域名，迁移到k8s集群后不想修改代码，就能适配集群工作负载间k8s域名访问。

二、解决方案简介

在coreDNS的configmap文件中添加rewrite规则，将访问集群外部域名的请求重写为集群内部域名

三、操作步骤

3.1 配置多个域名跳转

这里使用两个不用的子域名进行测试验证，单域名只需要配置一个域名即可
demo-app1.lixiangbudao.com
demo-app2.smartboy.com

3.1.1 准备测试的工作负载和service

• 客户端 pod：tomcat-app，用于从容器里访问服务端域名

# kubectl get pod |grep tomcat-app
tomcat-app-66964dd8c9-ml6ff   1/1     Running   0          12m

• 服务端pod：demo-app1/demoapp2和 service，镜像为nginx，同时设置pod的启动后命令使demo-app1和demo-app2为不同的html文件

# kubectl get pod | grep demo-app
demo-app1-849478747-x85sr     1/1     Running   0          20m 
demo-app2-8755d44cc-rhrvb     1/1     Running   0          20m 

# kubectl get svc | grep demo-app 
demo-app1    ClusterIP   10.247.98.133    <none>        80/TCP     21m 
demo-app2    ClusterIP   10.247.206.242   <none>        80/TCP     20m 

# kubectl get pod demo-app1-5757d87bdf-jzr9d -oyaml | grep -A6 postStart: 
      postStart: 
        exec: 
          command: 
          - /bin/sh 
          - -c 
          - 'echo ''Hello MyApp | Version: v1 | <a href="hostname.html">Pod Name</a>'' 
            > /usr/share/nginx/html/index.html' 

# kubectl get pod demo-app2-6b64d76c76-9clt8 -oyaml | grep -A6 postStart: 
      postStart: 
        exec: 
          command: 
          - /bin/sh 
          - -c 
          - 'echo ''Hello MyApp | Version: v2 | <a href="hostname.html">Pod Name</a>'' 
            > /usr/share/nginx/html/index.html'

• 访问服务的pod查看效果

 # curl 10.247.98.133:80 
Hello MyApp | Version: v1 | <a href="hostname.html">Pod Name</a> 
# curl 10.247.206.242:80 
Hello MyApp | Version: v2 | <a href="hostname.html">Pod Name</a>

3.1.2 修改core DNS的configmap添加rewrite规则

# kubectl edit cm coredns -n kube-system

apiVersion: v1
kind: ConfigMap
metadata:
  labels:
    app: coredns
    k8s-app: coredns
    kubernetes.io/cluster-service: "true"
    kubernetes.io/name: CoreDNS
    release: cceaddon-coredns
  name: coredns
  namespace: kube-system
data:
  Corefile: |-
    .:5353 {
        bind {$POD_IP}
        cache 30 {
            servfail 5s
        }
        errors
        health {$POD_IP}:8080
        kubernetes cluster.local in-addr.arpa ip6.arpa {
            pods insecure
            fallthrough in-addr.arpa ip6.arpa
        }
        rewrite continue {
            # name regex ：通过正则表达式匹配请求中的查询名称是子域名lixiangbudao.com的域名，然后重写为{1}.test1.svc.cluster.local，{1}表示子域名前缀，即正则表达式(.*)匹配到的子域名前缀
            name regex (.*)\.lixiangbudao\.com.$ {1}.default.svc.cluster.local
            # answer name：响应中的查询名称将根据from regex模式进行重写，即在响应结果根据DNS查询进行回答，将(.*)\.test1\.svc\.cluster\.local\.$重写为{1}.lixiangbudao.com
            answer name (.*)\.default\.svc\.cluster\.local.$ {1}.lixiangbudao.com
        }
        rewrite continue {
            name regex (.*)\.smartboy\.com.$ {1}.default.svc.cluster.local
            answer name (.*)\.default\.svc\.cluster\.local.$ {1}.smartboy.com
        }
        # 将下面匹配到域名规则设为最后一条跳转规则，后继匹配到的转发规则停止继续转发
        rewrite stop {
            ttl regex(.*)\.lixiangbudao\.com.$ 3
        }
        rewrite stop {
            ttl regex(.*)\.smartboy\.com.$ 3
        }
        loadbalance round_robin 
        prometheus {$POD_IP}:9153
        forward . /etc/resolv.conf {
            policy random
        }
        reload
        ready {$POD_IP}:8081
    }

四、验证

4.1 验证从容器里访问域名

# kubectl exec -it tomcat-app-66964dd8c9-ml6ff -- /bin/bash

root@tomcat-app-66964dd8c9-ml6ff:/usr/local/tomcat# cat /etc/resolv.conf
search default.svc.cluster.local svc.cluster.local cluster.local openstacklocal
nameserver 10.247.3.10
options ndots:5 single-request-reopen timeout:2

root@tomcat-app-66964dd8c9-ml6ff:/usr/local/tomcat# curl demo-app1.lixiangbudao.com
Hello MyApp | Version: v1 | <a href="hostname.html">Pod Name</a>

root@tomcat-app-66964dd8c9-ml6ff:/usr/local/tomcat# curl demo-app2.smartboy.com
Hello MyApp | Version: v2 | <a href="hostname.html">Pod Name</a>
root@tomcat-app-66964dd8c9-ml6ff:/usr/local/tomcat#

4.2 验证从节点访问域名

步骤1 编辑节点的/etc/resolv.conf 文件，添加coredns的ClusterIP

# kubectl -n kube-system get svc -l app=coredns 
NAME      TYPE        CLUSTER-IP    EXTERNAL-IP   PORT(S)                  AGE 
coredns   ClusterIP   10.247.3.10   <none>        53/UDP,53/TCP,8080/TCP   25d 

# cat /etc/resolv.conf
# Generated by NetworkManager
search openstacklocal
nameserver 10.247.3.10
nameserver 100.79.1.240
nameserver 100.79.1.250
options timeout:1 single-request-reopen

步骤2 节点测试访问服务

# curl demo-app1.lixiangbudao.com
Hello MyApp | Version: v1 | <a href="hostname.html">Pod Name</a> 

# curl demo-app2.lixiangbudao.com
Hello MyApp | Version: v2 | <a href="hostname.html">Pod Name</a>