ExternalDNS自动化DNS管理实践：实现Kubernetes服务自动注册

ExternalDNS自动化DNS管理实践实现Kubernetes服务自动注册一、ExternalDNS概述ExternalDNS是一个Kubernetes控制器能够自动同步Kubernetes资源如Service和Ingress到外部DNS服务商。它消除了手动管理DNS记录的繁琐工作实现了DNS记录的自动化管理。ExternalDNS支持的DNS服务商AWS Route 53Google Cloud DNSAzure DNSCloudflareDigitalOceanCoreDNSInfobloxNS1二、ExternalDNS安装与配置2.1 使用Helm安装# 添加ExternalDNS Helm仓库 helm repo add external-dns https://kubernetes-sigs.github.io/external-dns/ # 创建命名空间 kubectl create namespace external-dns # 安装ExternalDNS以AWS为例 helm install external-dns external-dns/external-dns \ --namespace external-dns \ --version 1.13.0 \ --set provideraws \ --set aws.regionus-west-2 \ --set domainFilters{example.com}2.2 配置RBAC权限apiVersion: v1 kind: ServiceAccount metadata: name: external-dns namespace: external-dns --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: external-dns rules: - apiGroups: [] resources: [services, endpoints, pods] verbs: [get, watch, list] - apiGroups: [extensions, networking.k8s.io] resources: [ingresses] verbs: [get, watch, list] - apiGroups: [] resources: [nodes] verbs: [list, watch] --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: external-dns-viewer roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: external-dns subjects: - kind: ServiceAccount name: external-dns namespace: external-dns2.3 验证安装# 检查ExternalDNS Pod状态 kubectl get pods -n external-dns # 查看日志 kubectl logs -n external-dns deployment/external-dns三、配置DNS Provider3.1 AWS Route 53配置apiVersion: v1 kind: Secret metadata: name: aws-credentials namespace: external-dns data: credentials: | [default] aws_access_key_id YOUR_ACCESS_KEY aws_secret_access_key YOUR_SECRET_KEYhelm install external-dns external-dns/external-dns \ --namespace external-dns \ --set provideraws \ --set aws.regionus-west-2 \ --set aws.secretNameaws-credentials \ --set domainFilters{example.com}3.2 Cloudflare配置apiVersion: v1 kind: Secret metadata: name: cloudflare-api-token namespace: external-dns data: api-token: YOUR_CLOUDFLARE_API_TOKENhelm install external-dns external-dns/external-dns \ --namespace external-dns \ --set providercloudflare \ --set cloudflare.secretNamecloudflare-api-token \ --set domainFilters{example.com}3.3 Google Cloud DNS配置# 创建服务账号密钥文件 gcloud iam service-accounts create external-dns gcloud projects add-iam-policy-binding my-project \ --member serviceAccount:external-dnsmy-project.iam.gserviceaccount.com \ --role roles/dns.admin gcloud iam service-accounts keys create key.json \ --iam-account external-dnsmy-project.iam.gserviceaccount.com # 创建Secret kubectl create secret generic gcp-key \ --namespace external-dns \ --from-filekey.json./key.json # 安装ExternalDNS helm install external-dns external-dns/external-dns \ --namespace external-dns \ --set providergoogle \ --set google.projectmy-project \ --set google.secretNamegcp-key \ --set domainFilters{example.com}四、使用ExternalDNS4.1 Service配置apiVersion: v1 kind: Service metadata: name: my-service annotations: external-dns.alpha.kubernetes.io/hostname: my-service.example.com. external-dns.alpha.kubernetes.io/ttl: 60 spec: type: LoadBalancer selector: app: my-app ports: - port: 80 targetPort: 80804.2 Ingress配置apiVersion: networking.k8s.io/v1 kind: Ingress metadata: name: my-ingress annotations: external-dns.alpha.kubernetes.io/hostname: app.example.com. external-dns.alpha.kubernetes.io/target: my-loadbalancer-123456.us-west-2.elb.amazonaws.com spec: rules: - host: app.example.com http: paths: - path: / pathType: Prefix backend: service: name: my-service port: number: 804.3 多域名配置apiVersion: v1 kind: Service metadata: name: multi-domain-service annotations: external-dns.alpha.kubernetes.io/hostname: | service1.example.com. service2.example.com. service3.example.com. spec: type: LoadBalancer selector: app: my-app ports: - port: 80五、高级配置5.1 同步策略helm install external-dns external-dns/external-dns \ --namespace external-dns \ --set provideraws \ --set policyupsert-only \ --set registrytxt \ --set txtOwnerIdmy-cluster-id支持的策略sync完全同步删除不存在的记录upsert-only只添加/更新记录不删除create-only只创建新记录5.2 过滤配置helm install external-dns external-dns/external-dns \ --namespace external-dns \ --set provideraws \ --set domainFilters{example.com,api.example.com} \ --set excludeDomains{internal.example.com} \ --set annotationFilterexternal-dns\.alpha\.kubernetes\.io/enabledtrue5.3 自定义TTLapiVersion: v1 kind: Service metadata: name: my-service annotations: external-dns.alpha.kubernetes.io/hostname: my-service.example.com. external-dns.alpha.kubernetes.io/ttl: 300 spec: type: LoadBalancer selector: app: my-app六、监控与日志6.1 Prometheus指标apiVersion: v1 kind: Service metadata: name: external-dns-metrics namespace: external-dns spec: selector: app.kubernetes.io/name: external-dns ports: - name: metrics port: 7979 targetPort: metrics6.2 配置ServiceMonitorapiVersion: monitoring.coreos.com/v1 kind: ServiceMonitor metadata: name: external-dns-monitor namespace: monitoring spec: selector: matchLabels: app.kubernetes.io/name: external-dns endpoints: - port: metrics interval: 30s七、最佳实践7.1 权限最小化apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: name: external-dns-limited namespace: external-dns rules: - apiGroups: [] resources: [services, endpoints] verbs: [get, watch, list] - apiGroups: [networking.k8s.io] resources: [ingresses] verbs: [get, watch, list]7.2 多集群场景helm install external-dns external-dns/external-dns \ --namespace external-dns \ --set provideraws \ --set txtOwnerIdcluster-a \ --set domainFilters{cluster-a.example.com}7.3 测试模式helm install external-dns external-dns/external-dns \ --namespace external-dns \ --set provideraws \ --set dryRuntrue八、故障排除8.1 常见问题# 查看详细日志 kubectl logs -n external-dns deployment/external-dns -f # 检查配置错误 kubectl describe deployment external-dns -n external-dns # 验证DNS记录 dig my-service.example.com8.2 调试技巧# 启用详细日志 helm upgrade external-dns external-dns/external-dns \ --namespace external-dns \ --set logLeveldebug # 手动触发同步 kubectl delete pod -n external-dns -l app.kubernetes.io/nameexternal-dns九、总结ExternalDNS为Kubernetes提供了强大的DNS自动化管理能力消除了手动管理DNS记录的繁琐工作。通过本文的实践指南您可以快速部署和配置ExternalDNS实现服务的自动DNS注册。建议根据实际需求选择合适的DNS服务商和配置策略。参考资料ExternalDNS官方文档ExternalDNS GitHubKubernetes Service文档