Configurar DNS externo

Esta página orienta você pelo processo de implantação e validação de DNS externo para seus componentes do Kubernetes Operator implantados em vários clusters do Kubernetes sem uma malha de serviço.

Pré-requisitos

Antes de começar, execute as seguintes tarefas:

Instalar kubectl.
Atualize conforme necessário e defina as variáveis de ambiente definidas no arquivo env_variables.sh a seguir.
```
1# This script builds on top of the environment configured in the setup guides.2# It depends (uses) the following env variables defined there to work correctly.3# If you don't use the setup guide to bootstrap the environment, then define them here.4#  ${K8S_CLUSTER_0}5#  ${K8S_CLUSTER_1}6#  ${K8S_CLUSTER_2}7#  ${K8S_CLUSTER_0_ZONE}8#  ${K8S_CLUSTER_1_ZONE}9#  ${K8S_CLUSTER_2_ZONE}10#  ${K8S_CLUSTER_0_CONTEXT_NAME}11#  ${K8S_CLUSTER_1_CONTEXT_NAME}12#  ${K8S_CLUSTER_2_CONTEXT_NAME}13#  ${MDB_GKE_PROJECT}14
15suffix_short="${K8S_CLUSTER_SUFFIX}"16# Ensure suffix_short is no longer than 19 characters to make GKE identifiers fit under 30 characters17if [[ -n "${suffix_short}" && ${#suffix_short} -gt 19 ]]; then18    # Calculate positions for cutting from the middle19    prefix_len=$(((19 - 1) / 2))  # -1 for the 'x' replacement20    suffix_start=$((${#suffix_short} - prefix_len))21    # Create the truncated version with 'x' in the middle22    suffix_short="${suffix_short:0:${prefix_len}}x${suffix_short:${suffix_start}}"23fi24
25export DNS_SA_NAME="ext-dns-sa${suffix_short}"26export DNS_SA_EMAIL="${DNS_SA_NAME}@${MDB_GKE_PROJECT}.iam.gserviceaccount.com"27
28export CUSTOM_DOMAIN="mongodb.custom"29export DNS_ZONE="mongodb${suffix_short}"
```

código fonte

Você pode encontrar todo o código-fonte incluído no repositório do MongoDB Kubernetes Operator.

Procedimento

Crie uma conta de serviço GCP para o InternalDNS.

gcloud iam service-accounts create "${DNS_SA_NAME}" --display-name "${DNS_SA_NAME}"

Adicione a função de administrador DNS à sua conta de serviço GCP.

gcloud projects add-iam-policy-binding "${MDB_GKE_PROJECT}" --member serviceAccount:"${DNS_SA_EMAIL}" --role roles/dns.admin

Criar chave de conta de serviço GCP.

mkdir -p secrets
gcloud iam service-accounts keys create secrets/external-dns-sa-key.json --iam-account="${DNS_SA_EMAIL}"

Crie um namespace Kubernetes para distribuir o InternalDNS.

kubectl --context "${K8S_CLUSTER_0_CONTEXT_NAME}" create ns external-dnskubectl --context "${K8S_CLUSTER_1_CONTEXT_NAME}" create ns external-dnskubectl --context "${K8S_CLUSTER_2_CONTEXT_NAME}" create ns external-dns

Crie um Kubernetes Secret contendo a chave de conta de serviço.

# create secret with service account keykubectl --context "${K8S_CLUSTER_0_CONTEXT_NAME}" -n external-dns create secret generic external-dns-sa-secret --from-file credentials.json=secrets/external-dns-sa-key.jsonkubectl --context "${K8S_CLUSTER_1_CONTEXT_NAME}" -n external-dns create secret generic external-dns-sa-secret --from-file credentials.json=secrets/external-dns-sa-key.jsonkubectl --context "${K8S_CLUSTER_2_CONTEXT_NAME}" -n external-dns create secret generic external-dns-sa-secret --from-file credentials.json=secrets/external-dns-sa-key.json

Instale o externalDNS.

O externalDNS torna os recursos do Kubernetes detectáveis por meio de servidores DNS públicos. Implemente o sistema Kubernetes eternal-dns e os objetos de permissões relacionados ao namespace que você acabou de criar.

kubectl --context "${K8S_CLUSTER_0_CONTEXT_NAME}" -n external-dns apply -f yamls/externaldns.yamlkubectl --context "${K8S_CLUSTER_1_CONTEXT_NAME}" -n external-dns apply -f yamls/externaldns.yamlkubectl --context "${K8S_CLUSTER_2_CONTEXT_NAME}" -n external-dns apply -f yamls/externaldns.yaml

apiVersion: v1kind: ServiceAccountmetadata:  name: external-dns  labels:    app.kubernetes.io/name: external-dns---apiVersion: rbac.authorization.k8s.io/v1kind: ClusterRolemetadata:  name: external-dns  labels:    app.kubernetes.io/name: external-dnsrules:  - apiGroups: [""]    resources: ["services","endpoints","pods","nodes"]    verbs: ["get","watch","list"]  - apiGroups: ["extensions","networking.k8s.io"]    resources: ["ingresses"]    verbs: ["get","watch","list"]---apiVersion: rbac.authorization.k8s.io/v1kind: ClusterRoleBindingmetadata:  name: external-dns-viewer  labels:    app.kubernetes.io/name: external-dnsroleRef:  apiGroup: rbac.authorization.k8s.io  kind: ClusterRole  name: external-dnssubjects:  - kind: ServiceAccount    name: external-dns    namespace: external-dns---apiVersion: apps/v1kind: Deploymentmetadata:  name: external-dns  labels:    app.kubernetes.io/name: external-dnsspec:  strategy:    type: Recreate  selector:    matchLabels:      app.kubernetes.io/name: external-dns  template:    metadata:      labels:        app.kubernetes.io/name: external-dns    spec:      serviceAccountName: external-dns      containers:        - name: external-dns          image: registry.k8s.io/external-dns/external-dns:v0.16.1          args:            - --source=service            - --source=ingress            - --provider=google            - --log-format=json # google cloud logs parses severity of the "text" log format incorrectly            - --interval=10s            - --policy=upsert-only # would prevent ExternalDNS from deleting any records, omit to enable full synchronization            - --registry=txt      #     # uncomment below if static credentials are used          env:             - name: GOOGLE_APPLICATION_CREDENTIALS               value: /etc/secrets/service-account/credentials.json          volumeMounts:             - name: google-service-account               mountPath: /etc/secrets/service-account/      volumes:         - name: google-service-account           secret:             secretName: external-dns-sa-secret

Configure a zona DNS .

Este exemplo inclui uma zona de DNS privado . Isso significa que você só pode acessar os recursos distribuídos na zona DNS a partir dos clusters GKE que criamos. Se você estiver planejando acessar seus recursos de fora dos clusters do GKE, use uma zona de DNS pública. Para fazer isso, você deve ter um domínio registrado.

FQ_CLUSTER_0="projects/${MDB_GKE_PROJECT}/locations/${K8S_CLUSTER_0_ZONE}/clusters/${K8S_CLUSTER_0}"FQ_CLUSTER_1="projects/${MDB_GKE_PROJECT}/locations/${K8S_CLUSTER_1_ZONE}/clusters/${K8S_CLUSTER_1}"FQ_CLUSTER_2="projects/${MDB_GKE_PROJECT}/locations/${K8S_CLUSTER_2_ZONE}/clusters/${K8S_CLUSTER_2}"
gcloud dns managed-zones create "${DNS_ZONE}" \  --description="" \  --dns-name="${CUSTOM_DOMAIN}" \  --visibility="private" \  --gkeclusters="${FQ_CLUSTER_0}","${FQ_CLUSTER_1}","${FQ_CLUSTER_2}"

Voltar

Clusters GKE

Implemente o operador