本页将引导您完成为跨多个没有 服务网格 的Kubernetes集群部署的Kubernetes Operator 组件部署和验证外部 DNS 的进程。
先决条件
开始之前，请执行以下任务：
安装
kubectl。根据需要更新并设立以下
env_variables.sh文件中定义的环境变量。1 # This script builds on top of the environment configured in the setup guides. 2 # It depends (uses) the following env variables defined there to work correctly. 3 # If you don't use the setup guide to bootstrap the environment, then define them here. 4 # ${K8S_CLUSTER_0} 5 # ${K8S_CLUSTER_1} 6 # ${K8S_CLUSTER_2} 7 # ${K8S_CLUSTER_0_ZONE} 8 # ${K8S_CLUSTER_1_ZONE} 9 # ${K8S_CLUSTER_2_ZONE} 10 # ${K8S_CLUSTER_0_CONTEXT_NAME} 11 # ${K8S_CLUSTER_1_CONTEXT_NAME} 12 # ${K8S_CLUSTER_2_CONTEXT_NAME} 13 # ${MDB_GKE_PROJECT} 14 15 export DNS_SA_NAME="external-dns-sa" 16 export DNS_SA_EMAIL="${DNS_SA_NAME}@${MDB_GKE_PROJECT}.iam.gserviceaccount.com" 17 18 export CUSTOM_DOMAIN="mongodb.custom" 19 export DNS_ZONE="mongodb"
源代码
您可以在 MongoDB Kubernetes Operator存储库中找到所有包含的源代码。
步骤
1
2
3
4
5
创建包含服务帐户密钥的Kubernetes密钥。
create secret with service account key kubectl --context "${K8S_CLUSTER_0_CONTEXT_NAME}" -n external-dns create secret generic external-dns-sa-secret --from-file credentials.json=secrets/external-dns-sa-key.json kubectl --context "${K8S_CLUSTER_1_CONTEXT_NAME}" -n external-dns create secret generic external-dns-sa-secret --from-file credentials.json=secrets/external-dns-sa-key.json kubectl --context "${K8S_CLUSTER_2_CONTEXT_NAME}" -n external-dns create secret generic external-dns-sa-secret --from-file credentials.json=secrets/external-dns-sa-key.json
6
安装外部 DNS。
ExternalDNS 使Kubernetes资源可通过公共 DNS 服务器发现。将 eternal-dns Kubernetes部署和相关权限对象部署到刚刚创建的命名空间。
kubectl --context "${K8S_CLUSTER_0_CONTEXT_NAME}" -n external-dns apply -f yamls/externaldns.yaml kubectl --context "${K8S_CLUSTER_1_CONTEXT_NAME}" -n external-dns apply -f yamls/externaldns.yaml kubectl --context "${K8S_CLUSTER_2_CONTEXT_NAME}" -n external-dns apply -f yamls/externaldns.yaml
apiVersion: v1 kind: ServiceAccount metadata: name: external-dns labels: app.kubernetes.io/name: external-dns apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: external-dns labels: app.kubernetes.io/name: external-dns rules: - apiGroups: [""] resources: ["services","endpoints","pods","nodes"] verbs: ["get","watch","list"] - apiGroups: ["extensions","networking.k8s.io"] resources: ["ingresses"] verbs: ["get","watch","list"] apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: external-dns-viewer labels: app.kubernetes.io/name: external-dns roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: external-dns subjects: - kind: ServiceAccount name: external-dns namespace: external-dns apiVersion: apps/v1 kind: Deployment metadata: name: external-dns labels: app.kubernetes.io/name: external-dns spec: strategy: type: Recreate selector: matchLabels: app.kubernetes.io/name: external-dns template: metadata: labels: app.kubernetes.io/name: external-dns spec: serviceAccountName: external-dns containers: - name: external-dns image: registry.k8s.io/external-dns/external-dns:v0.16.1 args: - --source=service - --source=ingress - --provider=google - --log-format=json # google cloud logs parses severity of the "text" log format incorrectly - --interval=10s - --policy=upsert-only # would prevent ExternalDNS from deleting any records, omit to enable full synchronization - --registry=txt # # uncomment below if static credentials are used env: - name: GOOGLE_APPLICATION_CREDENTIALS value: /etc/secrets/service-account/credentials.json volumeMounts: - name: google-service-account mountPath: /etc/secrets/service-account/ volumes: - name: google-service-account secret: secretName: external-dns-sa-secret
7
设置 DNS区域。
此示例包括一个私有 DNS区域。这意味着您只能从我们创建的 GKE 集群访问权限DNS区域中部署的资源。如果您计划从 GKE 集群外部访问权限资源，请使用公共 DNS区域。为此，您必须拥有一个注册域。
FQ_CLUSTER_0="projects/${MDB_GKE_PROJECT}/locations/${K8S_CLUSTER_0_ZONE}/clusters/${K8S_CLUSTER_0}" FQ_CLUSTER_1="projects/${MDB_GKE_PROJECT}/locations/${K8S_CLUSTER_1_ZONE}/clusters/${K8S_CLUSTER_1}" FQ_CLUSTER_2="projects/${MDB_GKE_PROJECT}/locations/${K8S_CLUSTER_2_ZONE}/clusters/${K8S_CLUSTER_2}" gcloud dns managed-zones create "${DNS_ZONE}" \ --description="" \ --dns-name="${CUSTOM_DOMAIN}" \ --visibility="private" \ --gkeclusters="${FQ_CLUSTER_0}","${FQ_CLUSTER_1}","${FQ_CLUSTER_2}"