配置外部 DNS

本页将引导您完成在没有服务网格的情况下为跨多个Kubernetes集群部署的Kubernetes Operator 组件部署和验证外部 DNS 的进程。

先决条件

开始之前，请执行以下任务：

安装 kubectl。
根据需要更新并设立以下 env_variables.sh文件中定义的环境变量。
```
1# This script builds on top of the environment configured in the setup guides.2# It depends (uses) the following env variables defined there to work correctly.3# If you don't use the setup guide to bootstrap the environment, then define them here.4#  ${K8S_CLUSTER_0}5#  ${K8S_CLUSTER_1}6#  ${K8S_CLUSTER_2}7#  ${K8S_CLUSTER_0_ZONE}8#  ${K8S_CLUSTER_1_ZONE}9#  ${K8S_CLUSTER_2_ZONE}10#  ${K8S_CLUSTER_0_CONTEXT_NAME}11#  ${K8S_CLUSTER_1_CONTEXT_NAME}12#  ${K8S_CLUSTER_2_CONTEXT_NAME}13#  ${MDB_GKE_PROJECT}14
15export DNS_SA_NAME="ext-dns-sa${K8S_CLUSTER_SUFFIX:-}"16export DNS_SA_EMAIL="${DNS_SA_NAME}@${MDB_GKE_PROJECT}.iam.gserviceaccount.com"17
18export CUSTOM_DOMAIN="mongodb.custom"19export DNS_ZONE="mongodb${K8S_CLUSTER_SUFFIX:-}"
```

源代码

您可以在MongoDB Kubernetes Operator存储库中找到所有包含的源代码。

步骤

为外部 DNS 创建GCP服务帐户。

gcloud iam service-accounts create "${DNS_SA_NAME}" --display-name "${DNS_SA_NAME}"

将 DNS 管理员角色添加到您的GCP服务帐户。

gcloud projects add-iam-policy-binding "${MDB_GKE_PROJECT}" --member serviceAccount:"${DNS_SA_EMAIL}" --role roles/dns.admin

创建GCP服务帐户密钥。

mkdir -p secrets
gcloud iam service-accounts keys create secrets/external-dns-sa-key.json --iam-account="${DNS_SA_EMAIL}"

创建用于部署外部 DNS 的Kubernetes命名空间。

kubectl --context "${K8S_CLUSTER_0_CONTEXT_NAME}" create ns external-dnskubectl --context "${K8S_CLUSTER_1_CONTEXT_NAME}" create ns external-dnskubectl --context "${K8S_CLUSTER_2_CONTEXT_NAME}" create ns external-dns

创建包含服务帐户密钥的Kubernetes密钥。

# create secret with service account keykubectl --context "${K8S_CLUSTER_0_CONTEXT_NAME}" -n external-dns create secret generic external-dns-sa-secret --from-file credentials.json=secrets/external-dns-sa-key.jsonkubectl --context "${K8S_CLUSTER_1_CONTEXT_NAME}" -n external-dns create secret generic external-dns-sa-secret --from-file credentials.json=secrets/external-dns-sa-key.jsonkubectl --context "${K8S_CLUSTER_2_CONTEXT_NAME}" -n external-dns create secret generic external-dns-sa-secret --from-file credentials.json=secrets/external-dns-sa-key.json

安装外部 DNS。

ExternalDNS 使Kubernetes资源可通过公共 DNS 服务器发现。将 eternal-dns Kubernetes部署和相关权限对象部署到刚刚创建的命名空间。

# Render the manifest once so ${DNS_ZONE}/${CUSTOM_DOMAIN} are substituted.rendered_manifest=$(eval "cat <<EOF$(cat yamls/externaldns.yaml)EOF")
echo "${rendered_manifest}" | kubectl --context "${K8S_CLUSTER_0_CONTEXT_NAME}" -n external-dns apply -f -echo "${rendered_manifest}" | kubectl --context "${K8S_CLUSTER_1_CONTEXT_NAME}" -n external-dns apply -f -echo "${rendered_manifest}" | kubectl --context "${K8S_CLUSTER_2_CONTEXT_NAME}" -n external-dns apply -f -

apiVersion: v1kind: ServiceAccountmetadata:  name: external-dns  labels:    app.kubernetes.io/name: external-dns---apiVersion: rbac.authorization.k8s.io/v1kind: ClusterRolemetadata:  name: external-dns  labels:    app.kubernetes.io/name: external-dnsrules:  - apiGroups: [""]    resources: ["services","endpoints","pods","nodes"]    verbs: ["get","watch","list"]  - apiGroups: ["extensions","networking.k8s.io"]    resources: ["ingresses"]    verbs: ["get","watch","list"]---apiVersion: rbac.authorization.k8s.io/v1kind: ClusterRoleBindingmetadata:  name: external-dns-viewer  labels:    app.kubernetes.io/name: external-dnsroleRef:  apiGroup: rbac.authorization.k8s.io  kind: ClusterRole  name: external-dnssubjects:  - kind: ServiceAccount    name: external-dns    namespace: external-dns---apiVersion: apps/v1kind: Deploymentmetadata:  name: external-dns  labels:    app.kubernetes.io/name: external-dnsspec:  strategy:    type: Recreate  selector:    matchLabels:      app.kubernetes.io/name: external-dns  template:    metadata:      labels:        app.kubernetes.io/name: external-dns    spec:      serviceAccountName: external-dns      containers:        - name: external-dns          image: registry.k8s.io/external-dns/external-dns:v0.16.1          args:            - --source=service            - --source=ingress            - --provider=google            - --google-zone-visibility=private            - --zone-id-filter=${DNS_ZONE}            - --domain-filter=${CUSTOM_DOMAIN}            - --log-format=json # google cloud logs parses severity of the "text" log format incorrectly            - --interval=10s            - --policy=upsert-only # would prevent ExternalDNS from deleting any records, omit to enable full synchronization            - --registry=txt      #     # uncomment below if static credentials are used          env:             - name: GOOGLE_APPLICATION_CREDENTIALS               value: /etc/secrets/service-account/credentials.json          volumeMounts:             - name: google-service-account               mountPath: /etc/secrets/service-account/      volumes:         - name: google-service-account           secret:             secretName: external-dns-sa-secret

设置 DNS区域。

此示例包括一个私有 DNS区域。这意味着您只能从我们创建的 GKE 集群访问权限DNS区域中部署的资源。如果您计划从 GKE 集群外部访问权限资源，请使用公共 DNS区域。为此，您必须拥有一个注册域。

FQ_CLUSTER_0="projects/${MDB_GKE_PROJECT}/locations/${K8S_CLUSTER_0_ZONE}/clusters/${K8S_CLUSTER_0}"FQ_CLUSTER_1="projects/${MDB_GKE_PROJECT}/locations/${K8S_CLUSTER_1_ZONE}/clusters/${K8S_CLUSTER_1}"FQ_CLUSTER_2="projects/${MDB_GKE_PROJECT}/locations/${K8S_CLUSTER_2_ZONE}/clusters/${K8S_CLUSTER_2}"
gcloud dns managed-zones create "${DNS_ZONE}" \  --description="" \  --dns-name="${CUSTOM_DOMAIN}" \  --visibility="private" \  --gkeclusters="${FQ_CLUSTER_0}","${FQ_CLUSTER_1}","${FQ_CLUSTER_2}"