查看iptables

sudo iptables-save > ./iptables.init.rules

k8s的DNS

1.在每个容器里面，有resolve.conf，指向默认的k8s-dns，但是IP是clusterIP。

resolve.png

[root@192-168-124-65 ~]# kube get svc --all-namespaces -o wide
NAMESPACE     NAME                   CLUSTER-IP      EXTERNAL-IP   PORT(S)          AGE       SELECTOR
default       bbbb-benchmark-tools   10.106.48.150   <nodes>       8080:31268/TCP   1h        app=bbbb-benchmark-tools
default       kubernetes             10.96.0.1       <none>        443/TCP          8d        <none>
kube-system   kube-dns               10.96.0.2       <none>        53/UDP,53/TCP    8d        k8s-app=kube-dns

2.但是只是clusterIP，该IP是虚拟的，完全由iptables重定向

-A KUBE-SERVICES -d 10.96.0.2/32 -p udp -m comment --comment "kube-system/kube-dns:dns cluster IP" -m udp --dport 53 -j KUBE-SVC-TCOU7JCQXEZGVUNU
-A KUBE-SVC-TCOU7JCQXEZGVUNU -m comment --comment "kube-system/kube-dns:dns" -j KUBE-SEP-ZZNQVAV2FG6QK37R
-A KUBE-SEP-ZZNQVAV2FG6QK37R -p udp -m comment --comment "kube-system/kube-dns:dns" -m udp -j DNAT --to-destination 172.28.217.133:53

最终转到k8s-dns的pod

[root@192-168-124-65 ~]# kube get pod --all-namespaces -o wide
NAMESPACE     NAME                                       READY     STATUS    RESTARTS   AGE       IP               NODE
default       bbbb-benchmark-tools-2280011006-m1zh0      1/1       Running   0          1h        172.28.246.4     192-168-124-64
kube-system   calico-kube-controllers-2897584769-wh77q   1/1       Running   0          23h       192.168.124.65   192-168-124-65
kube-system   calico-node-2kp5p                          2/2       Running   2          23h       192.168.124.64   192-168-124-64
kube-system   calico-node-65p73                          2/2       Running   0          23h       192.168.124.65   192-168-124-65
kube-system   kube-dns-2356124473-ft5n9                  3/3       Running   0          23h       172.28.217.133   192-168-124-65
kube-system   kube-dns-2356124473-m1m6d                  3/3       Running   0          23h       172.28.217.132   192-168-124-65
kube-system   kube-proxy-vq8q1                           1/1       Running   18         8d        192.168.124.64   192-168-124-64
kube-system   kube-proxy-w5cv3                           1/1       Running   0          8d        192.168.124.65   192-168-124-65

3.验证，进入容器内部，使用nslookup

nslookup.png