Prerequisites

The VPC where the CCE cluster is deployed has been connected to the on-premises IDC through a private line (Direct Connect) or other channels. The IDC can access the IP addresses in the VPC CIDR block and CCE cluster container CIDR block. For details about how to create a Direct Connect connection, see Getting Started with Direct Connect.

Procedure

CoreDNS configurations are stored in the ConfigMap named coredns. You can find this ConfigMap in the kube-system namespace. Run the following command to view the default configurations.

kubectl get configmap coredns -n kube-system -oyaml

kind: ConfigMap
apiVersion: v1
metadata:
  name: coredns
  namespace: kube-system
  selfLink: /api/v1/namespaces/kube-system/configmaps/coredns
  uid: d54ed5df-f4a0-48ec-9bc0-3efc1ac76af0
  resourceVersion: '21789515'
  creationTimestamp: '2021-03-02T09:21:55Z'
  labels:
    app: coredns
    k8s-app: coredns
    kubernetes.io/cluster-service: 'true'
    kubernetes.io/name: CoreDNS
    release: cceaddon-coredns
data:
  Corefile: |-
    .:5353 {
        bind {$POD_IP}
        cache 30
        errors
        health {$POD_IP}:8080
        kubernetes cluster.local in-addr.arpa ip6.arpa {
          pods insecure
          upstream /etc/resolv.conf
          fallthrough in-addr.arpa ip6.arpa
        }
        loadbalance round_robin
        prometheus {$POD_IP}:9153
        forward . /etc/resolv.conf
        reload
    }

The preceding example shows that all CoreDNS configurations are defined in Corefile. By default, resolution requests of any domain name that does not belong to the Kubernetes cluster are directed to the DNS server specified by forward. In forward . /etc/resolv.conf, the first period (.) indicates all domain names, and /etc/resolv.conf. indicates the DNS server of the node.

If a specific external domain name needs to be resolved, you can add an extra configuration item. For example, if you want to forward the requests of resolving the domain name content.internal to the DNS server whose IP address is 10.0.0.190, run the following command to add configurations in Corefile.

kubectl edit configmap coredns -n kube-system

apiVersion: v1
data:
  Corefile: |-
    .:5353 {
        bind {$POD_IP}
        cache 30
        errors
        health {$POD_IP}:8080
        kubernetes cluster.local in-addr.arpa ip6.arpa {
          pods insecure
          upstream /etc/resolv.conf
          fallthrough in-addr.arpa ip6.arpa
        }
        loadbalance round_robin
        prometheus {$POD_IP}:9153
        forward . /etc/resolv.conf
        reload
    }
    content.internal:5353 {
        bind {$POD_IP}
        errors
        cache 30
        forward . 10.0.0.190
    }

For details about other CoreDNS configurations, see Customizing DNS Service.

You can also add configurations on the CCE console, as shown in Figure 1.

Figure 1 Changing CoreDNS configurations on the console

Verification

Create a pod to access the IDC domain name. The following output shows that the domain name can be resolved.

web-terminal-568c6566df-c9jhl:~# kubectl run -i --tty --image tutum/dnsutils dnsutils --restart=Never --rm /bin/sh 
If you don't see a command prompt, try pressing enter.
# ping www.content.internal
PING www.content.internal (10.0.1.80) 56(84) bytes of data.
64 bytes from 10.0.1.80: icmp_seq=1 ttl=64 time=1.08 ms
64 bytes from 10.0.1.80: icmp_seq=2 ttl=64 time=0.337 ms

Access a HUAWEI CLOUD domain name. The following output shows that the domain name can be resolved.

# ping cce.cn-east-3.myhuaweicloud.com
PING cce.cn-east-3.myhuaweicloud.com (100.125.4.16) 56(84) bytes of data.

Access the IDC domain name on the cluster node. The domain name cannot be pinged, indicating that the CoreDNS configurations do not affect the domain name resolution of the node.