Solution 2: Changing the CoreDNS Configurations

Prerequisites

The VPC where the CCE cluster is deployed has been connected to the on-premises IDC through a private line (Direct Connect) or other channels. The IDC can access the IP addresses in the VPC CIDR block and CCE cluster container CIDR block. For details about how to create a Direct Connect connection, see Getting Started with Direct Connect.

Procedure

CoreDNS configurations are stored in the ConfigMap named coredns. You can find this ConfigMap in the kube-system namespace. Run the following command to view the default configurations.

kubectl get configmap coredns -n kube-system -oyaml

kind: ConfigMap
apiVersion: v1
metadata:
  name: coredns
  namespace: kube-system
  selfLink: /api/v1/namespaces/kube-system/configmaps/coredns
  uid: d54ed5df-f4a0-48ec-9bc0-3efc1ac76af0
  resourceVersion: '21789515'
  creationTimestamp: '2021-03-02T09:21:55Z'
  labels:
    app: coredns
    k8s-app: coredns
    kubernetes.io/cluster-service: 'true'
    kubernetes.io/name: CoreDNS
    release: cceaddon-coredns
data:
  Corefile: |-
    .:5353 {
        bind {$POD_IP}
        cache 30
        errors
        health {$POD_IP}:8080
        kubernetes cluster.local in-addr.arpa ip6.arpa {
          pods insecure
          upstream /etc/resolv.conf
          fallthrough in-addr.arpa ip6.arpa
        }
        loadbalance round_robin
        prometheus {$POD_IP}:9153
        forward . /etc/resolv.conf
        reload
    }

The preceding example shows that all CoreDNS configurations are defined in Corefile. By default, resolution requests of any domain name that does not belong to the Kubernetes cluster are directed to the DNS server specified by forward. In forward . /etc/resolv.conf, the first period (.) indicates all domain names, and /etc/resolv.conf. indicates the DNS server of the node.

If a specific external domain name needs to be resolved, you can add an extra configuration item. For example, if you want to forward the requests of resolving the domain name content.internal to the DNS server whose IP address is 10.0.0.190, perform the following operations to add configurations in Corefile.

1. Log in to the CCE console and click the cluster name to access the cluster console.
2. In the navigation pane, choose Add-ons. On the displayed page, click Edit under CoreDNS.
3. Add a stub domain in the Parameters area. A stub domain is a key-value pair. The key is a DNS suffix domain name, and the value is a DNS IP address or a group of DNS IP addresses. In this example, set the key-value pair to content.internal --10.0.0.190.

   

4. Click OK.
5. Choose ConfigMaps and Secrets in the navigation pane. In the kube-system namespace, view the coredns configuration data to check whether the update is successful.

   

   Corresponding Corefile content:

   .:5353 {
       bind {$POD_IP}
       cache 30
       errors
       health {$POD_IP}:8080
       kubernetes cluster.local in-addr.arpa ip6.arpa {
           pods insecure
           fallthrough in-addr.arpa ip6.arpa
       }
       loadbalance round_robin
       prometheus {$POD_IP}:9153
       forward . /etc/resolv.conf {
           policy random
       }
       reload
       ready {$POD_IP}:8081
   }
   content.internal:5353 {
       bind {$POD_IP}
       errors
       cache 30
       forward . 10.0.0.190
   }

   For details about other CoreDNS configurations, see Customizing DNS Service.

Verification

Create a pod to access the IDC domain name. The following output shows that the domain name can be resolved.

web-terminal-568c6566df-c9jhl:~# kubectl run -i --tty --image tutum/dnsutils dnsutils --restart=Never --rm /bin/sh 
If you don't see a command prompt, try pressing enter.
# ping www.content.internal
PING www.content.internal (10.0.1.80) 56(84) bytes of data.
64 bytes from 10.0.1.80: icmp_seq=1 ttl=64 time=1.08 ms
64 bytes from 10.0.1.80: icmp_seq=2 ttl=64 time=0.337 ms

Access a Huawei Cloud domain name. The following output shows that the domain name can be resolved.

# ping cce.ap-southeast-1.myhuaweicloud.com
PING cce.ap-southeast-1.myhuaweicloud.com (100.125.4.16) 56(84) bytes of data.

Access the IDC domain name on the cluster node. The domain name cannot be pinged, indicating that the CoreDNS configurations do not affect the domain name resolution of the node.