自建DNS服务(k8s学习二)
记录本次学习k8s搭建集群的经过
安装Bind
dns0-50 被我预留为做DNS服务的机器, 所以只在这台安装bind
Bind(Berkeley Internet Name Domain Service)，它是一款实现DNS服务器的开放源码软件,够提供双向解析，转发，子域授权，view等功能,是世界上使用最为广泛的DNS服务器软件，目前Internet上半数以上的DNS服务器有都是用Bind来架设的。
yum install -y bind
查看版本:
[root@dns0-50 ~]# named -v
BIND 9.11.20-RedHat-9.11.20-5.el8 (Extended Support Version) <id:f3d1d66>安装常用工具
yum install -y wget
yum install -y net-tools
yum install -y telnet
yum install -y tree
yum install -y nmap
yum install -y sysstat
yum install -y lrzsz
yum install -y dos2unix
yum install -y bind-utils
yum install -y vim
yum install -y less
配置Bind
[root@dns0-50 ~]# vim /etc/named.conf修改配置:
options {
listen-on port 53 { 192.168.0.50; }; #修改
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
secroots-file "/var/named/data/named.secroots";
recursing-file "/var/named/data/named.recursing";
allow-query { any; }; #修改
forwarders { 192.168.0.1; }; #新增
/*
- If you are building an AUTHORITATIVE DNS server, do NOT enable recursion.
- If you are building a RECURSIVE (caching) DNS server, you need to enable
recursion.
- If your recursive DNS server has a public IP address, you MUST enable access
control to limit queries to your legitimate users. Failing to do so will
cause your server to become part of large scale DNS amplification
attacks. Implementing BCP38 within your network would greatly
reduce such attack surface
*/
recursion yes;
dnssec-enable no; #修改
dnssec-validation no; #修改
managed-keys-directory "/var/named/dynamic";
pid-file "/run/named/named.pid";
session-keyfile "/run/named/session.key";
/* https://fedoraproject.org/wiki/Changes/CryptoPolicy */
include "/etc/crypto-policies/back-ends/bind.config";
};
logging {
channel default_debug {
file "data/named.run";
severity dynamic;
};
};
zone "." IN {
type hint;
file "named.ca";
};
include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";检查配置是否正确, 无报错即为正确:
named-checkconf增加DNS配置
vim /etc/named.rfc1912.zones
# 添加以下内容
zone "host.com" IN {
type master;
file "host.com.zone";
allow-update { 192.168.0.50; };
};
zone "gy.com" IN {
type master;
file "gy.com.zone";
allow-update { 192.168.0.50; };
};修改 /var/named/host.com.zone
$ORIGIN host.com.
$TTL 600 ; 10 minutes # 过期时间十分钟 这里的分号是注释
@ IN SOA dns.host.com. dnsadmin.host.com. (
2021022101 ; serial
10800 ; refresh (3 hours) # soa参数
900 ; retry (15 minutes)
604800 ; expire (1 week)
86400 ; minimum (1 day)
)
NS dns.host.com.
$TTL 60 ; 1 minute
dns A 192.168.0.50
sh0-20 A 192.168.0.20
sh0-21 A 192.168.0.21
sh0-30 A 192.168.0.30
sh0-31 A 192.168.0.31修改 /var/named/gy.com.zone
$ORIGIN gy.com.
$TTL 600 ; 10 minutes
@ IN SOA dns.gy.com. dnsadmin.gy.com. (
2021022101 ; serial
10800 ; refresh (3 hours)
900 ; retry (15 minutes)
604800 ; expire (1 week)
86400 ; minimum (1 day)
)
NS dns.gy.com.
$TTL 60 ; 1 minute
dns A 192.168.0.50检查配置 named-checkconf
启动bind服务 systemctl start named
查看端口 netstat -luntp | grep 53
tcp 0 0 192.168.0.50:53 0.0.0.0:* LISTEN 27121/named
tcp 0 0 127.0.0.1:953 0.0.0.0:* LISTEN 27121/named
tcp6 0 0 :::53 :::* LISTEN 27121/named
tcp6 0 0 ::1:953 :::* LISTEN 27121/named
udp 0 0 192.168.0.50:53 0.0.0.0:* 27121/named
udp6 0 0 :::53 :::* 27121/named修改其他机子的dns指向ip
vim /etc/sysconfig/network-scripts/ifcfg-ens33
IPADDR=192.168.0.20
NETMASK=255.255.255.0
GATEWAY=192.168.0.1
DNS1=192.168.0.50然后测试ping
[root@sh0-20 ~]# ping sh0-31
PING sh0-31.host.com (192.168.0.31) 56(84) bytes of data.
64 bytes from 192.168.0.31 (192.168.0.31): icmp_seq=1 ttl=64 time=0.970 ms
64 bytes from 192.168.0.31 (192.168.0.31): icmp_seq=2 ttl=64 time=0.646 ms
64 bytes from 192.168.0.31 (192.168.0.31): icmp_seq=3 ttl=64 time=0.715 ms
64 bytes from 192.168.0.31 (192.168.0.31): icmp_seq=4 ttl=64 time=0.752 ms
64 bytes from 192.168.0.31 (192.168.0.31): icmp_seq=5 ttl=64 time=0.814 ms
64 bytes from 192.168.0.31 (192.168.0.31): icmp_seq=6 ttl=64 time=0.555 ms
64 bytes from 192.168.0.31 (192.168.0.31): icmp_seq=7 ttl=64 time=0.687 ms
64 bytes from 192.168.0.31 (192.168.0.31): icmp_seq=8 ttl=64 time=0.713 ms
64 bytes from 192.168.0.31 (192.168.0.31): icmp_seq=9 ttl=64 time=0.666 ms如果遇到短域名不可用
vim /etc/resolv.conf
最前面添加一行 search host.comwewew
wewe
