본문 바로가기
Technical/Cloud, Virtualization, Containers

Amazon Route53, Google cloud DNS 를 활용한 kubernetes service DNS 자동화 (2/3)

Barracuda 2020. 9. 13. 18:37
반응형

 

2. AWS Route53 hosted-zone(호스팅영역) 과 External DNS로 kubernetes service 연결하기

 

 

지난 글(https://bryan.wiki/305) 에 이어서, 이번에는 Route53에 hosted-zone을 생성하여 Local kubernetes 의 external-dns를 통해 deploy 되는 service를 연결해 보고자 한다

 

 

 

 

Route53 hosted-zone 만들기

Aws console UI에서 Route53 > 호스팅 영역 > 호스팅 영역 생성' 을 통해서도 동일한 결과를 볼 수 있다

$ aws route53 create-hosted-zone --name route53.kube.click --caller-reference this-hosted-zone-is-sub-domain-of-kube-click
----------
{
    "Location": "https://route53.amazonaws.com/2013-04-01/hostedzone/REDACTEDHOSTEDZONEID",
    "HostedZone": {
        "Id": "/hostedzone/REDACTEDHOSTEDZONEID",
        "Name": "route53.kube.click.",
        "CallerReference": "this-hosted-zone-is-sub-domain-of-kube-click",
        "Config": {
            "PrivateZone": false
        },
        "ResourceRecordSetCount": 2
    },
    "ChangeInfo": {
        "Id": "/change/REDACTEDCHANGEID",
        "Status": "PENDING",
        "SubmittedAt": "2020-09-13T09:22:25.551000+00:00"
    },
    "DelegationSet": {
        "NameServers": [
            "ns-1333.redactedawsdomain.org",
            "ns-556.redactedawsdomain.net",
            "ns-1574.redactedawsdomain.co.uk",
            "ns-240.redactedawsdomain.com"
        ]
    }
}

$ aws route53 list-hosted-zones
----------
{
    "HostedZones": [
    ...
        {
            "Id": "/hostedzone/REDACTEDHOSTEDZONEID",
            "Name": "route53.kube.click.",
            "CallerReference": "this-hosted-zone-is-sub-domain-of-kube-click",
            "Config": {
                "PrivateZone": false
            },
            "ResourceRecordSetCount": 2
        }
    ]
}

 

  • Kube.click(parent domain) 에 NS record 추가
$ export AWS_ZONE_ID=$(aws route53 list-hosted-zones-by-name --output json  --dns-name route53.kube.click | jq -r '.HostedZones[0].Id' | cut -f3 -d'/')

$ aws route53 get-hosted-zone --id $AWS_ZONE_ID
----------
{
    "HostedZone": {
        "Id": "/hostedzone/REDACTEDHOSTEDZONEID",
        "Name": "route53.kube.click.",
        "CallerReference": "this-hosted-zone-is-sub-domain-of-kube-click",
        "Config": {
            "PrivateZone": false
        },
        "ResourceRecordSetCount": 3
    },
    "DelegationSet": {
        "NameServers": [
            "ns-1333.redactedawsdomain.org",
            "ns-556.redactedawsdomain.net",
            "ns-1574.redactedawsdomain.co.uk",
            "ns-240.redactedawsdomain.com"
        ]
    }
}

 

Route53 > 호스팅 영역 > kube.click > 레코드 생성

 

  • NS resolving 확인
$ dig route53.kube.click ns
----------
; <<>> DiG 9.10.6 <<>> route53.kube.click ns
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 64026
;; flags: qr rd ra; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;route53.kube.click.        IN    NS

;; ANSWER SECTION:
route53.kube.click.    30    IN    NS    ns-1333.redactedawsdomain.org.
route53.kube.click.    30    IN    NS    ns-1574.redactedawsdomain.co.uk.
route53.kube.click.    30    IN    NS    ns-556.redactedawsdomain.net.
route53.kube.click.    30    IN    NS    ns-240.redactedawsdomain.com.

;; Query time: 186 msec
;; SERVER: 210.220.163.82#53(210.220.163.82)
;; WHEN: Sun Sep 13 20:04:09 KST 2020
;; MSG SIZE  rcvd: 187

 

 

Kubernetes external-dns deploy

Aws Route53 과 연결 가능한 external-dns 를 helm 을 통해서 deploy 해 보자.
txtOwnerId 로는 앞서 추출한 route53.kube.click 도메인의 ID를 사용한다

$ helm install external-dns bitnami/external-dns \
  --set provider=aws \
  --set aws.credentials.accessKey="AWSSDKACCESSKEY" \
  --set aws.credentials.secretKey="AWSSDKSECRETKEY" \
  --set txtOwnerId=$AWS_ZONE_ID \
  --set domainFilters\[0\]=route53.kube.click \
  --set policy=sync

$ kubectl logs external-dns-f44b659f8-vqc94
----------
...
time="2020-09-13T16:04:08Z" level=info msg="Instantiating new Kubernetes client"
time="2020-09-13T16:04:08Z" level=info msg="Using inCluster-config based on serviceaccount-token"
time="2020-09-13T16:04:08Z" level=info msg="Created Kubernetes client https://10.100.0.1:443"
time="2020-09-13T16:04:17Z" level=info msg="All records are already up to date"
time="2020-09-13T16:05:19Z" level=info msg="All records are already up to date"

 

접속 대상인 Kubernetes service deploy

Nginx 로 이루어진 kubernetes service 를 다음과 같이 정의하자. Type을 LoadBalancer 로 하고 svc1 서비스에 대해 Kubernetes cluster 에서 사용 가능한 주소 대역이 할당되도록 설정하면 되는데, 여기서 보이는 10.0.0.* 대역의 IP가 지금은 사설 IP 대역이지만 실제 운영시에는 공인 IP 대역으로, 외부 접근 가능한 주소로 보면 된다.

 

service-example.yaml

apiVersion: v1
kind: Service
metadata:
  name: svc1
  annotations:
    external-dns.alpha.kubernetes.io/hostname: svc1.route53.kube.click
  labels:
    app: nginx
spec:
  type: LoadBalancer
  ports:
  - port: 80
    name: http
    targetPort: 80
  selector:
    app: nginx

---

apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx
spec:
  selector:
    matchLabels:
      app: nginx
  template:
    metadata:
      labels:
        app: nginx
    spec:
      containers:
      - image: nginx
        name: nginx
        ports:
        - containerPort: 80
          name: http

 

$ kubectl apply -f service-example.yaml
----------
service/svc1 created
deployment.apps/nginx created

$ kubectl get service -l app=nginx
----------
NAME   TYPE           CLUSTER-IP      EXTERNAL-IP   PORT(S)        AGE
svc1   LoadBalancer   10.100.89.153   10.0.0.201    80:32114/TCP   29m

 

약간의 시간이 흐른 후 External-dns 의 log 를 살펴 보면 다음과 같은 내용과 함께, Route53 에 새로운 A 레코드와 TXT 레코드가 추가되 어 있는 것을 볼 수 있다.

$ kubectl logs external-dns-f44b659f8-vqc94
----------
...
time="2020-09-13T16:12:28Z" level=info msg="Desired change: CREATE svc1.route53.kube.click A [Id: /hostedzone/REDACTEDHOSTEDZONEID]"
time="2020-09-13T16:12:28Z" level=info msg="Desired change: CREATE svc1.route53.kube.click TXT [Id: /hostedzone/REDACTEDHOSTEDZONEID]"
time="2020-09-13T16:12:28Z" level=info msg="2 record(s) in zone route53.kube.click. [Id: /hostedzone/REDACTEDHOSTEDZONEID] were successfully updated"
...

$ aws route53 list-resource-record-sets --hosted-zone-id $AWS_ZONE_ID
----------
{
    "ResourceRecordSets": [
        ...
        {
            "Name": "svc1.route53.kube.click.",
            "Type": "A",
            "TTL": 300,
            "ResourceRecords": [
                {
                    "Value": "10.0.0.201"
                }
            ]
        },
        {
            "Name": "svc1.route53.kube.click.",
            "Type": "TXT",
            "TTL": 300,
            "ResourceRecords": [
                {
                    "Value": "\"heritage=external-dns,external-dns/owner=REDACTEDHOSTEDZONEID,external-dns/resource=service/default/svc1\""
                }
            ]
        }
    ]
}

 

Curl 또는 웹 브라우저로 도메인 접속

$ curl http://10.0.0.201
----------
<!DOCTYPE html>
<html>
<head>
<title>Welcome to nginx!</title>
<style>
    body {
        width: 35em;
        margin: 0 auto;
        font-family: Tahoma, Verdana, Arial, sans-serif;
    }
</style>
</head>
<body>
<h1>Welcome to nginx!</h1>
<p>If you see this page, the nginx web server is successfully installed and
working. Further configuration is required.</p>

<p>For online documentation and support please refer to
<a href="http://nginx.org/">nginx.org</a>.<br/>
Commercial support is available at
<a href="http://nginx.com/">nginx.com</a>.</p>

<p><em>Thank you for using nginx.</em></p>
</body>
</html>

 

Kubernetes service 삭제

 

External-dns deploy 옵션에서 policy=sync 로 설정했기 때문에, 접속 대상이 되는 service를 삭제하면 Route53의 route53.kube.click 호스팅 영역의 svc1.route53.kube.click 레코드도 자동으로 삭제된다

$ kubectl delete -f service-example.yaml
----------
service/svc1 deleted
deployment.apps/nginx deleted

 

약간의 시간이 흐른 후 External-dns 의 log 를 살펴 보면 다음과 같은 내용과 함께, Route53 의 svc1에 대한 A 레코드와 TXT 레코드가 삭제되어 있는 것을 볼 수 있다.

$ kubectl logs external-dns-f44b659f8-vqc94
----------
...
time="2020-09-13T17:46:16Z" level=info msg="Desired change: DELETE svc1.route53.kube.click A [Id: /hostedzone/REDACTEDHOSTEDZONEID]"
time="2020-09-13T17:46:16Z" level=info msg="Desired change: DELETE svc1.route53.kube.click TXT [Id: /hostedzone/REDACTEDHOSTEDZONEID]"
time="2020-09-13T17:46:16Z" level=info msg="2 record(s) in zone route53.kube.click. [Id: /hostedzone/REDACTEDHOSTEDZONEID] were successfully updated"
...

$ aws route53 list-resource-record-sets --hosted-zone-id $AWS_ZONE_ID

 

다음 포스팅(https://bryan.wiki/307)에서는 Google cloud DNS와 external-dns 를 이용해서 kubernetes service 와 domain 주소를 통한 연결을 구성해 보도록 하자.

 

Barracuda

 

반응형
저작자표시 비영리 변경금지

'Technical > Cloud, Virtualization, Containers' 카테고리의 다른 글

[Kubernetes] Traefik v2와 cert-manager 를 이용한 secure service 구현  (0) 2020.10.06
Amazon Route53, Google cloud DNS 를 활용한 kubernetes service DNS 자동화 (3/3)  (0) 2020.09.21
Amazon Route53, Google cloud DNS 를 활용한 kubernetes service DNS 자동화 (1/3)  (0) 2020.09.10
[Kubernetes StatefulSet] Mariadb Galera Cluster with etcd(3/5)  (0) 2018.10.14
[Kubernetes StatefulSet] Mongodb Replicaset by StatefulSet(2/5)  (2) 2018.09.16

'Technical/Cloud, Virtualization, Containers' Related Articles

티스토리툴바