如何在Route53手动更新AWS EC2公网IP修复K8S集群连接故障

执行kubectl get cluster-info时触发连接超时错误：

E0902 13:22:08.516718     897 memcache.go:265] couldn't get current server API group list: Get "https://api.kubevpro.quickesh.com/api?timeout=32s": dial tcp 203.0.113.123:443: i/o timeout
Unable to connect to the server: dial tcp 203.0.113.123:443: i/o timeout

已执行操作 #

• 运行kops validate cluster --state=s3://ky-bucket-kops --name=kubevpro.quickesh.com，返回结果如下：

Validating cluster kubevpro.quickesh.com

INSTANCE GROUPS
NAME                ROLE        MACHINETYPE MIN MAX SUBNETS
control-plane-us-east-1a    ControlPlane    t3.medium   1   1   us-east-1a
nodes-us-east-1a        Node        t3.small    1   1   us-east-1a
nodes-us-east-1b        Node        t3.small    1   1   us-east-1b

NODE STATUS
NAME    ROLE    READY

VALIDATION ERRORS
KIND    NAME        MESSAGE
dns apiserver   Validation Failed

The dns-controller Kubernetes deployment has not updated the Kubernetes cluster's API DNS entry to the correct IP address.  The API DNS IP address is the placeholder address that kops creates: 203.0.113.123.  Please wait about 5-10 minutes for a control plane node to start, dns-controller to launch, and DNS to propagate.  The protokube container and dns-controller deployment logs may contain more diagnostic information.  Etcd and the API DNS entries must be updated for a kops Kubernetes cluster to start.

Validation Failed
Error: validation failed: cluster not yet healthy

推测原因是重启EC2实例后，Kops未自动更新Route53中的公网IP，但在AWS控制台找不到相关配置，需手动更新方法。

手动更新Route53 DNS记录步骤 #

1. 获取控制节点公网IP

   • 登录AWS控制台进入EC2服务，找到名称含control-plane的控制节点实例，复制其公网IPv4地址；
   • 或用CLI命令查询：

     aws ec2 describe-instances --filters "Name=tag:Name,Values=kubevpro.quickesh.com-control-plane-us-east-1a" --query "Reservations[*].Instances[*].PublicIpAddress" --output text
     

2. 定位Route53集群DNS记录

   • 进入Route53服务，点击「托管区域」，找到对应集群域名kubevpro.quickesh.com的托管区域；
   • 在记录集中查找名称为api.kubevpro.quickesh.com的A记录，当前指向占位IP203.0.113.123。

3. 更新A记录IP

   • 点击该A记录的「编辑记录」按钮，将值替换为步骤1获取的控制节点公网IP，保存更改。

4. 验证DNS生效

   • 等待数分钟DNS传播完成，运行nslookup api.kubevpro.quickesh.com或dig api.kubevpro.quickesh.com确认IP已更新；
   • 再次执行kubectl get cluster-info测试连接。

5. 排查自动更新故障（可选）

   • 若后续仍出现自动更新问题，SSH登录控制节点查看dns-controller日志：

     kubectl logs -n kube-system deployment/dns-controller
     

   • 检查集群IAM角色权限，确保包含route53:ChangeResourceRecordSets等Route53修改权限。

内容的提问来源于stack exchange，提问作者kykywei