关于Kubernetes内部DNS外部暴露及自定义DNS名称的技术咨询

Great question! Using Git hashes as namespace names is a smart pattern for isolating different service versions—let’s walk through how you can expose internal Kubernetes services to the external world with custom DNS names (instead of relying on the auto-generated cluster-internal DNS).

Can I expose internal Kubernetes DNS to the outside? #

Short answer: Yes, but you won’t typically expose the cluster-internal DNS service (like CoreDNS) directly to external users. Instead, you’ll use Kubernetes tools to map custom external DNS names to your internal services. Here are the most common approaches:

1. Use an Ingress Controller + Custom Hostnames #

Ingress is the standard way to route external HTTP/HTTPS traffic to internal services, and it lets you define custom DNS names directly. For your per-Git-hash namespace setup, you can create an Ingress resource that ties a custom hostname to your service.

Example Ingress manifest (for a namespace named abc123—your Git hash):

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: my-service-ingress
  namespace: abc123
spec:
  # Optional: Add TLS for secure access
  tls:
  - hosts:
    - my-service.abc123.example.com
    secretName: my-service-tls-secret
  rules:
  - host: my-service.abc123.example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: my-service
            port:
              number: 80

Once you apply this, your Ingress controller (like NGINX Ingress) will route traffic from my-service.abc123.example.com to the my-service service in the abc123 namespace. You just need to point your domain’s DNS records to your Ingress controller’s external IP (either manually or with tools like ExternalDNS below).

2. Use ExternalDNS for Automated DNS Record Management #

If you want to avoid manually updating DNS records every time you deploy a new namespace/service, ExternalDNS is the way to go. It integrates with popular DNS providers and automatically creates/updates DNS records based on your Kubernetes resources.

To use it, add an annotation to your Service or Ingress specifying your desired external hostname:

apiVersion: v1
kind: Service
metadata:
  name: my-service
  namespace: abc123
  annotations:
    external-dns.alpha.kubernetes.io/hostname: my-service.abc123.example.com
spec:
  type: LoadBalancer # Or NodePort, but LoadBalancer gives a stable external IP
  ports:
  - port: 80
    targetPort: 80
  selector:
    app: my-app

ExternalDNS will detect this annotation and create a DNS record pointing my-service.abc123.example.com to your Service’s external IP.

3. Avoid Exposing Cluster DNS Directly #

It’s technically possible to expose your cluster’s CoreDNS service to the outside (e.g., via a LoadBalancer Service), but this is not recommended. It introduces security risks (external users could query internal cluster resources) and isn’t flexible for custom branding/versioning like the above methods.

Can I manually specify DNS names instead of using the auto-generated ones? #

Absolutely! The auto-generated <service-name>.<namespace-name>.svc.cluster.local is only for internal cluster communication. For external access, you have full control over the DNS names you use:

• For Ingress: Define any valid hostname in the spec.rules.host field (as shown earlier).
• For Services with ExternalDNS: Use the external-dns.alpha.kubernetes.io/hostname annotation to set your desired name.
• You can even use patterns like {service-name}-{git-hash}.example.com or {git-hash}.{service-name}.example.com to make it clear which version of the service the DNS points to.

Key Notes #

• Domain Ownership: You’ll need to own the top-level domain (e.g., example.com) so you can create subdomains for your services.
• Security: Always use TLS for external-facing services (you can get free certificates via tools like Cert-Manager).
• Cleanup: Don’t forget to delete old Ingress/Service resources (and their corresponding DNS records) when you retire a namespace/service version to avoid stale entries.

内容的提问来源于stack exchange，提问作者Alexander Mills