kOps 实战：基于 AWS Route53 子域搭建多可用区高可用集群并弹性扩容

kOps 实战基于 AWS Route53 子域搭建多可用区高可用集群并弹性扩容【免费下载链接】kopsKubernetes Operations (kOps) - Production Grade k8s Installation, Upgrades and Management项目地址: https://gitcode.com/gh_mirrors/kop/kops本文是一份以 kOpsKubernetes Operations为核心的 AWS 实战指南从零开始在一个 Route53 子域上创建具备 3 个 master、2 个 worker、横跨多个可用区AZ的高可用 Kubernetes 集群并演示通过修改 InstanceGroup 完成集群横向扩容最后安全地删除集群并验证 DNS 记录清理结果。读完本文你将掌握 Route53 子域委派、kOps 集群创建参数--control-plane-zones、--node-count等、kOps 自动生成的 DNS 记录结构以及kops edit igkops update cluster的扩容工作流并了解这些行为背后的 kOps 源码实现。实验目标本实验对应仓库 docs/examples/kops-test-route53-subdomain.md聚焦以下目标演示一套生产向的高可用拓扑3 个 master 2 个 worker分布于不同可用区确保 3 个 master 部署在 3 个不同的 AWS 可用区确保 worker 节点部署在 2 个不同的 AWS 可用区使用 AWS Route53 承载集群 DNS 子域演示如何正确地横向扩容集群。整个实验属于仓库 docs/examples/README.md 中划分的 Chapter III同系列还有 CoreOS 多 master 实验docs/examples/coreos-kops-tests-multimaster.md与私有网络 Bastion 实验docs/examples/kops-tests-private-net-bastion-host.md本文的 DNS 子域基础同样可复用于后两个场景。前置检查Pre-Flight Check在开始之前请先完成 docs/examples/basic-requirements.md 中列出的所有实验公共要求这是所有 kOps 实验的基础配置好的 AWS CLI具备 kOps 所需的权限与角色本机 SSH 密钥就绪于~/.ssh/id_rsa/id_rsa.pub可用ssh-keygen -t rsa -f ~/.ssh/id_rsa -P 生成设置 AWS 区域。本系列实验大部分部署在us-east-1可用区包括 us-east-1a ~ us-east-1f真正的 Kubernetes API 级高可用需要 3 个 master参考 docs/operations/high_availability.md。以root身份为所有用户安装工具cd ~ curl -LO https://dl.k8s.io/release/$(curl -s -L https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl curl -LO https://github.com/kubernetes/kops/releases/download/$(curl -s https://api.github.com/repos/kubernetes/kops/releases/latest | grep tag_name | cut -d -f 4)/kops-linux-amd64 chmod 755 kubectl kops-linux-amd64 mv kops-linux-amd64 kops mv kubectl kops /usr/local/bin若无root权限也可将kops、kubectl放入本地~/bin并加入PATH。另外本实验的很多命令使用jq解析 JSON请一并安装。DNS 准备在 AWS Route53 上创建子域确认父域托管区已就绪假设你已经有一个 AWS 托管 DNS 域。先用 AWS CLI 列出托管区aws route53 list-hosted-zones --outputtable输出示例------------------------------------------------------------------------------------------------------------------ || ListHostedZones || ---------------------------------------------------------------------------------------------------------------- ||| HostedZones || ||-----------------------------------------------------------------------------------------------------------| ||| CallerReference | Id | Name | ResourceRecordSetCount || ||-----------------------------------------------------------------------------------------------------------| ||| C0461665-01D8-463B-BF2D-62F1747A16DB | /hostedzone/ZTKK4EXR1EWR5 | example.org. | 2 || ||-----------------------------------------------------------------------------------------------------------| |||| Config ||| |||-----------------------------------------------------------------------------------------------------------|| |||| PrivateZone | False ||| |||-----------------------------------------------------------------------------------------------------------||再用dig确认域可以从互联网解析。dig通常随 bind-tools / bind 相关软件包一起提供几乎所有现代 Linux 及其他类 Unix 系统都可用dig short example.org soa # ns-656.example-aws-dns-18.net. example-aws-dns-hostmaster.amazon.com. 1 7200 900 1209600 86400 dig short example.org ns # ns-1056.example-aws-dns-04.org. # ns-656.example-aws-dns-18.net. # ns-9.example-aws-dns-01.com. # ns-1642.example-aws-dns-13.co.uk.只有当soa与ns查询都返回 OK、且数据指向 Amazon 时才说明托管区可用。务必在开始其他操作之前确认 Route53 托管区工作正常。创建集群专用子域为集群创建一个子域export ID$(uuidgen) echo $ID # ae852c68-78b3-41af-85ee-997fc470fd1c aws route53 \ create-hosted-zone \ --outputjson \ --name kopsclustertest.example.org \ --caller-reference $ID | \ jq .DelegationSet.NameServersaws route53 create-hosted-zone会返回该子域的 4 个 NS 服务器[ ns-1383.example-aws-dns-44.org, ns-829.example-aws-dns-39.net, ns-346.example-aws-dns-43.com, ns-1973.example-aws-dns-54.co.uk ]获取父区 ID 并添加 NS 委派记录还需要父域example.org.的 hosted zone IDaws route53 --outputjson list-hosted-zones | jq .HostedZones[] | select(.Nameexample.org.) | .Id | cut -d/ -f3|cut -d\ -f1建议将其导出为环境变量后续命令会反复使用export parentzoneidaws route53 --outputjson list-hosted-zones | jq .HostedZones[] | select(.Nameexample.org.) | .Id | cut -d/ -f3|cut -d\ -f1 echo $parentzoneid # ZTKK4EXR1EWR5这一步是必需的新创建的子域托管区上还没有 NS 记录需要把上面获得的 4 个 NS 记录写入子域。先构造 JSON 变更文件catEOF ~/kopsclustertest.example.org.json { Comment: Create a subdomain NS record in the parent domain, Changes: [ { Action: CREATE, ResourceRecordSet: { Name: kopsclustertest.example.org, Type: NS, TTL: 300, ResourceRecords: [ { Value: ns-1383.example-aws-dns-44.org }, { Value: ns-829.example-aws-dns-39.net }, { Value: ns-346.example-aws-dns-43.com }, { Value: ns-1973.example-aws-dns-54.co.uk } ] } } ] } EOF然后把它提交到父托管区aws route53 change-resource-record-sets \ --outputtable \ --hosted-zone-id $parentzoneid \ --change-batch file://~/kopsclustertest.example.org.json输出类似------------------------------------------------------------------------------------------------------------------------- || ChangeResourceRecordSets || ----------------------------------------------------------------------------------------------------------------------- ||| ChangeInfo || ||------------------------------------------------------------------------------------------------------------------| ||| Comment | Id | Status | SubmittedAt || ||------------------------------------------------------------------------------------------------------------------| ||| Create a subdomain NS record in the parent domain | /change/CJ7FOVJ7U58L0 | PENDING | 2017-09-06T13:28:12.972Z || ||------------------------------------------------------------------------------------------------------------------|最后检查子域上的记录aws route53 list-resource-record-sets \ --outputtable \ --hosted-zone-id aws route53 --outputjson list-hosted-zones | jq .HostedZones[] | select(.Namekopsclustertest.example.org.) | .Id | cut -d/ -f3|cut -d\ -f1可以看到子域上已同时存在 NS 记录TTL 172800即 AWS 自动创建的 NS 记录与 SOA 记录TTL 900--------------------------------------------------------------------------------------- || ListResourceRecordSets || ------------------------------------------------------------------------------------- ||| ResourceRecordSets || ||---------------------------------------------------------------------------------| ||| Name | TTL | Type || ||---------------------------------------------------------------------------------| ||| kopsclustertest.example.org. | 172800 | NS || ||---------------------------------------------------------------------------------| |||| ResourceRecords ||| |||---------------------------------------------------------------------------------|| |||| Value ||| |||---------------------------------------------------------------------------------|| |||| ns-1383.example-aws-dns-44.org. ||| |||| ns-829.example-aws-dns-39.net. ||| |||| ns-346.example-aws-dns-43.com. ||| |||| ns-1973.example-aws-dns-54.co.uk. ||| |||---------------------------------------------------------------------------------|| ||| ResourceRecordSets || ||---------------------------------------------------------------------------------| ||| Name | TTL | Type || ||---------------------------------------------------------------------------------| ||| kopsclustertest.example.org. | 900 | SOA || ||---------------------------------------------------------------------------------| |||| ResourceRecords ||| |||---------------------------------------------------------------------------------|| |||| Value ||| |||---------------------------------------------------------------------------------|| |||| ns-1383.example-aws-dns-44.org. example-aws-dns-hostmaster.amazon.com. 1 7200 900 1209600 86400 ||| |||---------------------------------------------------------------------------------||再用dig验证子域在公网上的可用性dig short kopsclustertest.example.org soa # ns-1383.example-aws-dns-44.org. example-aws-dns-hostmaster.amazon.com. 1 7200 900 1209600 86400 dig short kopsclustertest.example.org ns # ns-1383.example-aws-dns-44.org. # ns-829.example-aws-dns-39.net. # ns-1973.example-aws-dns-54.co.uk. # ns-346.example-aws-dns-43.com.SOA 与 NS 记录都出现后子域即可交给 kOps 使用。AWS / kOps 环境信息设置假设你已在 Linux 系统上配置好 AWS 环境可通过如下脚本导出凭证适用于默认 profileexport AWS_ACCESS_KEY_IDgrep aws_access_key_id ~/.aws/credentials|awk {print $3} export AWS_SECRET_ACCESS_KEYgrep aws_secret_access_key ~/.aws/credentials|awk {print $3} echo $AWS_ACCESS_KEY_ID $AWS_SECRET_ACCESS_KEY如果使用多个 profile非默认则改用export AWS_PROFILEname_of_your_profile为集群状态创建一个 S3 bucket如果没有的话aws s3api create-bucket --bucket my-kops-s3-bucket-for-cluster-state --region us-east-1然后导出集群名称与 state store 地址集群名要使用完整子域export NAMEmycluster01.kopsclustertest.example.org export KOPS_STATE_STOREs3://my-kops-s3-bucket-for-cluster-state说明NAME是后续所有 kOps 命令引用集群名称的环境变量。本实验中集群名为mycluster01.kopsclustertest.example.org它会作为 kOps 选择 DNS 托管区的依据——详见后文源码解析。创建集群3 master 2 worker 的多可用区高可用部署创建集群实现多 master3 个、跨多 AZ、双 worker同样跨 AZkops create cluster \ --cloudaws \ --control-plane-zonesus-east-1a,us-east-1b,us-east-1c \ --zonesus-east-1a,us-east-1b,us-east-1c \ --node-count2 \ --node-sizet2.micro \ --control-plane-sizet2.micro \ ${NAME}对参数逐条说明${NAME}即先前导出的集群名mycluster01.kopsclustertest.example.org--cloudawskOps 支持多种云需要显式告知使用 AWS真正的 master 级 HA 需要选择至少包含 3 个可用区的区域本实验使用us-east-1含 us-east-1a、1b、1c、1d、1e 五个 AZ--control-plane-zonesus-east-1a,us-east-1b,us-east-1c强制创建 3 个 master--node-count2只作用于 worker 节点不影响 master--node-size与--control-plane-size分别指定 worker 与 master 的实例类型本实验为简化教学使用t2.micro生产环境不要使用 t2.micro最小建议从t2.medium起步。从源码看这些参数在 cmd/kops/create_cluster.go 中定义--zones为 Zones in which to run the cluster--control-plane-zones的官方描述是 Zones in which to run control-plane nodes. (must be an odd number)即要求奇数个可用区——这与文档master 数量取从 3 开始的奇数的建议完全一致--node-count描述为 Total number of worker nodes. Defaults to one node per zone。另外旧式参数--master-zones、--master-size、--master-count均已标记为 deprecated见 cmd/kops/create_cluster.go应统一使用control-plane-*前缀。--node-size/--control-plane-size均为StringSliceVar意味着可以传入逗号分隔的多种机型且注册了按云厂商实例类型补全的函数。关于私有网络与 Bastion文档开头提到本拓扑使用私有网络与 Bastion 服务器但上面给出的命令并不包含相应参数。若需要真正启用私有网络 Bastion需在创建命令中加入--topologyprivate --bastion等参数具体可参考同系列实验 docs/examples/kops-tests-private-net-bastion-host.md。本文命令输出展示的是默认public拓扑下的结果。部署集群kops update cluster ${NAME} --yes输出示例历史版本日志当前版本输出结构类似I0906 09:42:09.399908 13538 executor.go:91] Tasks: 0 done / 75 total; 38 can run I0906 09:42:12.033675 13538 vfs_castore.go:422] Issuing new certificate: master I0906 09:42:12.310586 13538 vfs_castore.go:422] Issuing new certificate: kube-scheduler I0906 09:42:12.791469 13538 vfs_castore.go:422] Issuing new certificate: kube-proxy I0906 09:42:13.312675 13538 vfs_castore.go:422] Issuing new certificate: kops I0906 09:42:13.378500 13538 vfs_castore.go:422] Issuing new certificate: kubelet I0906 09:42:13.398070 13538 vfs_castore.go:422] Issuing new certificate: kube-controller-manager I0906 09:42:13.636134 13538 vfs_castore.go:422] Issuing new certificate: kubecfg I0906 09:42:14.684945 13538 executor.go:91] Tasks: 38 done / 75 total; 14 can run I0906 09:42:15.997588 13538 executor.go:91] Tasks: 52 done / 75 total; 19 can run I0906 09:42:17.855959 13538 launchconfiguration.go:327] waiting for IAM instance profile masters.mycluster01.kopsclustertest.example.org to be ready I0906 09:42:17.932515 13538 launchconfiguration.go:327] waiting for IAM instance profile nodes.mycluster01.kopsclustertest.example.org to be ready I0906 09:42:18.602180 13538 launchconfiguration.go:327] waiting for IAM instance profile masters.mycluster01.kopsclustertest.example.org to be ready I0906 09:42:18.682038 13538 launchconfiguration.go:327] waiting for IAM instance profile masters.mycluster01.kopsclustertest.example.org to be ready I0906 09:42:29.215995 13538 executor.go:91] Tasks: 71 done / 75 total; 4 can run I0906 09:42:30.073417 13538 executor.go:91] Tasks: 75 done / 75 total; 0 can run I0906 09:42:30.073471 13538 dns.go:152] Pre-creating DNS records I0906 09:42:32.403909 13538 update_cluster.go:247] Exporting kubecfg for cluster kOps has set your kubectl context to mycluster01.kopsclustertest.example.org Cluster is starting. It should be ready in a few minutes. Suggestions: * validate cluster: kops validate cluster * list nodes: kubectl get nodes --show-labels * ssh to the master: ssh -i ~/.ssh/id_rsa adminapi.mycluster01.kopsclustertest.example.org The admin user is specific to Debian. If not using Debian please use the appropriate user based on your OS. * read about installing addons: docs/addons.md注意日志中的dns.go:152] Pre-creating DNS recordskOps 会先为 API 等内部服务预创建 DNS 记录。kOps 会自动为 API 创建api.mycluster01.kopsclustertest.example.org记录用dig可验证dig short api.mycluster01.kopsclustertest.example.org A # 34.228.219.212 # 34.206.72.126 # 54.83.144.111kOps 创建了一条 DNS 轮询round-robinA 记录包含全部 3 个 master 的公网 IP——还记得我们指定了 3 个 master 吗这三个 IP 就是它们。验证集群大约 10~15 分钟取决于 AWS 服务当时的速度后验证集群kops validate cluster输出示例Using cluster from kubectl context: mycluster01.kopsclustertest.example.org Validating cluster mycluster01.kopsclustertest.example.org INSTANCE GROUPS NAME ROLE MACHINETYPE MIN MAX SUBNETS master-us-east-1a Master t2.micro 1 1 us-east-1a master-us-east-1b Master t2.micro 1 1 us-east-1b master-us-east-1c Master t2.micro 1 1 us-east-1c nodes Node t2.micro 2 2 us-east-1a,us-east-1b,us-east-1c NODE STATUS NAME ROLE READY ip-172-20-125-42.ec2.internal master True ip-172-20-33-58.ec2.internal master True ip-172-20-43-160.ec2.internal node True ip-172-20-64-116.ec2.internal master True ip-172-20-68-15.ec2.internal node True Your cluster mycluster01.kopsclustertest.example.org is ready也可以直接查看节点kubectl get nodes再通过 SSH 向 master 发送命令ssh -i ~/.ssh/id_rsa adminapi.mycluster01.kopsclustertest.example.org ec2metadata --public-ipv4 # 34.206.72.126返回的正是 3 个 master 公网 IP 之一说明api.xxxx记录工作正常。kOps 在 Route53 上创建的 DNS 记录解析用 AWS CLI 检查子域内 kOps 创建的资源记录aws route53 list-resource-record-sets \ --outputtable \ --hosted-zone-id aws route53 --outputjson list-hosted-zones | jq .HostedZones[] | select(.Namekopsclustertest.example.org.) | .Id | cut -d/ -f3|cut -d\ -f1输出节选显示 kOps 在子域内创建了如下记录记录名类型TTL值示例kopsclustertest.example.org.NS / SOA172800 / 900我们手动添加的委派记录api.mycluster01.kopsclustertest.example.org.A6034.206.72.126 / 34.228.219.212 / 54.83.144.1113 个 master 公网 IP轮询api.internal.mycluster01.kopsclustertest.example.org.A60172.20.125.42 / 172.20.33.58 / 172.20.64.1163 个 master 内网 IPetcd-a.internal.mycluster01.kopsclustertest.example.org.A60172.20.33.58etcd 成员 Aetcd-b.internal.mycluster01.kopsclustertest.example.org.A60172.20.64.116etcd 成员 Betcd-c.internal.mycluster01.kopsclustertest.example.org.A60172.20.125.42etcd 成员 Cetcd-events-a/b/c.internal....A60与 etcd-a/b/c 相同的内网 IPetcd events 集群使用 JSON 输出 jq可得到更结构化的结果aws route53 list-resource-record-sets --outputjson --hosted-zone-id aws route53 --outputjson list-hosted-zones | jq .HostedZones[] | select(.Namekopsclustertest.example.org.) | .Id | cut -d/ -f3|cut -d\ -f1|jq .ResourceRecordSets[]从源码层面看这套 DNS 行为的实现依据托管区匹配kOps 通过FindDNSHostedZoneupup/pkg/fi/cloudup/utils.go在 DNS 提供方中列举全部托管区筛选出集群名的后缀匹配项然后选取名称最长最精确的托管区若找不到任何匹配托管区会直接报错 No matching hosted zones found若存在多个同长度匹配则要求用户用--dns-zone显式指定。这正是集群名必须是子域完整名称的原因——mycluster01.kopsclustertest.example.org能精确命中kopsclustertest.example.org托管区。--dns-zone参数在 cmd/kops/create_cluster.go 中定义为 DNS hosted zone (defaults to longest matching zone)可用于多托管区场景下手动指定。预创建记录日志中的 Pre-creating DNS records 来自 upup/pkg/fi/cloudup/dns.go。kOps 在集群真正就绪前就会先把需要的记录写入 Route53A 记录先写入占位 IP203.0.113.123TEST-NET-3 保留地址见 pkg/dns/placeholder.goTTL 使用PlaceholderTTL 10upup/pkg/fi/cloudup/dns.go实例启动后 kOps 再将占位记录更新为真实 IP。这个机制保证了 API 域名从一开始就能解析。etcd 记录每条 etcd 成员记录对应一个 master 的内网 IP正是 etcd 集群节点间通信与 master 故障检测的依赖。集群横向扩容Scale-up假设负载上升需要增加 2 个 worker 节点。首先查看现有 InstanceGroupkops get instancegroups输出Using cluster from kubectl context: mycluster01.kopsclustertest.example.org NAME ROLE MACHINETYPE MIN MAX SUBNETS master-us-east-1a Master t2.micro 1 1 us-east-1a master-us-east-1b Master t2.micro 1 1 us-east-1b master-us-east-1c Master t2.micro 1 1 us-east-1c nodes Node t2.micro 2 2 us-east-1a,us-east-1b,us-east-1cworker 组名为nodes。编辑该组kops edit ig nodes会打开$EDITOR指定的编辑器内容如下apiVersion: kops.k8s.io/v1alpha2 kind: InstanceGroup metadata: labels: kops.k8s.io/cluster: mycluster01.kopsclustertest.example.org name: nodes spec: image: 099720109477/ubuntu/images/hvm-ssd-gp3/ubuntu-noble-24.04-amd64-server-20260714 machineType: t2.micro maxSize: 2 minSize: 2 role: Node subnets: - us-east-1a - us-east-1b - us-east-1c将minSize与maxSize都改为3apiVersion: kops.k8s.io/v1alpha2 kind: InstanceGroup metadata: labels: kops.k8s.io/cluster: mycluster01.kopsclustertest.example.org name: nodes spec: image: 099720109477/ubuntu/images/hvm-ssd-gp3/ubuntu-noble-24.04-amd64-server-20260714 machineType: t2.micro maxSize: 3 minSize: 3 role: Node subnets: - us-east-1a - us-east-1b - us-east-1c保存后先用不带--yes的 dry-run 预览变更kops update cluster $NAME输出会明确列出将要修改的资源Will modify resources: AutoscalingGroup/nodes.mycluster01.kopsclustertest.example.org MinSize 2 - 3 MaxSize 2 - 3 Must specify --yes to apply changes确认无误后应用kops update cluster $NAME --yes等待数分钟后再次验证kops validate cluster输出示例INSTANCE GROUPS NAME ROLE MACHINETYPE MIN MAX SUBNETS master-us-east-1a Master t2.micro 1 1 us-east-1a master-us-east-1b Master t2.micro 1 1 us-east-1b master-us-east-1c Master t2.micro 1 1 us-east-1c nodes Node t2.micro 3 3 us-east-1a,us-east-1b,us-east-1c NODE STATUS NAME ROLE READY ip-172-20-103-68.ec2.internal node True ip-172-20-125-42.ec2.internal master True ip-172-20-33-58.ec2.internal master True ip-172-20-43-160.ec2.internal node True ip-172-20-64-116.ec2.internal master True ip-172-20-68-15.ec2.internal node True Your cluster mycluster01.kopsclustertest.example.org is ready集群已扩容到 3 个 worker 节点共 6 节点。扩容建议提前规划可用区如果希望未来能扩到区域内所有可用区请在kops create cluster时就把它们加入--zones参数例如--zonesus-east-1a,us-east-1b,us-east-1c,us-east-1d,us-east-1e这样后期扩容会更简单。master 数量取奇数与其他集群一样完全冗余的多 master 方案应从 3 开始取奇数。在 kOps 中master 的数量由--control-plane-zones传入的可用区数量决定源码层面该参数即要求奇数见 cmd/kops/create_cluster.go。变更链路扩容本质是修改 InstanceGroup 的minSize/maxSize再由kops update cluster同步到 AWS 的 Auto Scaling GroupASG。若涉及镜像、机型等会导致实例重建的变更可配合kops rolling-update cluster有序滚动替换kOps 的滚动更新会先处理 bastion 组再处理 master 组与 worker 组见 pkg/instancegroups/rollingupdate.go。删除集群并检查 DNS 子域不再需要集群时使用 kOps 命令删除kops delete cluster ${NAME} --yes片刻后会看到Deleted kubectl config for mycluster01.kopsclustertest.example.org Deleted cluster: mycluster01.kopsclustertest.example.org这两条输出分别对应源码中的两个环节kops delete cluster会清理云端资源并调用DeleteKubeConfigpkg/kubeconfig/kubecfg_builder.go从本地 kubeconfig 中删除该集群的 cluster、authinfo 与 context 条目随后打印 Deleted cluster: ...cmd/kops/delete_cluster.go。再次检查子域内的 DNS 记录aws route53 list-resource-record-sets \ --outputtable \ --hosted-zone-id aws route53 --outputjson list-hosted-zones | jq .HostedZones[] | select(.Namekopsclustertest.example.org.) | .Id | cut -d/ -f3|cut -d\ -f1输出只剩--------------------------------------------------------------------------------------- || ListResourceRecordSets || ------------------------------------------------------------------------------------- ||| ResourceRecordSets || ||---------------------------------------------------------------------------------| ||| Name | TTL | Type || ||---------------------------------------------------------------------------------| ||| kopsclustertest.example.org. | 172800 | NS || ||---------------------------------------------------------------------------------| |||| ResourceRecords ||| |||---------------------------------------------------------------------------------|| |||| Value ||| |||---------------------------------------------------------------------------------|| |||| ns-1383.example-aws-dns-44.org. ||| |||| ns-829.example-aws-dns-39.net. ||| |||| ns-346.example-aws-dns-43.com. ||| |||| ns-1973.example-aws-dns-54.co.uk. ||| |||---------------------------------------------------------------------------------|| ||| ResourceRecordSets || ||---------------------------------------------------------------------------------| ||| Name | TTL | Type || ||---------------------------------------------------------------------------------| ||| kopsclustertest.example.org. | 900 | SOA || ||---------------------------------------------------------------------------------| |||| ResourceRecords ||| |||---------------------------------------------------------------------------------|| |||| Value ||| |||---------------------------------------------------------------------------------|| |||| ns-1383.example-aws-dns-44.org. example-aws-dns-hostmaster.amazon.com. 1 7200 900 1209600 86400 ||| |||---------------------------------------------------------------------------------||所有 kOps 创建的资源记录都被一并删除只保留我们手动添加的 NS 委派记录以及托管区自带的 SOA 记录——这就是本文开头手工创建子域、手工加 NS 记录的价值删除集群后子域与父域的委派关系原样保留可以随时再建新集群复用。总结通过本文的完整实验你已掌握一条可复制的 kOps AWS 生产向工作流DNS 层用aws route53 create-hosted-zone创建子域、在父域添加 NS 委派记录并用dig验证环境层导出 AWS 凭证、创建 S3 state store bucket、设置NAME与KOPS_STATE_STORE创建层用--control-plane-zones奇数个可用区--node-count定义高可用拓扑kops update cluster --yes一键部署验证层dig检查api.*记录、kops validate cluster、kubectl get nodes、SSH 探测 master运维层kops edit ig nodes修改minSize/maxSize扩容kops delete cluster --yes回收资源并确认 DNS 记录仅剩 NS/SOA。这些行为都能在仓库源码中找到对应实现cmd/kops/create_cluster.go参数定义、upup/pkg/fi/cloudup/utils.go托管区最长匹配选择、upup/pkg/fi/cloudup/dns.goDNS 记录预创建与占位 IP、pkg/kubeconfig/kubecfg_builder.go删除集群时清理 kubeconfig。进一步延伸可参考仓库中的 docs/operations/high_availability.mdHA 架构、docs/operations/rolling-update.md滚动更新与 docs/addons.md集群插件安装。【免费下载链接】kopsKubernetes Operations (kOps) - Production Grade k8s Installation, Upgrades and Management项目地址: https://gitcode.com/gh_mirrors/kop/kops创作声明：本文部分内容由AI辅助生成（AIGC），仅供参考