问题描述：
我有一个收割机 HCI 集群（RKE2），其中 pod 无法解析互联网域的正确 IP 地址。
kubectl run debug --image=busybox -i --tty --rm -- sh
/ # ping serverfault.com
PING serverfault.com (<redacted IP address>): 56 data bytes
64 bytes from <redacted IP address>: seq=0 ttl=63 time=0.362 ms
64 bytes from <redacted IP address>: seq=1 ttl=63 time=0.312 ms
64 bytes from <redacted IP address>: seq=2 ttl=63 time=0.319 ms
64 bytes from <redacted IP address>: seq=3 ttl=63 time=0.449 ms
64 bytes from <redacted IP address>: seq=4 ttl=63 time=0.317 ms
64 bytes from <redacted IP address>: seq=5 ttl=63 time=0.363 ms
64 bytes from <redacted IP address>: seq=6 ttl=63 time=0.296 ms
64 bytes from <redacted IP address>: seq=7 ttl=63 time=0.361 ms
^C
--- serverfault.com ping statistics ---
8 packets transmitted, 8 packets received, 0% packet loss
round-trip min/avg/max = 0.296/0.347/0.449 ms
<redacted IP address>在这种情况下，恰好是集群所在网络的公共 IP 地址（而不是其中一个serverfault.comIP 地址）。
但是在同一个容器内，nslookup确实列出了正确的 IP 地址：
/ # nslookup serverfault.com
Server: 10.53.0.10
Address: 10.53.0.10:53
Non-authoritative answer:
Name: serverfault.com
Address: 104.18.23.101
Name: serverfault.com
Address: 104.18.22.101
Non-authoritative answer:
这在主机节点上无法重现：
# ping serverfault.com
PING serverfault.com (104.18.23.101) 56(84) bytes of data.
64 bytes from 104.18.23.101 (104.18.23.101): icmp_seq=1 ttl=57 time=1.27 ms
64 bytes from 104.18.23.101 (104.18.23.101): icmp_seq=2 ttl=57 time=1.30 ms
64 bytes from 104.18.23.101 (104.18.23.101): icmp_seq=3 ttl=57 time=1.33 ms
64 bytes from 104.18.23.101 (104.18.23.101): icmp_seq=4 ttl=57 time=1.29 ms
64 bytes from 104.18.23.101 (104.18.23.101): icmp_seq=5 ttl=57 time=1.23 ms
64 bytes from 104.18.23.101 (104.18.23.101): icmp_seq=6 ttl=57 time=1.28 ms
^C
--- serverfault.com ping statistics ---
6 packets transmitted, 6 received, 0% packet loss, time 5006ms
rtt min/avg/max/mdev = 1.231/1.284/1.333/0.030 ms
集群本身是全新安装的Harvester HCI v1.2.0安装后无需进行其他配置更改。
我正在寻找有关如何解决此问题并找出其解析错误 IP 地址的原因的更多提示。
语境：
/etc/resolve.conf在主机上：
### /etc/resolv.conf is a symlink to /var/run/netconfig/resolv.conf
### autogenerated by netconfig!
search harvester.<redacted domain> 1
nameserver 10.10.0.1
/etc/resolve.conf在 pod 容器上：
search default.svc.cluster.local svc.cluster.local cluster.local harvester.<redacted domain>
nameserver 10.53.0.10
options ndots:5
/etc/nsswitch.conf在主机上：
#
# /etc/nsswitch.conf
#
passwd: compat
group: compat
shadow: compat
# Allow initgroups to default to the setting for group.
# initgroups: compat
hosts: files mdns_minimal [NOTFOUND=return] dns
networks: files dns
aliases: files usrfiles
ethers: files usrfiles
gshadow: files usrfiles
netgroup: files nis
protocols: files usrfiles
publickey: files
rpc: files usrfiles
services: files usrfiles
automount: files nis
bootparams: files
netmasks: files
/etc/nsswitch.conf在 pod 容器上：
# /etc/nsswitch.conf
#
# Example configuration of GNU Name Service Switch functionality.
# If you have the `glibc-doc-reference' and `info' packages installed, try:
# `info libc "Name Service Switch"' for information about this file.
passwd: files
group: files
shadow: files
gshadow: files
hosts: files dns
networks: files
protocols: db files
services: db files
ethers: db files
rpc: db files
netgroup: nis
/etc/hosts两种情况下均不包含额外/可疑的条目。
答案1
我发现问题出在以下ndots选项上resolve.conf：
options ndots:5
此选项意味着仅当主机名包含 5 个或更多点时，它才会附加到搜索域。
我怀疑这个选项是需要的，因为 kubernetes 内部使用了很多带有多个点的主机名。
但是serverfault.com例如只有一个点，所以我被附加到本地域，harvester.<redacted domain>使其成为serverfault.com.harvester.<redacted domain>。我们碰巧*在该域上有一个通配符（）记录，指向网络的公共 IP 地址。因此serverfault.com.harvester.<redacted domain>将使用通配符记录进行解析，解释了该行为。
为了解决这个问题，我们暂时删除了本地域的 DHCP 记录。因此，配置search将result.conf不再包含它，因此互联网域将不再附加到本地域。
从长远来看，我们计划删除通配符域名。