本文为系列测试文章，拟基于自签名证书认证的etcd容器来构建coredns域名解析系统。
一、前置文章
构建后端为etcd的CoreDNS的容器集群（一）、生成自签名证书
构建后端为etcd的CoreDNS的容器集群（二）、下载最新的etcd容器镜像
构建后端为etcd的CoreDNS的容器集群（三）、etcd功能测试
构建后端为etcd的CoreDNS的容器集群（四）、etcd挂载私有自签名证书进行访问测试
构建后端为etcd的CoreDNS的容器集群（五）、coredns对接etcd测试
二、本次任务目标
coredns对接了etcd数据库，本次尝试编写一段脚本，通过fping命令检查远端服务器的存活状态，域名假定为www.test.com，ip假定为192.168.1.168，如果ip存活，则检查etcd数据库有无此记录，没有则添加；如IP不存活，则检查etcd数据库中有无此记录，有则删除。同时为了避免在网络异常时域名记录被完全清除，在操作前增加一个对本地网关的检查，如果fping本地网关不通的时候才扫行域名记录的增、删操作，如果网关fping异常则不做任何操作。
三、代码编写
本任务代码如下：
[root@localhost etcd]# cat auto_main_domain.sh
#!/bin/bash
##__author__='daigjianbing'
DOMAIN="www.test.com"
IP="192.168.80.135"
GATEWAY="192.168.80.135"
ETCD_KEY="/coredns/com/test/www"
ETCD_VALUE='{"host":"192.168.80.135","ttl":10}'
ETCD_ENDPOINT="https://etcd-1:2379" # 根据实际情况调整etcd的端点
ETCD_CERT="/opt/etcd/ssl/etcd.pem" # 如果etcd使用了TLS证书，请指定证书路径，否则留空
ETCD_KEY_FILE="/opt/etcd/ssl/etcd-key.pem" # 如果etcd使用了TLS密钥文件，请指定密钥文件路径，否则留空
ETCD_CACERT="/opt/etcd/ssl/ca.pem" # 如果etcd使用了CA证书，请指定CA证书路径，否则留空
# 检查本地网关存活状态
if ! fping -c 1 $GATEWAY &> /dev/null; then
echo "Gateway $GATEWAY is not reachable. Skipping further operations."
exit 1
else
echo "Gateway $GATEWAY is reachable."
fi
# 检查IP存活状态
if fping -c 1 $IP &> /dev/null; then
echo "IP $IP is alive."
# 检查etcd中是否有记录
itemcheck=`/opt/etcd/etcdctl --endpoints=$ETCD_ENDPOINT --cert=$ETCD_CERT --key=$ETCD_KEY_FILE --cacert=$ETCD_CACERT get $ETCD_KEY | grep $ETCD_KEY |wc -l`
if [ ${itemcheck} -eq 0 ]; then
echo "Record for $DOMAIN ($IP) does not exist in etcd. Adding..."
/opt/etcd/etcdctl --endpoints=$ETCD_ENDPOINT --cert=$ETCD_CERT --key=$ETCD_KEY_FILE --cacert=$ETCD_CACERT put $ETCD_KEY $ETCD_VALUE
if [ $? -eq 0 ]; then
echo "Record added successfully."
else
echo "Failed to add record."
fi
else
echo "Record for $DOMAIN ($IP) already exists in etcd."
fi
else
echo "IP $IP is not alive."
# 检查etcd中是否有记录
itemcheck=`/opt/etcd/etcdctl --endpoints=$ETCD_ENDPOINT --cert=$ETCD_CERT --key=$ETCD_KEY_FILE --cacert=$ETCD_CACERT get $ETCD_KEY | grep $ETCD_KEY |wc -l`
if [ $itemcheck -ne 0 ]; then
echo "Record for $DOMAIN ($IP) exists in etcd. Deleting..."
/opt/etcd/etcdctl --endpoints=$ETCD_ENDPOINT --cert=$ETCD_CERT --key=$ETCD_KEY_FILE --cacert=$ETCD_CACERT del $ETCD_KEY
if [ $? -eq 0 ]; then
echo "Record deleted successfully."
else
echo "Failed to delete record."
fi
else
echo "Record for $DOMAIN ($IP) does not exist in etcd."
fi
fi
[root@localhost etcd]# 四、IP正常测试
1、清空域名解析数据库记录
[root@localhost etcd]# ./etcdctl --endpoints=https://etcd-1:2379 --cacert ssl/ca.pem --cert ssl/etcd.pem --key ssl/etcd-key.pem del --prefix "/"
3
[root@localhost etcd]# ./etcdctl --endpoints=https://etcd-1:2379 --cacert ssl/ca.pem --cert ssl/etcd.pem --key ssl/etcd-key.pem get --prefix "/"
[root@localhost etcd]# 可以看到当前已无域名记录。
2、运行程序
[root@localhost etcd]# sh auto_main_domain.sh
Gateway 192.168.80.135 is reachable.
IP 192.168.80.135 is alive.
Record for www.test.com (192.168.80.135) does not exist in etcd. Adding...
OK
Record added successfully.
[root@localhost etcd]# ./etcdctl --endpoints=https://etcd-1:2379 --cacert ssl/ca.pem --cert ssl/etcd.pem --key ssl/etcd-key.pem get --prefix "/"
/coredns/com/test/www
{"host":"192.168.80.135","ttl":10}3、验证解析
[root@localhost etcd]# nslookup www.test.com 127.0.0.1
Server: 127.0.0.1
Address: 127.0.0.1#53
Name: www.test.com
Address: 192.168.80.135
** server can't find www.test.com: NXDOMAIN
[root@localhost etcd]# 可以看到域名解析正常
四、异常测试
1、测试准备
本次异常测试因测试地址就是本机IP，无法设置不能访问，因此采用仅修改域名对应检查IP的方式来进行，修改原脚本中的IP值为当前无法访问的ip
2、实际测试
[root@localhost etcd]# sh auto_main_domain.sh
Gateway 192.168.80.135 is reachable.
IP 192.168.80.136 is not alive.
Record for www.test.com (192.168.80.136) exists in etcd. Deleting...
1
Record deleted successfully.
[root@localhost etcd]# ./etcdctl --endpoints=https://etcd-1:2379 --cacert ssl/ca.pem --cert ssl/etcd.pem --key ssl/etcd-key.pem get --prefix "/"
[root@localhost etcd]#
[root@localhost etcd]# nslookup www.test.com 127.0.0.1
Server: 127.0.0.1
Address: 127.0.0.1#53
** server can't find www.test.com: NXDOMAIN
[root@localhost etcd]# 可以看到，相关域名记录已自动删除，解析已无结果。
五、总结
通过上述代码，可以根据后端服务器IP的存活情况对域名进行动态管理，结合单域名多IP，可以实现域名IP智能化分发。
