kubernetes - Kubernetes无法访问Pod

Question

我有一个主节点和工作节点，并且都已启动并正在运行，我在k8集群中部署了一个 Angular 应用程序。当我检查我的pod日志时，所有东西都在正常工作，没有任何错误。

我正在尝试使用主服务器IP和工作服务器IP地址以及后面的节点端口号(如下所示)在浏览器中访问应用程序，并出现无法连接等错误。

http://10.0.0.1:32394/

Name:         frontend-app-6848bc9666-9ggz7
Namespace:    pre-release
Priority:     0
Node:         SBT-poc-worker2/10.0.0.5
Start Time:   Fri, 17 Jan 2020 05:04:10 +0000
Labels:       app=frontend-app
              pod-template-hash=6848bc9666
Annotations:  <none>
Status:       Running
IP:           10.32.0.3
IPs:
  IP:           10.32.0.3
Controlled By:  ReplicaSet/frontend-app-6848bc9666
Containers:
  frontend-app:
    Container ID:   docker://292199347e391c9feecd667e1668f32931f1fd7c670514eb1e05e4a37b8109ad
    Image:          frontend-app:future-master-fix-7ba35fbe
    Image ID:       docker://sha256:0099587db89de9ef999a7d1f087d4781e73c491b17e89392e92b08d2f935ad27
    Port:           8080/TCP
    Host Port:      0/TCP
    State:          Running
      Started:      Fri, 17 Jan 2020 05:04:15 +0000
    Ready:          True
    Restart Count:  0
    Limits:
      cpu:     250m
      memory:  256Mi
    Requests:
      cpu:        100m
      memory:     128Mi
    Environment:  <none>
    Mounts:
      /var/run/secrets/kubernetes.io/serviceaccount from default-token-r67p7 (ro)
Conditions:
  Type              Status
  Initialized       True 
  Ready             True 
  ContainersReady   True 
  PodScheduled      True 
Volumes:
  default-token-r67p7:
    Type:        Secret (a volume populated by a Secret)
    SecretName:  default-token-r67p7
    Optional:    false
QoS Class:       Burstable
Node-Selectors:  <none>
Tolerations:     node.kubernetes.io/not-ready:NoExecute for 300s
                 node.kubernetes.io/unreachable:NoExecute for 300s
Events:
  Type    Reason     Age    From                       Message
  ----    ------     ----   ----                       -------
  Normal  Scheduled  5m44s  default-scheduler          Successfully assigned pre-release/frontend-app-6848bc9666-9ggz7 to SBT-poc-worker2
  Normal  Pulled     5m41s  kubelet, SBT-poc-worker2  Container image "frontend-app:future-master-fix-7ba35fbe" already present on machine
  Normal  Created    5m39s  kubelet, SBT-poc-worker2  Created container frontend-app
  Normal  Started    5m39s  kubelet, SBT-poc-worker2  Started container frontend-app

root@jenkins-linux-vm:/home/SBT-admin# kubectl get pods -n pre-release
NAME                            READY   STATUS    RESTARTS   AGE
frontend-app-6848bc9666-9ggz7   1/1     Running   0          7m26s

root@jenkins-linux-vm:/home/SBT-admin# kubectl get services -n pre-release
NAME           TYPE       CLUSTER-IP   EXTERNAL-IP   PORT(S)          AGE
frontend-app   NodePort   10.96.6.77   <none>        8080:32394/TCP   7m36s

root@jenkins-linux-vm:/home/SBT-admin# kubectl get deployment -n pre-release
NAME           READY   UP-TO-DATE   AVAILABLE   AGE
frontend-app   1/1     1            1           11m

root@jenkins-linux-vm:/home/SBT-admin# kubectl get -o yaml -n pre-release svc frontend-app
apiVersion: v1
kind: Service
metadata:
  annotations:
    kubectl.kubernetes.io/last-applied-configuration: |
      {"apiVersion":"v1","kind":"Service","metadata":{"annotations":{},"labels":{"name":"frontend-app"},"name":"frontend-app","namespace":"pre-release"},"spec":{"ports":[{"port":8080,"targetPort":8080}],"selector":{"name":"frontend-app"},"type":"NodePort"}}
  creationTimestamp: "2020-01-17T05:04:10Z"
  labels:
    name: frontend-app
  name: frontend-app
  namespace: pre-release
  resourceVersion: "1972713"
  selfLink: /api/v1/namespaces/pre-release/services/frontend-app
  uid: 91b87f9e-d723-498c-af05-5969645a82ee
spec:
  clusterIP: 10.96.6.77
  externalTrafficPolicy: Cluster
  ports:
  - nodePort: 32394
    port: 8080
    protocol: TCP
    targetPort: 8080
  selector:
    name: frontend-app
  sessionAffinity: None
  type: NodePort
status:
  loadBalancer: {}

root@jenkins-linux-vm:/home/SBT-admin# kubectl get pods --selector="app=frontend-app" --output=wide
NAME                            READY   STATUS    RESTARTS   AGE   IP          NODE               NOMINATED NODE   READINESS GATES
frontend-app-7c7cf68f9c-n9tct   1/1     Running   0          58m   10.32.0.5   SBT-poc-worker2   <none>           <none>

root@jenkins-linux-vm:/home/SBT-admin# kubectl get pods
NAME                            READY   STATUS    RESTARTS   AGE
frontend-app-7c7cf68f9c-n9tct   1/1     Running   0          58m

root@jenkins-linux-vm:/home/SBT-admin# kubectl get svc
NAME           TYPE       CLUSTER-IP     EXTERNAL-IP   PORT(S)          AGE
frontend-app   NodePort   10.96.21.202   <none>        8080:31098/TCP   59m

root@jenkins-linux-vm:/home/SBT-admin# kubectl get deployment
NAME           READY   UP-TO-DATE   AVAILABLE   AGE
frontend-app   1/1     1            1           59m

你能请人帮我解决这个问题吗？

Answer 1

您应该尝试确定

There are no rules blocking the default node-port range (i.e from port 30000 - to port 32767) on security rules or firewall on cluster network.

例如，验证您是否在群集网络上打开了以下 安全规则，以使节点端口范围在浏览器中工作。

Ingress IPv4    TCP 30000 - 32767   0.0.0.0/0

一旦确认您没有安全组规则问题。我将采用以下方法进行调试，并发现节点级别的端口可达性出了什么问题。执行基本测试，并检查我是否可以通过节点端口在浏览器上安装和访问Nginx Web服务器:

脚步:

使用以下nginx.yaml部署NGINX部署

apiVersion: apps/v1
kind: Deployment
metadata:
  name: my-nginx
spec:
  selector:
    matchLabels:
      run: my-nginx
  replicas: 1
  template:
    metadata:
      labels:
        run: my-nginx
    spec:
      containers:
      - name: my-nginx
        image: nginx
        ports:
        - containerPort: 80

验证部署已启动并正在运行

$ kubectl apply -f nginx.yaml

$ kubectl get all
NAME                            READY   STATUS        RESTARTS   AGE
pod/my-nginx-75897978cd-ptqv9   1/1     Running       0          32s

NAME                 TYPE        CLUSTER-IP   EXTERNAL-IP   PORT(S)   AGE
service/kubernetes   ClusterIP   10.96.0.1    <none>        443/TCP   4d11h

NAME                       READY   UP-TO-DATE   AVAILABLE   AGE
deployment.apps/my-nginx   1/1     1            1           33s

NAME                                  DESIRED   CURRENT   READY   AGE
replicaset.apps/my-nginx-75897978cd   1         1         1       33s

现在 创建服务以使用以下示例公开nginx部署

apiVersion: v1
kind: Service
metadata:
  name: my-nginx
  labels:
    run: my-nginx
spec:
  type: NodePort
  ports:
  - port: 8080
    targetPort: 80
    protocol: TCP
    name: http
  selector:
    run: my-nginx

验证服务已创建，并且 标识分配给的节点端口(因为我们在service.yaml中未提供任何固定端口(例如，下面的节点端口为32502))

$ kubectl apply -f service.yaml

$ kubectl get svc
NAME         TYPE        CLUSTER-IP      EXTERNAL-IP   PORT(S)          AGE
kubernetes   ClusterIP   10.96.0.1       <none>        443/TCP          4d11h
my-nginx     NodePort    10.96.174.234   <none>        8080:32502/TCP   12s

除了nodeport 之外，还要标识主节点的ip，即下面的131.112.113.101

$ kubectl get nodes -o wide
NAME           STATUS   ROLES    AGE     VERSION   INTERNAL-IP       EXTERNAL-IP   OS-IMAGE             KERNEL-VERSION      CONTAINER-RUNTIME
master-1   Ready    master   4d11h   v1.17.0   131.112.113.101   <none>        Ubuntu 16.04.6 LTS   4.4.0-169-generic   docker://18.6.2
node-1     Ready    <none>   4d11h   v1.17.0   131.112.113.102   <none>        Ubuntu 16.04.6 LTS   4.4.0-169-generic   docker://18.6.2
node-2     Ready    <none>   4d11h   v1.17.0   131.112.113.103   <none>        Ubuntu 16.04.6 LTS   4.4.0-169-generic   docker://18.6.2

现在，如果您尝试在浏览器中使用具有nodeport值(例如 <masternode>:<nodeport>(即131.112.113.101:32502)的masterport)的masternode的IP访问nginx应用程序，则结果应类似于以下内容



请注意，它用于nginx.yaml上的容器端口和service.yaml上的targetPort(即80)，您应该能够更好地为您的前端应用程序弄清楚。希望这可以帮助您在节点/群集级别了解问题。