configmap 端口转发在 kubernetes 多容器 pod 中不起作用

Question

Below is configMap file for the pod containing multiple container. Port number 80 is exposed to external world and it will then redirect to port 5000 of another container running in the pod.

apiVersion: v1
kind: ConfigMap
metadata:
  name: mc3-nginx-conf
data:
  nginx.conf: |-
    user  nginx;
    worker_processes  1;

    error_log  /var/log/nginx/error.log warn;
    pid        /var/run/nginx.pid;

    events {
        worker_connections  1024;
    }

    http {
        include       /etc/nginx/mime.types;
        default_type  application/octet-stream;

        sendfile        on;
        keepalive_timeout  65;

        upstream webapp {
            server 127.0.0.1:5000;
        }

        server {
            listen 80;

            location / {
                proxy_pass         http://webapp;
                proxy_redirect     off;
            }
        }
    }


$kubectl apply -f confimap.yaml

The pod configuration:

apiVersion: v1
kind: Pod
metadata:
  name: mc3
  labels:
    app: mc3
spec:
  containers:
  - name: webapp
    image: training/webapp
  - name: nginx
    image: nginx:alpine
    ports:
    - containerPort: 80
    volumeMounts:
    - name: nginx-proxy-config
      mountPath: /etc/nginx/nginx.conf
      subPath: nginx.conf
  volumes:
  - name: nginx-proxy-config
    configMap:
      name: mc3-nginx-conf

Step 3. Expose the Pod using the NodePort service:

$ kubectl expose pod mc3 --type=NodePort --port=80
service "mc3" exposed

Step 4. Identify port on the node that is forwarded to the Pod:

$ kubectl describe service mc3

Name:                     mc3
Namespace:                default
Labels:                   app=mc3
Annotations:              <none>
Selector:                 app=mc3
Type:                     NodePort
IP:                       100.68.152.108
Port:                     <unset>  80/TCP
TargetPort:               80/TCP
NodePort:                 <unset>  32636/TCP
Endpoints:                100.96.2.3:80
Session Affinity:         None
External Traffic Policy:  Cluster
Events:                   <none>

But i am unable to perform curl

$ curl 100.96.2.3:80

$ curl http://100.96.2.3:80

$ curl http://100.96.2.3:32636

So,i want to know why this redirection doesn't work.

Source: https://www.mirantis.co.jp/blog/multi-container-pods-and-container-communication-in-kubernetes/

Its written on the page that we can access using url

http://myhost :

Now,what is myhost here? and,i understood that port exposed is 32636

But,i am not able to access from browser or curl /wget command.

Answer 1

Try:

Kubectl get nodes -o wide
NAME     STATUS   ROLES    AGE   VERSION   INTERNAL-IP   EXTERNAL-IP   OS-IMAGE             KERNEL-VERSION      CONTAINER-RUNTIME   
master   Ready    master   30m   v1.14.0   {{Node_IP}}   <none>        Ubuntu 16.04.6 LTS   4.4.0-157-generic   docker://18.9.7

Use one of the ips of your nodes like this:

curl NODE_IP:32636

Answer 2

From what I see you're having trouble connecting with your application over the NodePort .

In the comments you posted: I am executing on google cloud shell , so I assume you are running on GKE.

You also posted in comments:

XXXXX@cloudshell:~ (pubsub-quickstart-XXXXX)$ curl -v 10.59.242.245:31357 * Rebuilt URL to: 10.59.242.245:31357 * Trying 10.59.242.245... * TCP_NODELAY set * connect to 10.59.242.245 port 31357 failed: Connection timed out * Failed to connect to 10.59.242.245 port 31357: Connection timed out * Closing connection 0 curl: (7)`

So I see you are trying to curl private ip address of your cluster node from cloudshell and that will not work.

It is impossible to connect to a node over private addresses from cloudshell as these instances are in different networks (separated from each other).

To connect to your application from external network you need to use EXTERNAL-IP 's of your nodes which can be found running kubectl get no -owide

Second thing (very important) is to create a firewall rule to allow ingress traffic to this port eg using gcloud cli:

gcloud compute firewall-rules create test-node-port --allow tcp:[NODE_PORT]

More information on exposing application on GKE can be found in GKE documentation here .

Let me know if that helped.