K8s - 无法从另一个节点访问服务/集群 IP

Question

I am trying to access(from worker node) a pod(on worker node) via a service/ClusterIP using curl http://cluster_ip:port_no but it isn't working.

Here's some info on service

masternode@Master:/localdocker$ kubectl describe svc registry
Name:              registry
Namespace:         default
Labels:            io.kompose.service=registry
Annotations:       kompose.cmd: kompose convert -f docker-compose.yaml -o localregistry.yaml
                   kompose.version: 1.1.0 (36652f6)
Selector:          io.kompose.service=registry
Type:              ClusterIP
IP:                10.100.126.230
Port:              5000  5000/TCP
TargetPort:        5000/TCP
Endpoints:         192.168.171.74:5000
Session Affinity:  None
Events:            <none>```

here's some info on pod

masternode@Master:/localdocker$ kubectl describe pod registry-7ccd695dc7-69cx4
Name:         registry-7ccd695dc7-69cx4
Namespace:    default
Priority:     0
Node:         worker/10.0.1.5
Start Time:   Sun, 19 Jul 2020 06:09:14 +0000
Labels:       io.kompose.service=registry
              pod-template-hash=7ccd695dc7
Annotations:  cni.projectcalico.org/podIP: 192.168.171.74/32
              cni.projectcalico.org/podIPs: 192.168.171.74/32
Status:       Running
IP:           192.168.171.74
IPs:
  IP:           192.168.171.74
Controlled By:  ReplicaSet/registry-7ccd695dc7
Containers:
  registry:
    Container ID:   docker://ca372f12ef7a1a3cb23e7d6c58337f47848f91212f6c75af6bfd04bc48ea2f27
    Image:          registry:2
    Image ID:       docker-pullable://registry@sha256:8be26f81ffea54106bae012c6f349df70f4d5e7e2ec01b143c46e2c03b9e551d
    Port:           5000/TCP
    Host Port:      0/TCP
    State:          Running
      Started:      Sun, 19 Jul 2020 06:09:24 +0000
    Ready:          True
    Restart Count:  0
    Environment:
      REGISTRY_STORAGE_FILESYSTEM_ROOTDIRECTORY:  /data
    Mounts:
      /data from registry-claim0 (rw)
      /var/run/secrets/kubernetes.io/serviceaccount from default-token-fhf5k (ro)
Conditions:
  Type              Status
  Initialized       True
  Ready             True
  ContainersReady   True
  PodScheduled      True
Volumes:
  registry-claim0:
    Type:       PersistentVolumeClaim (a reference to a PersistentVolumeClaim in the same namespace)
    ClaimName:  registry-claim0
    ReadOnly:   false
  default-token-fhf5k:
    Type:        Secret (a volume populated by a Secret)
    SecretName:  default-token-fhf5k
    Optional:    false
QoS Class:       BestEffort
Node-Selectors:  <none>
Tolerations:     node.kubernetes.io/not-ready:NoExecute for 300s
                 node.kubernetes.io/unreachable:NoExecute for 300s
Events:
  Type    Reason     Age   From               Message
  ----    ------     ----  ----               -------
  Normal  Scheduled  13m   default-scheduler  Successfully assigned default/registry-7ccd695dc7-69cx4 to worker
  Normal  Pulling    13m   kubelet, worker    Pulling image "registry:2"
  Normal  Pulled     13m   kubelet, worker    Successfully pulled image "registry:2"
  Normal  Created    13m   kubelet, worker    Created container registry
  Normal  Started    13m   kubelet, worker    Started container registry

This is a practice exercise where I was able to do so(in their live environment) without any NodePorts.

Please let me know if any other info is required.

Answer 1

This is an expected behavior because ClusterIP type service is only accessible from within the kubernetes cluster ie from another pod etc.

If you want to access a pod via a service from outside the kubernetes cluster ie from the nodes itself then use NodePort type service.

Once you expose it via NodePort service you would be able to access it using curl http://<NODE-IP>:<NODE-PORT>

ClusterIP is created on service network of the cluster and nodes are in different network. By creating a NodePort service a Port is opened in each nodes network to forward traffic to ClusterIP . So in essence NodePort uses ClusterIP internally and is an higher level abstraction built on top of ClusterIP .