kubernetes ingress - 将 neo4j 端点暴露给内部网络

Question

I'm getting below error when trying to reach an internal neo4j endpoint from another cluster

neobolt.exceptions.ServiceUnavailable: Timed out trying to establish connection to ('xx.xxx.xx.xx', 7687)

When accessing this endpoint through the browser, it shows

not a WebSocket handshake request: missing upgrade

I work on GCP. This is what I've got:

• Cluster A with Composer running Airflow
• Cluster B with K8s where my application is deployed
• I know for sure both clusters can communicate

Cluster B has a neo4j ingress defined as follows:

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  annotations:
    field.cattle.io/publicEndpoints: '[{"addresses":["xx.xxx.xx.xx"],"port":443,"protocol":"HTTPS","serviceName":"dev:neo4j","ingressName":"dev:neo4j-dev-ing","hostname":"neo4j-dev.host_name","allNodes":false}]'
  generation: 6
  name: neo4j-dev-ing
spec:
  rules:
  - host: neo4j-dev.host_name
    http:
      paths:
      - backend:
          serviceName: neo4j
          servicePort: neo4j-dev-bolt
  tls:
  - hosts:
    - neo4j-dev.host_name
status:
  loadBalancer:
    ingress:
    - ip: xx.xxx.xx.xx

My neo4j service looks as follows:

apiVersion: v1
kind: Service
metadata:
  name: neo4j
spec:
  type: ClusterIP
  selector:
    app: neo4j
    component: neo4j
  ports:
    - port: 7473
      name: neo4j-dev-https
      targetPort: 7473
    - port: 7474
      name: neo4j-dev-http
      targetPort: 7474
    - port: 7687
      name: neo4j-dev-bolt
      targetPort: 7687
    - port: 1337
      name: neo4j-dev-shell
      targetPort: 1337

I've seen a few related questions but nothing concrete and a lot of contradictory information.

Any ideas if this can even work at all? Can someone with some insight into networks explain to me why this isn't working or put forward the concepts I need to research in order to get what's going on? Got stuck

Answer 1

It's a known issue with accessing neo4j outside of kubernetes and there are no straightforward workarounds

A complex workaround using multiple static IPs has been described here https://neo4j.com/labs/neo4j-helm/1.0.0/externalexposure/