Kube.netes Docker for Nginx 和 php-fpm 连接错误

Question

I have a docker deployment using Kube.netes. Out of the blue on a running AWS K8 "pod", I have started getting the following error:

connect() failed (111: Connection refused) while connecting to upstream, client: X.0.XX.XX, server: _, request: "GET /api/endpoint& HTTP/1.1", upstream: "fastcgi://127.0.0.1:9000", host: "domain.com"

It seems like it has something to do with the nginx configuration with php-fpm rather than the Dockerfile or the deployment. What fixes this error immediately is restarting the Kube.netes pods (whichever pod happens to give this error).

I suspect that if php-fpm happens to fail inside a given pod, that's when it stops listening on port 9000? I ssh'ed into the pod and did a.netstat to verify this and it shows 9000 being alive.

For reference, here is the Dockerfile:

FROM trafex/alpine-nginx-php7:1.9.0

USER root

RUN apk add --no-cache file
RUN apk --update add imagemagick
RUN apk --no-cache add php7-redis php7-simplexml php7-iconv php7-imagick
RUN curl -sS https://getcomposer.org/installer | php -- --install-dir=/usr/local/bin --filename=composer

ARG gh_token

ADD nginx-host.conf /etc/nginx/nginx.conf

RUN rm -Rf /var/www/html/
COPY . /var/www/html/

RUN composer config --global github-oauth.github.com ${gh_token}

RUN cd /var/www/html/ \
   && composer update
   
RUN composer config --global github-oauth.github.com "none"

USER nobody

And here is the nginx.conf:

worker_processes auto;
error_log stderr warn;
pid /run/nginx.pid;

events {
    worker_connections 1024;
}

http {
    include mime.types;
    default_type application/octet-stream;

    # Define custom log format to include reponse times
    log_format main_timed '$remote_addr - $remote_user [$time_local] "$request" '
                          '$status $body_bytes_sent "$http_referer" '
                          '"$http_user_agent" "$http_x_forwarded_for" '
                          '$request_time $upstream_response_time $pipe $upstream_cache_status';

    access_log /dev/stdout main_timed;
    error_log /dev/stderr notice;

    keepalive_timeout 65;

    # Write temporary files to /tmp so they can be created as a non-privileged user
    client_body_temp_path /tmp/client_temp;
    proxy_temp_path /tmp/proxy_temp_path;
    fastcgi_temp_path /tmp/fastcgi_temp;
    uwsgi_temp_path /tmp/uwsgi_temp;
    scgi_temp_path /tmp/scgi_temp;
    
    underscores_in_headers on;

    map $request_uri $version {
        ~(?<captured_topdir>^/[a-zA-Z0-9]+[/]) $captured_topdir;
    }

    # Default server definition
    server {
        listen [::]:8080 default_server;
        listen 8080 default_server;
        server_name _;

        sendfile off;
    
        client_max_body_size 6M;
    
        root /var/www/html;
        index index.php index.html;

        # Redirect server error pages to the static page /50x.html
        error_page 500 502 503 504 /50x.html;
        location = /50x.html {
            root /var/lib/nginx/html;
        }

        location / {
        rewrite ^/(v[0-9]+|stage|partner)?/(.*)$ /$2 last;
        set $new_uri $uri;
        try_files $uri $uri/ /index.php?$query_string;
    }

        # Pass the PHP scripts to PHP-FPM listening on 127.0.0.1:9000
        location ~ \.php$ {
            try_files $uri =404;
            fastcgi_split_path_info ^(.+\.php)(/.+)$;
            fastcgi_pass 127.0.0.1:9000;
            fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
            fastcgi_param SCRIPT_NAME $fastcgi_script_name;
            fastcgi_param PATH_INFO $fastcgi_path_info;
            fastcgi_param SCRIPT_NAME $fastcgi_script_name;
            fastcgi_param API_VERSION $version;
            fastcgi_index index.php;
            include fastcgi_params;
            fastcgi_param REQUEST_URI $new_uri;
        }

        location ~* \.(jpg|jpeg|gif|png|css|js|ico|xml)$ {
            expires 5d;
        }

        # Deny access to . files, for security
        location ~ /\. {
            log_not_found off;
            deny all;
        }

        # Allow fpm ping and status from localhost
        location ~ ^/(fpm-status|fpm-ping)$ {
            access_log off;
            allow 127.0.0.1;
            deny all;
            fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
            fastcgi_param SCRIPT_NAME $fastcgi_script_name;
            include fastcgi_params;
            fastcgi_pass 127.0.0.1:9000;
        }
    }
    
    gzip on;
    gzip_proxied any;
    gzip_types text/plain application/xml text/css text/js text/xml application/x-javascript text/javascript application/json application/xml+rss;
    gzip_vary on;
    gzip_disable "msie6";
    
    # Include other server configs
    include /etc/nginx/conf.d/*.conf;
}

Any idea on the nginx config where this error could be surfacing from? It has happened completely out of the blue a few times now.

Answer 1

Looks like Nginx is getting the connection refuse from the stream.

i would suggest trying with simple Nginx config, store it inside the Kube.netes configmap

apiVersion: v1
kind: ConfigMap
metadata:
  name: nginxthroughpass
  namespace: development
data:
  default.conf: |-
    server {
            listen 80 default_server;
            root /var/www/html;
            server_name  _;
            index index.php;
            location / {
                try_files $uri $uri/ /index.php?$args;
            }
            location ~ \.php$ {
                fastcgi_split_path_info ^(.+\.php)(/.+)$;
                fastcgi_pass 127.0.0.1:9000;
                fastcgi_index index.php;
                include fastcgi_params;
                fastcgi_param   PATH_INFO       $fastcgi_path_info;
                fastcgi_param   SCRIPT_FILENAME $document_root$fastcgi_script_name;
            }
        }

Injecting the Nginx configmap along with the PHP fpm deployment

apiVersion: extensions/v1
kind: Deployment
metadata:
  labels:
    app: wordpress-site
  name: wordpress-site
  namespace: development
spec:
  progressDeadlineSeconds: 600
  replicas: 1
  revisionHistoryLimit: 10
  selector:
    matchLabels:
      app: wordpress-site
      tier: frontend
  strategy:
    rollingUpdate:
      maxSurge: 25%
      maxUnavailable: 25%
    type: RollingUpdate
  template:
    metadata:
      creationTimestamp: null
      labels:
        app: wordpress-site
        tier: frontend
    spec:
      volumes:
      - configMap:
          defaultMode: 256
          name: nginxthroughpass
          optional: false
        name: nginxconf
      - name: shared-files
        emptyDir: {}
      containers:
        - name: app
          image: <REPLACE WITH DOCKER PHP-FPM IMAGE URL>
          imagePullPolicy : IfNotPresent
          volumeMounts:
            - name: shared-files
              mountPath: /var/www/html
          envFrom:
            - configMapRef:
                name: wordpress-configmap
        - name: nginx
          image: nginx
          imagePullPolicy : IfNotPresent
          volumeMounts:
          - name: shared-files
            mountPath: /var/www/html
          - mountPath: /etc/nginx/conf.d
            name: nginxconf
            readOnly: true

instead of WordPress image replace your php-fpm image and test.

You check this using Php-fpm WordPress with the Nginx pod and storing the config into the config map.

https://github.com/harsh4870/Kube.netes-wordpress-php-fpm-nginx