使用 kubernetes url 从另一个 pod 访问 pod

Question

I have two pods created with deployment and service. my problem is as follows the pod "my-gateway" accesses the url "adm-contact" of "http://127.0.0.1:3000/adm-contact" which accesses another pod called "my-adm-contact" as can i make this work? I tried the following command: kubectl port-forward my-gateway-5b85498f7d-5rwnn 3000:3000 8879:8879 but it gives this error:

E0526 21:56:34.024296   12428 portforward.go:400] an error occurred forwarding 3000 -> 3000: error forwarding port 3000 to pod 2d5811c20c3762c6c249a991babb71a107c5dd6b080c3c6d61b4a275b5747815, uid : exit status 1: 2022/05/27 00:56:35 socat[2494] E connect(16, AF=2 127.0.0.1:3000, 16): Connection refused

Remembering that the images created with dockerfile are with EXPOSE 3000 8879 follow my yamls:

Deployment my-adm-contact :

apiVersion: apps/v1
kind: Deployment
metadata:
  name: my-adm-contact
  labels:
    app: my-adm-contact
spec:
  selector:
    matchLabels:
      run: my-adm-contact
  template:
    metadata:
      labels:
        run: my-adm-contact
    spec:
      containers:
      - name: my-adm-contact
        image: my-contact-adm
        imagePullPolicy: Never
        ports:
          - containerPort: 8879
            hostPort: 8879
            name: admcontact8879
        readinessProbe:
          httpGet:
            path: /adm-contact
            port: 8879
          initialDelaySeconds: 30
          periodSeconds: 10
          failureThreshold: 6

Sevice my-adm-contact :

apiVersion: v1
kind: Service
metadata:
  name: my-adm-contact
  labels:
    run: my-adm-contact
spec:
  selector:
    app: my-adm-contact
  ports:
  - name: 8879-my-adm-contact
    port: 8879
    protocol: TCP
    targetPort: 8879
  type: LoadBalancer
status:
  loadBalancer: {}

Deployment my-gateway :

apiVersion: apps/v1
kind: Deployment
metadata:
  name: my-gateway
  labels:
    app: my-gateway
spec:
  selector:
    matchLabels:
      run: my-gateway
  template:
    metadata:
      labels:
        run: my-gateway
    spec:
      containers:
      - name: my-gateway
        image: api-gateway
        imagePullPolicy: Never
        ports:
          - containerPort: 3000
            hostPort: 3000
            name: home
          #- containerPort: 8879
           # hostPort: 8879
          #  name: adm
        readinessProbe:
          httpGet:
            path: /adm-contact
            port: 8879
            path: /
            port: 3000
          initialDelaySeconds: 30
          periodSeconds: 10
          failureThreshold: 6

Service my-gateway :

apiVersion: v1
kind: Service
metadata:
  name: my-gateway
  labels:
    run: my-gateway
spec:
  selector:
    app: my-gateway
  ports:
  - name: 3000-my-gateway
    port: 3000
    protocol: TCP
    targetPort: 3000
    
  - name: 8879-my-gateway
    port: 8879
    protocol: TCP
    targetPort: 8879
  type: LoadBalancer
status:
  loadBalancer: {}

Answer 1

What k8s-cluster environment are you running this in? I ask because the service.type of LoadBalancer is a special kind: at pod initialisation your cloud provider's admission controller will spot this and add in a loadbalancer config See https://kubernetes.io/docs/concepts/services-networking/service/#loadbalancer

If you're not deploying this in a suitable cloud environment, your services won't do anything.

I had a quick look at your SO profile and - sorry if this is presumptious, I don't mean to be - it looks like you're relatively new to k8s. You shouldn't need to do any port-forwarding/kubectl proxying, and this should be a lot simpler than you might think.

When you create a service k8s will 'create' a DNS entry for you which points to the pod(s) specified by your selector.

I think you're trying to reach a setup where code running in my-gateway pod can connect to http://adm-contact on port 3000 and reach a listening service on the adm-contact pod. Is that correct?

If so, the outline solution is to expose tcp/3000 in the adm-contact pod, and create a service called adm-contact that has a selector for adm-contact pod.

This is a sample manifest I've just created which runs nginx and then creates a service for it, allowing any pod on the cluster to connect to it eg curl http://nginx-service.default.svc In this example I'm exposing port 80 because I didn't want to have to modify the nginx config, but the principle is the same.

apiVersion: v1
kind: Pod
metadata:
  labels:
    app: nginx
  name: nginx
spec:
  containers:
  - image: nginx
    imagePullPolicy: Always
    name: nginx
    ports:
    - containerPort: 80
      protocol: TCP
---
apiVersion: v1
kind: Service
metadata:
  name: nginx-service
spec:
  ports:
  - port: 80
    protocol: TCP
    targetPort: 80
  selector:
    app: nginx
  type: ClusterIP

The k8s docs on Services are pretty helpful if you want more https://kubernetes.io/docs/concepts/services-networking/connect-applications-service/

Answer 2

a service can be reached on it's own name from pods in it's namespace:

so a service foo in namespace bar can be reached at http://foo from a pod in namespace bar

from other namespaces that service is reachable at http://foo.bar.svc.cluster.local . Change out the servicename and namespace for your usecase.

k8s dns is explained here in the docs: https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/

Answer 3

I have taken the YAML you provided and assembled it here.

From another comment I see the URL you're trying to connect to is: http://gateway-service.default.svc.cluster.local:3000/my-adm-contact-service

The ability to resolve service names to pods only functions inside the cluster: coredns (a k8s pod) is the part which recognises when a service has been created and what IP(s) it's available at.

So another pod in the cluster eg one created by kubectl run bb --image=busybox -it -- sh would be able to resolve the command ping gateway-service , but pinging gateway-service from your desktop will fail because they're not both seeing the same DNS.

The api-gateway container will be able to make a connect to my-adm-contact-service on ports 3000 or 8879, and the my-adm-contact container will equally be able to connect to gateway-service on port 3000 - but only when those containers are running inside the cluster .

I think you're trying to access this from outside the cluster, so now the port/service types are correct you could re-try a kubectl port-forward svc/gateway-service 3000:3000 This will let you connect to 127.0.0.1:3000 and the traffic will be routed to port 3000 on the api-gateway container.

If you need to proxy to the other my-adm-contact-service then you'll have to issue similar kubectl commands in other shells, one per service:port combination. For completeness, if you wanted to route traffic from your local machine to all three container/port sets, you'd run:

# format kubectl port-forward svc/name src:dest (both TCP)
kubectl port-forward svc/gateway-service 3000:3000
kubectl port-forward svc/my-adm-contact-service 8879:8879
kubectl port-forward svc/my-adm-contact-service 3001:3000 #NOTE the changed local port, because localhost:3000 is already used

You will need a new shell for each kubectl, or run it as a background job.

apiVersion: v1
kind: Pod
metadata:
  name: my-adm-contact
  labels:
    app: my-adm-contact
spec:
  containers:
  - image: my-contact-adm
    imagePullPolicy: Never
    name: my-adm-contact
    ports:
    - containerPort: 8879
      protocol: TCP
    - containerPort: 3000
      protocol: TCP
---
apiVersion: v1
kind: Service
metadata:
  name: my-adm-contact-service
spec:
  ports:
  - port: 8879
    protocol: TCP
    targetPort: 8879
    name: adm8879
  - port: 3000
    protocol: TCP
    targetPort: 3000
    name: adm3000
  selector:
    app: my-adm-contact
  type: ClusterIP
---
apiVersion: v1
kind: Pod
metadata:
  name: my-gateway
  labels:
    app: my-gateway
spec:
  containers:
  - image: api-gateway
    imagePullPolicy: Never
    name: my-gateway
    ports:
    - containerPort: 3000
      protocol: TCP
---
apiVersion: v1
kind: Service
metadata:
  name: gateway-service
spec:
  ports:
  - port: 3000
    protocol: TCP
    targetPort: 3000
  selector:
    app:  my-gateway
  type: ClusterIP