tcp 10.10.2.2:443：I/O 超时 Cloud Build 访问私有 GKE

Question

我正在尝试按照https://cloud.google.com/architecture/accessing-private-gke-clusters-with-cloud-build-private-pools中描述的说明让 Cloud Build 访问我的私有 GKE

据我所知，我已经按照描述配置了东西，但是当我尝试部署任何东西或运行上面链接中描述的测试时，我收到以下错误：

Unable to connect to the server: dial tcp 10.10.2.2:443: i/o timeout
ERROR
ERROR: build step 0 "gcr.io/cloud-builders/kubectl" failed: step exited with non-zero status: 1

有谁知道我该如何解决这个问题？ 我的 VPN 隧道都已建立，我的 GKE 集群在其 authorized.networks 中允许 192.168.0.0/20。

以下是我的设置的一些其他详细信息以供参考：

# gcloud compute vpn-tunnels list
NAME            REGION    GATEWAY   PEER_ADDRESS
ha-vpn-tunnel1  us-east1  ha-vpn-1  35.242.12.184
ha-vpn-tunnel2  us-east1  ha-vpn-1  35.220.15.95
ha-vpn-tunnel3  us-east1  ha-vpn-2  35.242.6.151
ha-vpn-tunnel4  us-east1  ha-vpn-2  35.220.14.211

# gcloud compute vpn-gateways list
NAME      INTERFACE0     INTERFACE1     NETWORK                   REGION
ha-vpn-1  35.242.6.151   35.220.14.211  demo-vpc                  us-east1
ha-vpn-2  35.242.12.184  35.220.15.95   private-pool-peering-vpc  us-east1

# gcloud compute routers list
NAME            REGION    NETWORK
ha-vpn-router1  us-east1  demo-vpc
ha-vpn-router2  us-east1  private-pool-peering-vpc
my-router       us-east1  demo-vpc

# gcloud compute routers describe ha-vpn-router1 --region us-east1
bgp:
  advertiseMode: DEFAULT
  asn: 64515
  keepaliveInterval: 20
bgpPeers:
- advertiseMode: CUSTOM
  advertisedIpRanges:
  - description: ''
    range: 192.168.0.0/20
  advertisedRoutePriority: 100
  bfd:
    minReceiveInterval: 1000
    minTransmitInterval: 1000
    multiplier: 5
    sessionInitializationMode: DISABLED
  enable: 'TRUE'
  enableIpv6: false
  interfaceName: router1-interface2
  ipAddress: 169.254.1.2
  name: router1-peer2
  peerAsn: 64516
  peerIpAddress: 169.254.1.1
- advertiseMode: CUSTOM
  advertisedIpRanges:
  - description: ''
    range: 192.168.0.0/20
  advertisedRoutePriority: 100
  bfd:
    minReceiveInterval: 1000
    minTransmitInterval: 1000
    multiplier: 5
    sessionInitializationMode: DISABLED
  enable: 'TRUE'
  enableIpv6: false
  interfaceName: router1-interface1
  ipAddress: 169.254.0.1
  name: router1-peer1
  peerAsn: 64516
  peerIpAddress: 169.254.0.2
creationTimestamp: '2023-01-03T16:55:55.711-08:00'
id: '2186172510416498804'
interfaces:
- ipRange: 169.254.1.2/30
  linkedVpnTunnel: https://www.googleapis.com/compute/v1/projects/fakeproject/regions/us-east1/vpnTunnels/ha-vpn-tunnel2
  name: router1-interface2
- ipRange: 169.254.0.1/30
  linkedVpnTunnel: https://www.googleapis.com/compute/v1/projects/fakeproject/regions/us-east1/vpnTunnels/ha-vpn-tunnel1
  name: router1-interface1
kind: compute#router
name: ha-vpn-router1
network: https://www.googleapis.com/compute/v1/projects/fakeproject/global/networks/demo-vpc
region: https://www.googleapis.com/compute/v1/projects/fakeproject/regions/us-east1
selfLink: https://www.googleapis.com/compute/v1/projects/fakeproject/regions/us-east1/routers/ha-vpn-router1

# gcloud compute routers describe ha-vpn-router2 --region us-east1
bgp:
  advertiseMode: DEFAULT
  asn: 64516
  keepaliveInterval: 20
bgpPeers:
- advertiseMode: CUSTOM
  advertisedIpRanges:
  - description: ''
    range: 10.10.2.0/28
  advertisedRoutePriority: 100
  bfd:
    minReceiveInterval: 1000
    minTransmitInterval: 1000
    multiplier: 5
    sessionInitializationMode: DISABLED
  enable: 'TRUE'
  enableIpv6: false
  interfaceName: router2-interface1
  ipAddress: 169.254.0.2
  name: router2-peer1
  peerAsn: 64515
  peerIpAddress: 169.254.0.1
- advertiseMode: CUSTOM
  advertisedIpRanges:
  - description: ''
    range: 10.10.2.0/28
  advertisedRoutePriority: 100
  bfd:
    minReceiveInterval: 1000
    minTransmitInterval: 1000
    multiplier: 5
    sessionInitializationMode: DISABLED
  enable: 'TRUE'
  enableIpv6: false
  interfaceName: router2-interface2
  ipAddress: 169.254.1.1
  name: router2-peer2
  peerAsn: 64515
  peerIpAddress: 169.254.1.2
creationTimestamp: '2023-01-03T16:56:06.404-08:00'
id: '6144519957886103625'
interfaces:
- ipRange: 169.254.0.2/30
  linkedVpnTunnel: https://www.googleapis.com/compute/v1/projects/fakeproject/regions/us-east1/vpnTunnels/ha-vpn-tunnel3
  name: router2-interface1
- ipRange: 169.254.1.1/30
  linkedVpnTunnel: https://www.googleapis.com/compute/v1/projects/fakeproject/regions/us-east1/vpnTunnels/ha-vpn-tunnel4
  name: router2-interface2
kind: compute#router
name: ha-vpn-router2
network: https://www.googleapis.com/compute/v1/projects/fakeproject/global/networks/private-pool-peering-vpc
region: https://www.googleapis.com/compute/v1/projects/fakeproject/regions/us-east1
selfLink: https://www.googleapis.com/compute/v1/projects/fakeproject/regions/us-east1/routers/ha-vpn-router2

谢谢！

2022-01-04 更新：

我有一个 cloudbuild.yaml 文件与上面链接中的示例匹配，我刚刚更新为运行 kubectl get config 而不是 kubectl get nodes。 这是该命令的结果：

Running: kubectl config view
apiVersion: v1
clusters:
- cluster:
    certificate-authority-data: DATA+OMITTED
    server: https://10.10.2.2
  name: gke_fake-project_us-east1_demo-gke
contexts:
- context:
    cluster: gke_fake-project_us-east1_demo-gke
    user: gke_fake-project_us-east1_demo-gke
  name: gke_fake-project_us-east1_demo-gke
current-context: gke_fake-project_us-east1_demo-gke
kind: Config
preferences: {}
users:
- name: gke_fake-project_us-east1_demo-gke
  user:
    auth-provider:
      config:
        access-token: xxx
        cmd-args: config config-helper --format=json
        cmd-path: /builder/google-cloud-sdk/bin/gcloud
        expiry: "2023-01-05T03:17:33Z"
        expiry-key: '{.credential.token_expiry}'
        token-key: '{.credential.access_token}'
      name: gcp
PUSH
DONE

这是显示我的 authorized.networks 的 output：

gcloud container clusters describe demo-gke \
>       --format="value(masterAuthorizedNetworksConfig)"\
>       --region=us-east1
cidrBlocks=[{'cidrBlock': '10.0.0.0/8', 'displayName': 'internal_10'}, {'cidrBlock': '192.168.0.0/16', 'displayName': 'internal_192'}, {'cidrBlock': '172.16.0.0/12', 'displayName': 'internal_172'}];enabled=True

Answer 1

无法连接到服务器：拨打 tcp [IP_ADDRESS]: connect: 连接超时。

当 kubectl 无法与集群控制平面对话时，就会发生这种情况。

要解决此问题，请验证设置集群的上下文：

1. Go 到$HOME/.kube/config或运行命令kubectl config view以验证配置文件包含集群上下文和控制平面的外部 IP 地址。
2. 设置集群凭据：

 gcloud container clusters get-credentials CLUSTER_NAME \ --region=COMPUTE_REGION

替换以下内容：

CLUSTER_NAME:集群的名称。

COMPUTE_REGION:集群的 Compute Engine 区域。 对于区域集群，使用 --zone=COMPUTE_ZONE。

按照此文档进行操作，其中包含多种无法到达私有集群控制平面的故障排除方法，请尝试使用它们，如果这能解决您的问题，请告诉我。

Answer 2

原来问题出在我的 BGP 通告路由中有一个拼写错误。 一旦我解决了这个问题，一切都会按预期进行。