Kubernetes 無法訪問 pod

Question

我有一個主節點和工作節點，兩者都已啟動並正在運行，我在 k8 集群中部署了一個 angular 應用程序。 當我檢查我的 pod 日志時，所有東西都在工作文件中，沒有任何錯誤。

我試圖在瀏覽器中使用主 IP 地址和工作 IP 地址訪問應用程序，后跟如下所示的節點端口號，並出現無法連接之類的錯誤。

http://10.0.0.1:32394/

Name:         frontend-app-6848bc9666-9ggz7
Namespace:    pre-release
Priority:     0
Node:         SBT-poc-worker2/10.0.0.5
Start Time:   Fri, 17 Jan 2020 05:04:10 +0000
Labels:       app=frontend-app
              pod-template-hash=6848bc9666
Annotations:  <none>
Status:       Running
IP:           10.32.0.3
IPs:
  IP:           10.32.0.3
Controlled By:  ReplicaSet/frontend-app-6848bc9666
Containers:
  frontend-app:
    Container ID:   docker://292199347e391c9feecd667e1668f32931f1fd7c670514eb1e05e4a37b8109ad
    Image:          frontend-app:future-master-fix-7ba35fbe
    Image ID:       docker://sha256:0099587db89de9ef999a7d1f087d4781e73c491b17e89392e92b08d2f935ad27
    Port:           8080/TCP
    Host Port:      0/TCP
    State:          Running
      Started:      Fri, 17 Jan 2020 05:04:15 +0000
    Ready:          True
    Restart Count:  0
    Limits:
      cpu:     250m
      memory:  256Mi
    Requests:
      cpu:        100m
      memory:     128Mi
    Environment:  <none>
    Mounts:
      /var/run/secrets/kubernetes.io/serviceaccount from default-token-r67p7 (ro)
Conditions:
  Type              Status
  Initialized       True 
  Ready             True 
  ContainersReady   True 
  PodScheduled      True 
Volumes:
  default-token-r67p7:
    Type:        Secret (a volume populated by a Secret)
    SecretName:  default-token-r67p7
    Optional:    false
QoS Class:       Burstable
Node-Selectors:  <none>
Tolerations:     node.kubernetes.io/not-ready:NoExecute for 300s
                 node.kubernetes.io/unreachable:NoExecute for 300s
Events:
  Type    Reason     Age    From                       Message
  ----    ------     ----   ----                       -------
  Normal  Scheduled  5m44s  default-scheduler          Successfully assigned pre-release/frontend-app-6848bc9666-9ggz7 to SBT-poc-worker2
  Normal  Pulled     5m41s  kubelet, SBT-poc-worker2  Container image "frontend-app:future-master-fix-7ba35fbe" already present on machine
  Normal  Created    5m39s  kubelet, SBT-poc-worker2  Created container frontend-app
  Normal  Started    5m39s  kubelet, SBT-poc-worker2  Started container frontend-app

root@jenkins-linux-vm:/home/SBT-admin# kubectl get pods -n pre-release
NAME                            READY   STATUS    RESTARTS   AGE
frontend-app-6848bc9666-9ggz7   1/1     Running   0          7m26s

root@jenkins-linux-vm:/home/SBT-admin# kubectl get services -n pre-release
NAME           TYPE       CLUSTER-IP   EXTERNAL-IP   PORT(S)          AGE
frontend-app   NodePort   10.96.6.77   <none>        8080:32394/TCP   7m36s

root@jenkins-linux-vm:/home/SBT-admin# kubectl get deployment -n pre-release
NAME           READY   UP-TO-DATE   AVAILABLE   AGE
frontend-app   1/1     1            1           11m

root@jenkins-linux-vm:/home/SBT-admin# kubectl get -o yaml -n pre-release svc frontend-app
apiVersion: v1
kind: Service
metadata:
  annotations:
    kubectl.kubernetes.io/last-applied-configuration: |
      {"apiVersion":"v1","kind":"Service","metadata":{"annotations":{},"labels":{"name":"frontend-app"},"name":"frontend-app","namespace":"pre-release"},"spec":{"ports":[{"port":8080,"targetPort":8080}],"selector":{"name":"frontend-app"},"type":"NodePort"}}
  creationTimestamp: "2020-01-17T05:04:10Z"
  labels:
    name: frontend-app
  name: frontend-app
  namespace: pre-release
  resourceVersion: "1972713"
  selfLink: /api/v1/namespaces/pre-release/services/frontend-app
  uid: 91b87f9e-d723-498c-af05-5969645a82ee
spec:
  clusterIP: 10.96.6.77
  externalTrafficPolicy: Cluster
  ports:
  - nodePort: 32394
    port: 8080
    protocol: TCP
    targetPort: 8080
  selector:
    name: frontend-app
  sessionAffinity: None
  type: NodePort
status:
  loadBalancer: {}

root@jenkins-linux-vm:/home/SBT-admin# kubectl get pods --selector="app=frontend-app" --output=wide
NAME                            READY   STATUS    RESTARTS   AGE   IP          NODE               NOMINATED NODE   READINESS GATES
frontend-app-7c7cf68f9c-n9tct   1/1     Running   0          58m   10.32.0.5   SBT-poc-worker2   <none>           <none>

root@jenkins-linux-vm:/home/SBT-admin# kubectl get pods
NAME                            READY   STATUS    RESTARTS   AGE
frontend-app-7c7cf68f9c-n9tct   1/1     Running   0          58m

root@jenkins-linux-vm:/home/SBT-admin# kubectl get svc
NAME           TYPE       CLUSTER-IP     EXTERNAL-IP   PORT(S)          AGE
frontend-app   NodePort   10.96.21.202   <none>        8080:31098/TCP   59m

root@jenkins-linux-vm:/home/SBT-admin# kubectl get deployment
NAME           READY   UP-TO-DATE   AVAILABLE   AGE
frontend-app   1/1     1            1           59m

你能請人幫我解決這個問題嗎？

Answer 1

從問題陳述的日志中可以看出， POD 上的標簽是app=frontend-app 。 您的 POD 描述顯示在標簽下方

Name:         frontend-app-6848bc9666-9ggz7
Namespace:    pre-release
Priority:     0
Node:         SBT-poc-worker2/10.0.0.5
Start Time:   Fri, 17 Jan 2020 05:04:10 +0000
Labels:       app=frontend-app

服務yaml 文件上的 Selector 字段是name: frontend-app ，您應該將服務 yaml 文件上的此標簽更改為app: frontend-app並更新創建的服務。

您當前的選擇器值如下，比較 POD 上的標簽是錯誤的

  ports:
  - nodePort: 32394
    port: 8080
    protocol: TCP
    targetPort: 8080
  selector:
    name: frontend-app

將其更改為

selector:
    app: frontend-app

Answer 2

你應該嘗試建立

集群網絡上的安全規則或防火牆沒有阻止默認節點端口范圍（即從端口 30000 - 到端口 32767）的規則。

例如，驗證您在集群網絡上打開了以下安全規則，以便節點端口范圍在瀏覽器中工作。

Ingress IPv4    TCP 30000 - 32767   0.0.0.0/0

一旦您確認您沒有安全組規則問題。 我將采用以下方法進行調試，並找出節點級別端口可達性的問題。 執行基本測試並檢查我是否可以通過節點端口在瀏覽器上安裝和訪問 nginx Web 服務器：

腳步：

使用下面的 nginx.yaml部署 NGINX 部署

apiVersion: apps/v1
kind: Deployment
metadata:
  name: my-nginx
spec:
  selector:
    matchLabels:
      run: my-nginx
  replicas: 1
  template:
    metadata:
      labels:
        run: my-nginx
    spec:
      containers:
      - name: my-nginx
        image: nginx
        ports:
        - containerPort: 80

驗證部署已啟動並正在運行

$ kubectl apply -f nginx.yaml

$ kubectl get all
NAME                            READY   STATUS        RESTARTS   AGE
pod/my-nginx-75897978cd-ptqv9   1/1     Running       0          32s

NAME                 TYPE        CLUSTER-IP   EXTERNAL-IP   PORT(S)   AGE
service/kubernetes   ClusterIP   10.96.0.1    <none>        443/TCP   4d11h

NAME                       READY   UP-TO-DATE   AVAILABLE   AGE
deployment.apps/my-nginx   1/1     1            1           33s

NAME                                  DESIRED   CURRENT   READY   AGE
replicaset.apps/my-nginx-75897978cd   1         1         1       33s

現在使用以下示例創建服務以公開 nginx 部署

apiVersion: v1
kind: Service
metadata:
  name: my-nginx
  labels:
    run: my-nginx
spec:
  type: NodePort
  ports:
  - port: 8080
    targetPort: 80
    protocol: TCP
    name: http
  selector:
    run: my-nginx

驗證服務已創建並確定分配的節點端口（因為我們沒有在 service.yaml 中提供任何固定端口（如下所示節點端口為 32502）

$ kubectl apply -f service.yaml

$ kubectl get svc
NAME         TYPE        CLUSTER-IP      EXTERNAL-IP   PORT(S)          AGE
kubernetes   ClusterIP   10.96.0.1       <none>        443/TCP          4d11h
my-nginx     NodePort    10.96.174.234   <none>        8080:32502/TCP   12s

除了 nodeport標識你的主節點的 ip ie 131.112.113.101 下面

$ kubectl get nodes -o wide
NAME           STATUS   ROLES    AGE     VERSION   INTERNAL-IP       EXTERNAL-IP   OS-IMAGE             KERNEL-VERSION      CONTAINER-RUNTIME
master-1   Ready    master   4d11h   v1.17.0   131.112.113.101   <none>        Ubuntu 16.04.6 LTS   4.4.0-169-generic   docker://18.6.2
node-1     Ready    <none>   4d11h   v1.17.0   131.112.113.102   <none>        Ubuntu 16.04.6 LTS   4.4.0-169-generic   docker://18.6.2
node-2     Ready    <none>   4d11h   v1.17.0   131.112.113.103   <none>        Ubuntu 16.04.6 LTS   4.4.0-169-generic   docker://18.6.2

現在，如果您嘗試使用 masternode 的 IP 訪問 nginx 應用程序，並且在瀏覽器中使用 nodeport 值，例如<masternode>:<nodeport> （即 131.112.113.101:32502），您應該得到類似於下面的結果

請注意nginx.yaml 上使用的容器端口和 service.yaml 上的 targetPort（即 80），您應該能夠更好地為您的前端應用程序弄清楚這一點。 希望這將幫助您了解節點/集群級別的問題（如果有）。