kubernetes服务中可以公开的端口数量有限制吗

Question

我正试图在200多个端口上公开一个服务。这是示例服务yaml:

apiVersion: v1
kind: Service
metadata:
name: multiport-server-large-port
spec:
type: NodePort
selector:
app: multiport-server-large-port
ports:
- port: 49152
name: tcp-49152
- port: 49153
name: tcp-49153
- port: 49154
name: tcp-49154
- port: 49155
name: tcp-49155
- port: 49156
name: tcp-49156
- port: 49157
name: tcp-49157
- port: 49158
.
.
.
.... 200 more such ports

在我应用这个yaml之后，服务被创建，但ip:port组合无法访问，出现连接拒绝错误。在进一步的调查中，我发现iptables过滤器链KUBE-EXTERNAL-SERVICES中有一些REJECT条目用于我暴露的端口。

IPTABLES拒绝规则:

Chain KUBE-EXTERNAL-SERVICES (1 references)
pkts bytes target     prot opt in     out     source               destination
0     0 REJECT     tcp  --  any    any     anywhere             anywhere             /* default/multiport-server-large-port:tcp-49316 has no endpoints */ ADDRTYPE match dst-type LOCAL tcp dpt:31
184 reject-with icmp-port-unreachable
0     0 REJECT     tcp  --  any    any     anywhere             anywhere             /* default/multiport-server-large-port:tcp-49325 has no endpoints */ ADDRTYPE match dst-type LOCAL tcp dpt:31
225 reject-with icmp-port-unreachable
0     0 REJECT     tcp  --  any    any     anywhere             anywhere             /* default/multiport-server-large-port:tcp-49383 has no endpoints */ ADDRTYPE match dst-type LOCAL tcp dpt:32
620 reject-with icmp-port-unreachable
0     0 REJECT     tcp  --  any    any     anywhere             anywhere             /* default/multiport-server-large-port:tcp-49385 has no endpoints */ ADDRTYPE match dst-type LOCAL tcp dpt:30
107 reject-with icmp-port-unreachable
0     0 REJECT     tcp  --  any    any     anywhere             anywhere             /* default/multiport-server-large-port:tcp-49359 has no endpoints */ ADDRTYPE match dst-type LOCAL tcp dpt:31

我想了解：

1. 为什么会出现这些拒绝规则
2. 这不可能通过服务暴露大量端口吗
3. 可以通过服务公开的端口数量有限制吗

Answer 1

当特定服务有0个端点时，会插入REJECT。Service.spec中的选择器一定是错误的，或者您没有任何运行的pod