我无法从我的主Kubernetes集群访问pod

Question

如果我有一组使用NetworkPolicy入口连接的部署。这是工作！然而，如果我必须从外部连接(IP来自kubectl get-ep(，我必须设置另一个端点入口？还是出口政策？

apiVersion: apps/v1
kind: Deployment
metadata:
namespace: nginx
annotations:
kompose.cmd: ./kompose convert
kompose.version: 1.22.0 (955b78124)
creationTimestamp: null
labels:
io.kompose.service: nginx
name: nginx
spec:
replicas: 1
selector:
matchLabels:
io.kompose.service: nginx
strategy: {}
template:
metadata:
annotations:
kompose.cmd: ./kompose convert
kompose.version: 1.22.0 (955b78124)
creationTimestamp: null
labels:
io.kompose.network/nginx: "true"
io.kompose.service: nginx
spec:
containers:
- image: nginx
name: nginx
ports:
- containerPort: 8000
resources: {}
restartPolicy: Always
status: {}
---
apiVersion: apps/v1
kind: Deployment
metadata:
namespace: mariadb
annotations:
kompose.cmd: ./kompose convert
kompose.version: 1.22.0 (955b78124)
creationTimestamp: null
labels:
io.kompose.service: mariadb
name: mariadb
spec:
replicas: 1
selector:
matchLabels:
io.kompose.service: mariadb
strategy: {}
template:
metadata:
annotations:
kompose.cmd: ./kompose convert
kompose.version: 1.22.0 (955b78124)
creationTimestamp: null
labels:
io.kompose.network/nginx: "true"
io.kompose.service: mariadb
spec:
containers:
- image: mariadb
name: mariadb
ports:
- containerPort: 5432
resources: {}
restartPolicy: Always
status: {}
...

您可以在此处查看更多代码http://pastie.org/p/2QpNHjFdAK9xj7SYuZvGPf

终点：

kubectl get ep -n nginx
NAME       ENDPOINTS             AGE
mariadb  192.168.112.203:5432  2d2h
nginx     192.168.112.204:8000  42h

服务：

NAME       TYPE       CLUSTER-IP     EXTERNAL-IP  PORT(S)         AGE
mariadb ClusterIP  10.99.76.78    <none>       5432/TCP        2d2h
nginx     NodePort   10.111.176.21  <none>       8000:31604/TCP  42h

来自服务器的测试：

If I do curl 10.111.176.21:31604 -- No answer
If I do curl 192.168.112.204:8000 -- No answer
If I do curl 192.168.112.204:31604 -- No answer
If I do curl 10.0.0.2:8000 or 31604 -- No answer
10.0.0.2 is a worker node IP.

更新如果我执行kubectl port-forward nginx-PODXXX 8000:8000我可以从HTTP://localhost:8000 访问它

那么我错在哪里了？

Answer 1

看起来您正在使用网络策略作为传入流量的入口，但您可能希望使用入口控制器来管理入口流量。

出站是指从集群内的服务向外流到外部源的流量。Ingress用于将外部流量定向到集群内的特定服务。

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: my-app-ingress
annotations:
nginx.ingress.kubernetes.io/rewrite-target: /
spec:
rules:
- host: my-example.site.tld
http:
paths:
- path: /
backend:
serviceName: nginx
servicePort: 5432