服务是NodePort类型,并指定port和targetPort是什么意思？

Question

我白天对Kubernetes越来越熟悉,但我仍处于基本水平.我也不是网络人.

我正盯着服务定义的以下片段,我无法在脑海中形成正确的图片:

spec:
  type: NodePort
  ports:
  - port: 27018
    targetPort: 27017
    protocol: TCP

引用ServicePort文档,其中部分内容如下:

nodePort     The port on each node on which this service is exposed when type=NodePort or LoadBalancer. Usually
integer      assigned by the system. If specified, it will be allocated to the service if unused or else creation of the
             service will fail. Default is to auto-allocate a port if the ServiceType of this Service requires one. More info: 
             http://kubernetes.io/docs/user-guide/services#type--nodeport

port         The port that will be exposed by this service.
integer

targetPort   Number or name of the port to access on the pods targeted by the service. Number must be in the range 1
IntOrString  to 65535. Name must be an IANA_SVC_NAME. If this is a string, it will be looked up as a named port in the
             target Pod's container ports. If this is not specified, the value of the 'port' field is used (an identity map).
             This field is ignored for services with clusterIP=None, and should be omitted or set equal to the 'port' field.
             More info: http://kubernetes.io/docs/user-guide/services#defining-a-service

我的理解是,该集群之外的客户端将"看到"的端口将在范围内的动态分配的一个30000- 32767,所定义的文档中.这将使用我还不了解的一些黑魔法流向给targetPort定节点(27017在这种情况下).

那么port这里使用的是什么？

Answer 1

nodePort是群集外部的客户端将"看到"的端口.nodePort通过kube-proxy在集群中的每个节点上打开.使用iptables magic Kubernetes(k8s)然后将流量从该端口路由到匹配的服务pod(即使该pod在完全不同的节点上运行).

port是服务在集群内侦听的端口.我们来看这个例子:

---
apiVersion: v1
kind: Service
metadata:
  name: my-service
spec:
  ports:
  - port: 8080
    targetPort: 8070
    nodePort: 31222
    protocol: TCP 
  selector:
    component: my-service-app

从我的k8s群集内部,可以通过my-service.default.svc.cluster.local:8080(群集内的服务到服务通信)访问此服务,并且到达那里的任何请求都将转发到targetPort8070 上的正在运行的pod .

tagetPort默认情况下也是相同的值,port如果没有另外指定.

Answer 2

为了更好地解释这个概念,我想象了Service的NodePort概念.

正如@fishi在他的回答中提到的,NodePort允许将k8s主机端口(也称为nodePort)暴露给外部客户端.客户端可以直接访问nodePort,k8s将流量转发到必要的端口.

K8s保留了nodePort所有节点.运行服务的pod的所有节点都打开了此端口.

Pod不仅可以通过内部集群IP访问,还可以通过节点的IP和保留端口aka HOST_IP:NODE_PORT对访问.