如何在Ignite XML配置中为Kubernetes IPFinder设置MasterUrl

Question

使用带有Ignite 2.4和k8s 1.9的测试配置:

<?xml version="1.0" encoding="UTF-8"?>
    <beans xmlns="http://www.springframework.org/schema/beans"
           xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
           xmlns:util="http://www.springframework.org/schema/util"
           xsi:schemaLocation="
            http://www.springframework.org/schema/beans
            http://www.springframework.org/schema/beans/spring-beans.xsd
            http://www.springframework.org/schema/util
            http://www.springframework.org/schema/util/spring-util.xsd">

    <bean class="org.apache.ignite.configuration.IgniteConfiguration">
      <property name="discoverySpi">
        <bean class="org.apache.ignite.spi.discovery.tcp.TcpDiscoverySpi">
          <property name="ipFinder">
            <bean class="org.apache.ignite.spi.discovery.tcp.ipfinder.kubernetes.TcpDiscoveryKubernetesIpFinder"/>
          </property>
        </bean>
      </property>
    </bean>
</beans>

无法在https://kubernetes.default.svc.cluster.local找到Kubernetes API服务器:443 我可以在XML配置文件中设置API服务器URL吗？怎么样？

Answer 1

@Denis是对的.

Kubernetes使用RBAC访问控制系统,您需要授权您的pod访问API.

为此,您需要向您的pod 添加服务帐户.

所以,为此你需要:

1. 创建服务帐户并为其设置角色:

   apiVersion: v1
   kind: ServiceAccount
   metadata:
     name: ignite
     namespace: <Your namespace>
   

2. 我不确定只访问pod的权限对于Ignite是否足够,但如果没有 - 您可以添加更多权限.以下是具有大型权限列表的不同类型角色的示例.那么,现在我们为您的应用创建群集角色:

   apiVersion: rbac.authorization.k8s.io/v1beta1
   kind: ClusterRole
   metadata:
     name: ignite
     namespace: <Your namespace>
   rules:
   - apiGroups:
     - ""
     resources:
     - pods # Here is resources you can access
     verbs: # That is what you can do with them
     - get
     - list
     - watch
   

3. 为该角色创建绑定:

   kind: ClusterRoleBinding
   apiVersion: rbac.authorization.k8s.io/v1beta1
   metadata:
     name: ignite
   roleRef:
     kind: ClusterRole
     name: ignite
     apiGroup: rbac.authorization.k8s.io
   subjects:
   - kind: ServiceAccount
     name: ignite
     namespace: <Your namespace>
   

4. 现在,您需要将ServiceAccount与您的应用程序关联到pod:

   apiVersion: extensions/v1beta1
   kind: DaemonSet
   metadata:
     ....
   spec:
     template:
       spec:
         serviceAccountName: ignite
   

之后,您的应用程序将可以访问K8s API.PS不要忘记更改<Your namespace>到运行Ignition的命名空间.

Answer 2

看一下这个线程：http://apache-ignite-users.70518.x6.nabble.com/Unable-to-connect-ignite-pods-in-Kubernetes-using-Ip-finder-td18009.html

403错误的问题可以通过向服务帐户授予更多权限来解决。