使用 kubernetes 时 ftps 服务器无法正常工作

Question

我在 ftps-filezilla 和 Kubernetes 上遇到了几个星期的问题。

\n\n

语境：

\n\n

我有一个使用 Kubernetes 和 ftps 的学校项目。\n我需要在端口 21 的 kubernetes 中创建一个 ftps 服务器，并且它需要在 alpine linux 上运行。\n所以我使用 docker 容器创建 ftps-alpine 服务器的映像。\n我测试它，如果它自己正常工作：\n使用docker run --name test-alpine -itp 21:21 test_alpine\n我在 filezilla 中有这个输出：

\n\n

    Status: Connecting to 192.168.99.100:21\xe2\x80\xa6\n    Status: Connection established, waiting for welcome message\xe2\x80\xa6\n    Status: Initializing TLS\xe2\x80\xa6\n    Status: Verifying certificate\xe2\x80\xa6\n    Status: TLS connection established.\n    Status: Logged in\n    Status: Retrieving directory listing\xe2\x80\xa6\n    Status: Calculating timezone offset of server\xe2\x80\xa6\n    Status: Timezone offset of server is 0 seconds.\n    Status: Directory listing of \xe2\x80\x9c/\xe2\x80\x9d successful\n

\n\n

它工作成功，filezilla 看到我的 ftps 目录中的文件\n我现在很好（在活动模式下工作）。

\n\n

问题：

\n\n

所以我想要的是在我的 kubernetes 集群中使用我的映像（我使用 Minikube）。\n当我将我的 docker 映像连接到 kubernetes 中的入口服务部署时，我有：

\n\n

    Status: Connecting to 192.168.99.100:30894\xe2\x80\xa6\n    Status: Connection established, waiting for welcome message\xe2\x80\xa6\n    Status: Initializing TLS\xe2\x80\xa6\n    Status: Verifying certificate\xe2\x80\xa6\n    Status: TLS connection established.\n    Status: Logged in\n    Status: Retrieving directory listing\xe2\x80\xa6\n    Command:    PWD\n    Response:   257 \xe2\x80\x9c/\xe2\x80\x9d is the current directory\n    Command:    TYPE I\n    Response:   200 Switching to Binary mode.\n    Command:    PORT 192,168,99,1,227,247\n    Response:   500 Illegal PORT command.\n    Command:    PASV\n    Response:   227 Entering Passive Mode (172,17,0,5,117,69).\n    Command:    LIST\n    Error:  The data connection could not be established: EHOSTUNREACH - No route to host\n    Error:  Connection timed out after 20 seconds of inactivity\n    Error:  Failed to retrieve directory listing\n

\n\n

设置：

\n\n

\ningress.yaml :\n\n    kind: Ingress\n    metadata:\n    annotations:\n    nginx.ingress.kubernetes.io/rewrite-target: /$1\n    namespace: default\n    name: ingress-controller\n    spec:\n    backend:\n    serviceName: my-nginx\n    servicePort: 80\n    backend:\n    serviceName: ftps-alpine\n    servicePort: 21\n\nftps-alpine.yml :\n\n    apiVersion: v1\n    kind: Service\n    metadata:\n    name: ftps-alpine\n    labels:\n    run: ftps-alpine\n    spec:\n    type: NodePort\n    ports:\n\n    port: 21\n    targetPort: 21\n    protocol: TCP\n    name: ftp21\n    port: 20\n    targetPort: 20\n    protocol: TCP\n    name: ftp20\n    selector:\n    run: ftps-alpine\n    apiVersion: apps/v1\n    kind: Deployment\n    metadata:\n    name: ftps-alpine\n    spec:\n    selector:\n    matchLabels:\n    run: ftps-alpine\n    replicas: 1\n    template:\n    metadata:\n    labels:\n    run: ftps-alpine\n    spec:\n    - name: ftps-alpine\n    image: test_alpine\n    imagePullPolicy: Never\n    ports:\n    - containerPort: 21\n    - containerPort: 20\n

\n\n

我尝试了什么：

\n\n

\n
• 当我看到错误消息时：错误：无法建立数据连接：EHOSTUNREACH - 没有到主机的路由 google 一下，我看到\n此消息：\n被动模式下的 FTP：EHOSTUNREACH - 没有到主机的路由\n。我已经在活动模式下运行我的 ftps 服务器。
\n
• 更改 vsftpd.conf 文件和我的服务：
\n

\n\n

vsftpd.conf :\n\n    seccomp_sandbox=NO\n    pasv_promiscuous=NO\n    listen=NO\n    listen_ipv6=YES\n    anonymous_enable=NO\n    local_enable=YES\n    write_enable=YES\n    local_umask=022\n    dirmessage_enable=YES\n    use_localtime=YES\n    xferlog_enable=YES\n    connect_from_port_20=YES\n    chroot_local_user=YES\n    #secure_chroot_dir=/vsftpd/empty\n    pam_service_name=vsftpd\n    pasv_enable=YES\n    pasv_min_port=30020\n    pasv_max_port=30021\n    user_sub_token=$USER\n    local_root=/home/$USER/ftp\n    userlist_enable=YES\n    userlist_file=/etc/vsftpd.userlist\n    userlist_deny=NO\n    rsa_cert_file=/etc/ssl/private/vsftpd.pem\n    rsa_private_key_file=/etc/ssl/private/vsftpd.pem\n    ssl_enable=YES\n    allow_anon_ssl=NO\n    force_local_data_ssl=YES\n    force_local_logins_ssl=YES\n    ssl_tlsv1=YES\n    ssl_sslv2=NO\n    ssl_sslv3=NO\n    allow_writeable_chroot=YES\n    #listen_port=21\n

\n\n

我确实将 kubernetes 的节点端口更改为 30020 和 30021，并将它们添加到容器端口。\n我更改了 pasv 最小端口和最大端口。\n我添加了我的 minikube ip 的 pasv_adress。\n没有任何作用。

\n\n

问题：

\n\n

除了我的 kubernetes 集群之外，我怎样才能成功获得第一条消息？

\n\n

如果您有任何问题需要澄清，没问题。

\n\n

更新：

\n\n

感谢 coderanger，我已经提前了，但出现了这个问题：

\n\n

Status: Connecting to 192.168.99.100:30894...\nStatus: Connection established, waiting for welcome message...\nStatus: Initializing TLS...\nStatus: Verifying certificate...\nStatus: TLS connection established.\nStatus: Logged in\nStatus: Retrieving directory listing...\nCommand:    PWD\nResponse:   257 "/" is the current directory\nCommand:    TYPE I\nResponse:   200 Switching to Binary mode.\nCommand:    PASV\nResponse:   227 Entering Passive Mode (192,168,99,100,178,35).\nCommand:    LIST\nError:  The data connection could not be established: ECONNREFUSED - Connection refused by server\n

\n

Answer 1

它适用于以下更改：

apiVersion: v1
    kind: Service
    metadata:
      name: ftps-alpine
      labels:
        run: ftps-alpine
    spec:
      type: NodePort
      ports:
      - port: 21
        targetPort: 21
        nodePort: 30025
        protocol: TCP
        name: ftp21
      - port: 20
        targetPort: 20
        protocol: TCP
        nodePort: 30026
        name: ftp20
      - port: 30020
        targetPort: 30020
        nodePort: 30020
        protocol: TCP
        name: ftp30020
      - port: 30021
        targetPort: 30021
        nodePort: 30021
        protocol: TCP
        name: ftp30021
      selector:
        run: ftps-alpine
    ---

    apiVersion: apps/v1
    kind: Deployment
    metadata:
      name: ftps-alpine
    spec:
      selector:
        matchLabels:
          run: ftps-alpine
      replicas: 1
      template:
        metadata:
          labels:
            run: ftps-alpine
        spec:
          containers:
          - name: ftps-alpine
            image: test_alpine
            imagePullPolicy: Never
            ports:
            - containerPort: 21
            - containerPort: 20
            - containerPort: 30020
            - containerPort: 30021

对于 vsftpd.conf ：

seccomp_sandbox=NO
pasv_promiscuous=NO
listen=YES
listen_ipv6=NO
anonymous_enable=NO
local_enable=YES
write_enable=YES
local_umask=022
dirmessage_enable=YES
use_localtime=YES
xferlog_enable=YES
connect_from_port_20=YES
chroot_local_user=YES
#secure_chroot_dir=/vsftpd/empty
pam_service_name=vsftpd
pasv_enable=YES
pasv_min_port=30020
pasv_max_port=30021
user_sub_token=$USER
local_root=/home/$USER/ftp
userlist_enable=YES
userlist_file=/etc/vsftpd.userlist
userlist_deny=NO
rsa_cert_file=/etc/ssl/private/vsftpd.pem
rsa_private_key_file=/etc/ssl/private/vsftpd.pem
ssl_enable=YES
allow_anon_ssl=NO
force_local_data_ssl=YES
force_local_logins_ssl=YES
ssl_tlsv1=YES
ssl_sslv2=NO
ssl_sslv3=NO
allow_writeable_chroot=YES
#listen_port=21
pasv_address=#minikube_ip#