K8s - 无法从另一个节点访问服务/集群IP

Question

我正在尝试通过服务/ClusterIP 访问（从工作节点）一个 pod（在工作节点上），curl http://cluster_ip:port_no但它不工作。

这是有关服务的一些信息

masternode@Master:/localdocker$ kubectl describe svc registry
Name:              registry
Namespace:         default
Labels:            io.kompose.service=registry
Annotations:       kompose.cmd: kompose convert -f docker-compose.yaml -o localregistry.yaml
                   kompose.version: 1.1.0 (36652f6)
Selector:          io.kompose.service=registry
Type:              ClusterIP
IP:                10.100.126.230
Port:              5000  5000/TCP
TargetPort:        5000/TCP
Endpoints:         192.168.171.74:5000
Session Affinity:  None
Events:            <none>```

这是有关 pod 的一些信息

masternode@Master:/localdocker$ kubectl describe pod registry-7ccd695dc7-69cx4
Name:         registry-7ccd695dc7-69cx4
Namespace:    default
Priority:     0
Node:         worker/10.0.1.5
Start Time:   Sun, 19 Jul 2020 06:09:14 +0000
Labels:       io.kompose.service=registry
              pod-template-hash=7ccd695dc7
Annotations:  cni.projectcalico.org/podIP: 192.168.171.74/32
              cni.projectcalico.org/podIPs: 192.168.171.74/32
Status:       Running
IP:           192.168.171.74
IPs:
  IP:           192.168.171.74
Controlled By:  ReplicaSet/registry-7ccd695dc7
Containers:
  registry:
    Container ID:   docker://ca372f12ef7a1a3cb23e7d6c58337f47848f91212f6c75af6bfd04bc48ea2f27
    Image:          registry:2
    Image ID:       docker-pullable://registry@sha256:8be26f81ffea54106bae012c6f349df70f4d5e7e2ec01b143c46e2c03b9e551d
    Port:           5000/TCP
    Host Port:      0/TCP
    State:          Running
      Started:      Sun, 19 Jul 2020 06:09:24 +0000
    Ready:          True
    Restart Count:  0
    Environment:
      REGISTRY_STORAGE_FILESYSTEM_ROOTDIRECTORY:  /data
    Mounts:
      /data from registry-claim0 (rw)
      /var/run/secrets/kubernetes.io/serviceaccount from default-token-fhf5k (ro)
Conditions:
  Type              Status
  Initialized       True
  Ready             True
  ContainersReady   True
  PodScheduled      True
Volumes:
  registry-claim0:
    Type:       PersistentVolumeClaim (a reference to a PersistentVolumeClaim in the same namespace)
    ClaimName:  registry-claim0
    ReadOnly:   false
  default-token-fhf5k:
    Type:        Secret (a volume populated by a Secret)
    SecretName:  default-token-fhf5k
    Optional:    false
QoS Class:       BestEffort
Node-Selectors:  <none>
Tolerations:     node.kubernetes.io/not-ready:NoExecute for 300s
                 node.kubernetes.io/unreachable:NoExecute for 300s
Events:
  Type    Reason     Age   From               Message
  ----    ------     ----  ----               -------
  Normal  Scheduled  13m   default-scheduler  Successfully assigned default/registry-7ccd695dc7-69cx4 to worker
  Normal  Pulling    13m   kubelet, worker    Pulling image "registry:2"
  Normal  Pulled     13m   kubelet, worker    Successfully pulled image "registry:2"
  Normal  Created    13m   kubelet, worker    Created container registry
  Normal  Started    13m   kubelet, worker    Started container registry

这是一个练习练习，我能够在没有任何 NodePort 的情况下（在他们的实时环境中）这样做。

如果需要任何其他信息，请告诉我。

Answer 1

这是预期的行为，因为ClusterIP类型服务只能从 kubernetes 集群内访问，即从另一个 pod 等访问。

如果您想通过 kubernetes 集群外部的服务（即从节点本身）访问 pod，则使用NodePort类型的服务。

一旦您通过NodePort服务公开它，您就可以使用curl http://<NODE-IP>:<NODE-PORT>

ClusterIP在集群的服务网络上创建，节点在不同的网络中。通过创建NodePort服务，在每个节点网络中打开一个端口以将流量转发到ClusterIP. 所以本质上是内部NodePort使用ClusterIP，是建立在ClusterIP.