kubernetes 如何将 pod 暴露给集群机器之外的东西？

Question

我阅读了以下kubernetes 文档，这些文档导致以下 yaml 在集群中运行 postgresql 和 pgadmin：

--- pgadmin-deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: pgadmin-deployment
spec:
  replicas: 1
  selector:
    matchLabels:
      app: pgadmin-pod
  template:
    metadata:
      labels:
        app: pgadmin-pod
    spec:
      containers:
        - name: pgadmin-container
          image: dpage/pgadmin4
          imagePullPolicy: "IfNotPresent"
          ports:
            - containerPort: 80
          env:
            - name: PGADMIN_DEFAULT_EMAIL
              value: email@example.com
            - name: PGADMIN_DEFAULT_PASSWORD
              value: password

--- pgadmin-service.yaml
apiVersion: v1
kind: Service
metadata:
  name: pgadmin-service
spec:
  type: NodePort
  ports:
    - port: 30000
      targetPort: 80
  selector:
    app: pgadmin-pod

--- postgres-deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: postgres-deployment
spec:
  replicas: 1
  selector:
    matchLabels:
      app: postgres-pod
  template:
    metadata:
      labels:
        app: postgres-pod
    spec:
      containers:
        - name: postgres-container
          image: postgres:9.6-alpine
          imagePullPolicy: "IfNotPresent"
          ports:
            - containerPort: 5432
          env:
            - name: POSTGRES_DB
              value: database
            - name: POSTGRES_PASSWORD
              value: password
            - name: POSTGRES_USER
              value: username
          volumeMounts:
            - mountPath: /var/lib/postgresql/data
              name: postgrepvc
      volumes:
        - name: postgrepvc
          persistentVolumeClaim:
            claimName: postgres-pv-claim

--- postgres-service.yaml
apiVersion: v1
kind: Service
metadata:
  name: postgres-service
spec:
  type: NodePort
  ports:
    - port: 30001
      targetPort: 5432
  selector:
    app: postgres-pod

--- postgres-storage.yaml
postgres-storage.yaml
kind: PersistentVolume
apiVersion: v1
metadata:
  name: postgres-pv-volume
  labels:
    type: local
    app: postgres
spec:
  storageClassName: manual
  capacity:
    storage: 5Gi
  accessModes:
    - ReadWriteMany
  hostPath:
    path: "/mnt/data"
---
kind: PersistentVolumeClaim
apiVersion: v1
metadata:
  name: postgres-pv-claim
  labels:
    app: postgres
spec:
  storageClassName: manual
  accessModes:
    - ReadWriteMany
  resources:
    requests:
      storage: 5Gi

然后，我运行以下命令kubectl create -f ./，结果如下： kubernetes pods / svc's

然后我尝试从集群外部访问 10.43.225.170:30000 上的 pgAdmin，但我得到“10.43.225.170 响应时间太长”。无论我尝试什么。

那么我如何向外界公开 pgAdmin 和 postgress，有没有办法给它们静态 ip，这样我就不必每次在 kubernetes 上重新部署时更新连接字符串中的 ip，或者我必须使用有状态集吗？

Answer 1

这里有问题

1. 您正在尝试访问节点内部 IP， 10.43.225.170而不是外部IP。
2. nodePort 服务配置不正确。此外，您尝试调用不正确的端口

您还没有指定您使用的平台。我正在使用 GKE，所以就我而言，它更容易，因为我在集群节点创建期间自动分配了外部 IP。但我必须手动创建入口防火墙规则以允许从外部访问节点和所需端口（30000,30001）

在任何情况下，为了能够使用nodePort- 您应该将外部 IP 地址分配给集群中的节点之一，并设置允许进入该端口的流量的防火墙规则

接下来。您正在尝试拨打电话<NodeIP>:spec.ports[*].port。

根据Type NodePort 文档：

服务可见为<NodeIP>:spec.ports[*].nodePort

您需要显式指定nodePort

我对你的部署做了一些更改，部署后可以访问 pgAdmin 并在防火墙中打开相应的端口。

apiVersion: apps/v1
kind: Deployment
metadata:
  name: pgadmin-deployment
spec:
  replicas: 1
  selector:
    matchLabels:
      app: pgadmin-pod
  template:
    metadata:
      labels:
        app: pgadmin-pod
    spec:
      containers:
        - name: pgadmin-container
          image: dpage/pgadmin4
          imagePullPolicy: "IfNotPresent"
          ports:
            - containerPort: 80
          env:
            - name: PGADMIN_DEFAULT_EMAIL
              value: email@example.com
            - name: PGADMIN_DEFAULT_PASSWORD
              value: password

---
apiVersion: v1
kind: Service
metadata:
  name: pgadmin-service
spec:
  type: NodePort
  ports:
    - nodePort: 30000
      targetPort: 80
      port: 80
  selector:
    app: pgadmin-pod

--- postgres-deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: postgres-deployment
spec:
  replicas: 1
  selector:
    matchLabels:
      app: postgres-pod
  template:
    metadata:
      labels:
        app: postgres-pod
    spec:
      containers:
        - name: postgres-container
          image: postgres:9.6-alpine
          imagePullPolicy: "IfNotPresent"
          ports:
            - containerPort: 5432
          env:
            - name: POSTGRES_DB
              value: database
            - name: POSTGRES_PASSWORD
              value: password
            - name: POSTGRES_USER
              value: username
          volumeMounts:
            - mountPath: /var/lib/postgresql/data
              name: postgrepvc
      volumes:
        - name: postgrepvc
          persistentVolumeClaim:
            claimName: postgres-pv-claim

---
apiVersion: v1
kind: Service
metadata:
  name: postgres-service
spec:
  type: NodePort
  ports:
    - nodePort: 30001
      targetPort: 5432
      port: 5432
  selector:
    app: postgres-pod

---
kind: PersistentVolume
apiVersion: v1
metadata:
  name: postgres-pv-volume
  labels:
    type: local
    app: postgres
spec:
  storageClassName: manual
  capacity:
    storage: 5Gi
  accessModes:
    - ReadWriteMany
  hostPath:
    path: "/mnt/data"
---
kind: PersistentVolumeClaim
apiVersion: v1
metadata:
  name: postgres-pv-claim
  labels:
    app: postgres
spec:
  storageClassName: manual
  accessModes:
    - ReadWriteMany
  resources:
    requests:
      storage: 5Gi

查看：

kubectl apply -f pg_my.yaml
deployment.apps/pgadmin-deployment created
service/pgadmin-service created
service/postgres-service created
persistentvolume/postgres-pv-volume created
persistentvolumeclaim/postgres-pv-claim created


#In my case I take node external ip from any node from `kubectl get nodes -o wide` output:
NAME                                       STATUS   ROLES    AGE   VERSION            INTERNAL-IP   EXTERNAL-IP
gke-cluster-1-default-pool-*******-*****   Ready    <none>   20d   v1.18.16-gke.502   10.186.0.7    *.*.*.*

curl *.*.*.*:30000
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">
<title>Redirecting...</title>
<h1>Redirecting...</h1>
<p>You should be redirected automatically to target URL: <a href="/login?next=%2F">/login?next=%2F</a>.