问题：

GCP GKE入口无法访问后端服务，尽管健康检查、防火墙、服务和部署看起来都正确

危阳

2023-03-14

我正在尝试将node.js应用程序（工件注册表中的Dockerize）部署到GCP库伯内特斯集群中......然后还将服务/部署放在入口后面，以便我们的静态前端可以通过CORS与此应用程序通信。

我可以在不使用入口的情况下让服务正常工作（只是一个标准的服务/部署），但由于CORS错误，前端无法与之通信。经过研究，我了解到我应该创建一个入口来控制此场景的流量。

应用程序部署配置为在任何位置的端口80上运行（在Docker/app和节点端口/targetPort中）。

我主要完成的步骤有：

创建一个新的GKE集群（启用HTTP负载平衡，但我不确定这是否必要，因为下面的入口定义会自动创建自己的负载平衡器）

然后我应用了这个部署服务入口配置：kubectl应用-fdeployment.yaml：

# Main api deployment
kind: Deployment
apiVersion: apps/v1
metadata:
    name: adcloud-api
spec:
    selector:
        matchLabels:
            app: adcloud-api
    replicas: 1
    template:
        metadata:
            labels:
                app: adcloud-api
        spec:

            containers:
                - name: adcloud-api
                  image: gcr.io/ad-cloud-328718/adcloud/adcloud-web-api-image:v1
                  imagePullPolicy: IfNotPresent
                  ports:
                  - containerPort: 80
                    protocol: TCP
                  resources:
                      requests:
                          memory: "32Mi"
                          cpu: "100m"
                      limits:
                          memory: "128Mi"
                          cpu: "250m"
---
# Service for the above deployment
kind: Service
apiVersion: v1
metadata:
    name: adcloud-api
    annotations:
        cloud.google.com/backend-config: '{"ports": {"80":"adcloud-api-backendconfig"}, "default": "adcloud-api-backendconfig"}'
spec:
    #3type: LoadBalancer
    type: NodePort
    selector:
        app: adcloud-api
    ports:
        - protocol: TCP
          port: 80
          targetPort: 80
          nodePort: 32001
---
kind: BackendConfig
apiVersion: cloud.google.com/v1
metadata:
    name: adcloud-api-backendconfig
spec:
    healthCheck:
        # timeoutSec: 10
        # checkIntervalSec: 30
        requestPath: /health
        port: 80
        type: HTTP
  ---
# Ingress for the above service
kind: Ingress
apiVersion: networking.k8s.io/v1
metadata:
    name: api-ingress
    annotations:
        kubernetes.io/ingress.class: "gce"
        gce.ingress.kubernetes.io/enable-cors: "true"
        gce.ingress.kubernetes.io/cors-allow-credentials: "true"
        gce.ingress.kubernetes.io/cors-allow-methods: "GET, POST, PUT, PATCH, DELETE, OPTIONS"
        gce.ingress.kubernetes.io/cors-allow-origin: "*"
spec:
    rules:
        - http:
              paths:
                  - path: /*
                    pathType: ImplementationSpecific
                    backend:
                        service:
                            name: adcloud-api
                            port:
                                number: 80

您可以看到此后端服务的目标是nodePort 32001。这是正确的吗？我有应用程序的Dockerfile只公开端口80，并且在其他任何地方都定义了端口80（即。在健康检查中）。这里的后端服务应该也使用端口80，还是应该使用nodePort 32001？有一些内部代理处理吗？

kubectl描述的入口是：

$ kubectl describe ingress
Name:             api-ingress
Namespace:        default
Address:          35.227.241.142
Default backend:  default-http-backend:80 (10.0.17.5:8080)
Rules:
  Host        Path  Backends
  ----        ----  --------
  *
              /*   adcloud-api:80 (10.0.17.6:80)
Annotations:  gce.ingress.kubernetes.io/cors-allow-credentials: true
              gce.ingress.kubernetes.io/cors-allow-methods: GET, POST, PUT, PATCH, DELETE, OPTIONS
              gce.ingress.kubernetes.io/cors-allow-origin: *
              gce.ingress.kubernetes.io/enable-cors: true
              ingress.kubernetes.io/backends: {"k8s-be-32001--8950a5f3e6292d2e":"Unknown","k8s-be-32722--8950a5f3e6292d2e":"Unknown"}
              ingress.kubernetes.io/forwarding-rule: k8s2-fr-nto0o9ht-default-api-ingress-vo6louo7
              ingress.kubernetes.io/target-proxy: k8s2-tp-nto0o9ht-default-api-ingress-vo6louo7
              ingress.kubernetes.io/url-map: k8s2-um-nto0o9ht-default-api-ingress-vo6louo7
              kubernetes.io/ingress.class: gce
Events:
  Type    Reason     Age                From                     Message
  ----    ------     ----               ----                     -------
  Normal  Sync       35m                loadbalancer-controller  UrlMap "k8s2-um-nto0o9ht-default-api-ingress-vo6louo7" created
  Normal  Sync       35m                loadbalancer-controller  TargetProxy "k8s2-tp-nto0o9ht-default-api-ingress-vo6louo7" created
  Normal  Sync       34m                loadbalancer-controller  ForwardingRule "k8s2-fr-nto0o9ht-default-api-ingress-vo6louo7" created
  Normal  IPChanged  34m                loadbalancer-controller  IP is now 35.227.241.142
  Normal  Sync       12m (x5 over 35m)  loadbalancer-controller  Scheduled for sync

kubectl描述pods是：

$ kubectl describe pods
Name:         adcloud-api-5cb96bb47d-tmrd8
Namespace:    default
Priority:     0
Node:         gke-adcloud-cluster-default-pool-6f91d4e7-z7ks/10.128.15.216
Start Time:   Wed, 27 Oct 2021 00:51:50 -0400
Labels:       app=adcloud-api
              pod-template-hash=5cb96bb47d
Annotations:  <none>
Status:       Running
IP:           10.0.17.6
IPs:
  IP:           10.0.17.6
Controlled By:  ReplicaSet/adcloud-api-5cb96bb47d
Containers:
  adcloud-api:
    Container ID:   containerd://ebd1b857c541b8fdc52dcc6e44d4617d9558bd7e16783a5a016d5bdd1cce7370
    Image:          gcr.io/ad-cloud-328718/adcloud/adcloud-web-api-image:v1
    Image ID:       gcr.io/ad-cloud-328718/adcloud/adcloud-web-api-image@sha256:932e59850992e37854242cac9e70ca65eb52863f63c795d892c84671dca4ba68
    Port:           80/TCP
    Host Port:      0/TCP
    State:          Running
      Started:      Wed, 27 Oct 2021 02:19:48 -0400
    Ready:          True
    Restart Count:  0
    Limits:
      cpu:     250m
      memory:  128Mi
    Requests:
      cpu:        100m
      memory:     32Mi
    Environment:  <none>
    Mounts:
      /var/run/secrets/kubernetes.io/serviceaccount from default-token-4xcjx (ro)
Conditions:
  Type              Status
  Initialized       True
  Ready             True
  ContainersReady   True
  PodScheduled      True
Volumes:
  default-token-4xcjx:
    Type:        Secret (a volume populated by a Secret)
    SecretName:  default-token-4xcjx
    Optional:    false
QoS Class:       Burstable
Node-Selectors:  <none>
Tolerations:     node.kubernetes.io/not-ready:NoExecute op=Exists for 300s
                 node.kubernetes.io/unreachable:NoExecute op=Exists for 300s
Events:
  Type     Reason        Age                From             Message
  ----     ------        ----               ----             -------
  Warning  FailedMount   53m                kubelet          MountVolume.SetUp failed for volume "default-token-4xcjx" : failed to sync secret cache: timed out waiting for the condition
  Normal   Pulling       53m                kubelet          Pulling image "gcr.io/ad-cloud-328718/adcloud/adcloud-web-api-image:v1"
  Normal   Pulled        52m                kubelet          Successfully pulled image "gcr.io/ad-cloud-328718/adcloud/adcloud-web-api-image:v1" in 52.167675207s
  Normal   Created       52m                kubelet          Created container adcloud-api
  Normal   Started       52m                kubelet          Started container adcloud-api
  Normal   Pulling       34m                kubelet          Pulling image "gcr.io/ad-cloud-328718/adcloud/adcloud-web-api-image:v1"
  Normal   Pulled        34m                kubelet          Successfully pulled image "gcr.io/ad-cloud-328718/adcloud/adcloud-web-api-image:v1" in 29.499249423s
  Normal   Started       34m                kubelet          Started container adcloud-api
  Normal   Created       34m                kubelet          Created container adcloud-api
  Warning  NodeNotReady  16m (x7 over 95m)  node-controller  Node is not ready
  Normal   Pulling       14m                kubelet          Pulling image "gcr.io/ad-cloud-328718/adcloud/adcloud-web-api-image:v1"
  Normal   Pulled        13m                kubelet          Successfully pulled image "gcr.io/ad-cloud-328718/adcloud/adcloud-web-api-image:v1" in 27.814932495s
  Normal   Created       13m                kubelet          Created container adcloud-api
  Normal   Started       13m                kubelet          Started container adcloud-api

我真的不知道是什么阻止了单一后端服务的不健康性质，为什么它无法进行健康检查。

这些是因为健康检查失败而无法访问，还是因为无法访问而导致健康检查失败？有人对这里可能发生的其他事情有什么建议吗？除了上面的部署定义文件之外，我还需要进行任何网络配置吗？运行状况检查应该在开放的应用程序端口（即80）上运行，还是在临时节点端口（即32001）上运行？

我已经做了几天了，非常感谢您的帮助！

慕逸仙

2023-03-14

通常的做法是使用不同的端口和目标端口。查看文档中的示例服务
我还注意到您注释掉了Loadbalancer，并将服务类型更改为NodePort。确保所有yaml文件的设置都对齐。

如果所有设置都正确且问题仍然存在，请启用GKE日志记录并联系Google支持或通过公共问题跟踪程序报告问题。

GCP GKE入口无法访问后端服务，尽管健康检查、防火墙、服务和部署看起来都正确

共有1个答案

相关问答

相关文章

相关阅读

相关工具

相关文档