k8s的NodePort类型的service组件以及遇到的问题

k8s中service组件有三个类型
ClusterIP，NodePort，Loadbalancer

Cluster类型是k8s各node之间的内网通信，默认类型
Nodeport类型则是在ClusterIP基础上暴露出一个随机端口至外部[NodeIP]:[NodePort]，可让外部进行访问，默认端口范围30000~32767
Loadbalancer类型一般是和云负载一起使用，一般都是运行在云环境上的k8s一起使用。

本篇内容着重对Nodeport类型进行示例；

创建一个nginx的Deployment

[root@master1 demo]# kubectl create deployment nginx-deployment  --image=nginx1.8 --dry-run -o=yaml > nginx-deployment.yaml

修改yaml文件

[root@master1 demo]# cat nginx-deployment.yaml 
apiVersion: apps/v1
kind: Deployment
metadata:
labels:
app: nginx-deployment
name: nginx-deployment
spec:
replicas: 1
selector:
matchLabels:
    app: nginx-deployment
template:
metadata:
    labels:
    app: nginx-deployment
spec:
    containers:
    - image: nginx:1.8
    name: nginx
    ports:
    - containerPort: 80

创建service类型为NodePort

[root@master1 demo]# kubectl expose deployment nginx-deployment --protocol=TCP --port=80 --target-port=80 --type=NodePort --dry-run -o=yaml > nginx-deploy-service.yaml

修改yaml文件

[root@master1 demo]# cat nginx-deploy-service.yaml 
apiVersion: v1
kind: Service
metadata:
labels:
app: nginx-deployment
name: nginx-deployment
spec:
ports:
- port: 80
protocol: TCP
targetPort: 80
selector:
app: nginx-deployment
type: NodePort

selector:
app: nginx-deployment
这个标签是对应的Deployment的app标签。

创建并查看service

[root@master1 demo]# kubectl create -f nginx-deploy-service.yaml 
service/nginx-deployment created
[root@master1 demo]# kubectl get svc
NAME               TYPE        CLUSTER-IP   EXTERNAL-IP   PORT(S)        AGE
kubernetes         ClusterIP   10.0.0.1     <none>        443/TCP        6d7h
nginx-deployment   NodePort    10.0.0.238   <none>        80:32256/TCP   5s

本地访问一下端口，并测试外部Node节点ip的端口

[root@master1 demo]# curl 10.0.0.238 32256
<!DOCTYPE html>
<html>
<head>
<title>Welcome to nginx!</title>
<style>
    body {
        width: 35em;
        margin: 0 auto;
        font-family: Tahoma, Verdana, Arial, sans-serif;
    }
</style>
</head>
<body>
<h1>Welcome to nginx!</h1>
<p>If you see this page, the nginx web server is successfully installed and
working. Further configuration is required.</p>

<p>For online documentation and support please refer to
<a href="http://nginx.org/">nginx.org</a>.<br/>
Commercial support is available at
<a href="http://nginx.com/">nginx.com</a>.</p>

<p><em>Thank you for using nginx.</em></p>
</body>
</html>
curl: (7) Failed to connect to 0.0.126.0: 无效的参数

本地浏览器访问任意node节点ip演示

如果你的端口只能在生成pod节点node上或者此node节点ip上访问，外部无法访问，则说明node节点配置的iptables的FORWARD链是有问题的(默认全部DROP，应该改成ACCEPT)

如图所示

我们的集群replicas=1，scheduler通过计算绑定到172.16.1.76节点，NodePort端口为32256
NodePort类型的service组件会在每个Node节点都会监听32256端口，但是只能访问172.16.1.76节点才能正常访问，访问75和77节点就无法正常通信，那说明我们的iptables有问题

执行下列命令：

iptables -P FORWARD ACCEPT*

就可以正常访问，但是这样修改iptables只能临时生效，重启node节点就会失效。

永久解决方案(修改docker.service文件，每次docker启动自动修改FORWARD链)：

[root@k8s-master ~]# vim /usr/lib/systemd/system/docker.service
[Service]
............
ExecStartPost=/sbin/iptables -I FORWARD -s 0.0.0.0/0 -j **ACCEPT**

systemctl daemon-reload
systemctl restart docker

k8s的NodePort类型的service组件以及遇到的问题