EKS Fargate pods无法从互联网访问。

huangapple
go评论87阅读模式
英文:

EKS Fargate pods unreachable from internet

问题

我正在尝试创建EKS Fargate集群并部署一个具有1个端点的示例Spring Boot应用程序，我成功地使用以下CloudFormation脚本创建了堆栈：

  1. ---
  2. AWSTemplateFormatVersion: '2010-09-09'
  3. Description: 'AWS CloudFormation template for EKS Fargate managed Kubernetes cluster with exposed endpoints'
  4. # ... (此处省略了一些内容) ...

我运行以下命令来为Fargate打补丁CoreDNS：

  1. kubectl patch deployment coredns \
  2.     -n kube-system \
  3.     --type json \
  4.     -p='[{"op": "remove", "path": "/spec/template/metadata/annotations/eks.amazonaws.com~1compute-type"}]'

然后，我使用以下Kubernetes清单从公共ECR部署我的示例应用程序映像：

  1. ---
  2. apiVersion: apps/v1
  3. kind: Deployment
  4. metadata:
  5.   name: example-app
  6. # ... (此处省略了一些内容) ...

然后，当我运行：

  1. kubectl get svc

我看到以下结果：

  1. NAME              TYPE           CLUSTER-IP      EXTERNAL-IP                                                                  PORT(S)        AGE
  2. example-service   LoadBalancer   172.20.228.77   aa0116829ac2647a7bf39a97bffb0183-1208408433.eu-central-1.elb.amazonaws.com   80:31915/TCP   16m
  3. kubernetes        ClusterIP      172.20.0.1      <none>                                                                       443/TCP        29m

但是，当我尝试访问LoadBalancer example-service的EXTERNAL-IP时，我收到空响应，我无法访问我的应用程序仅在Spring Boot应用程序中定义的路径：/api/v1/info

  1. server.port=8080
  2. server.servlet.context-path=/api/v1

我漏掉了什么？

一些信息：

  • 我的Pod成功启动，当我运行kubectl logs pod-name时，我可以看到Spring Boot的日志记录。
  • 我的CoreDNS Pod也正常启动。
  • 我使用busybox来测试我的集群的DNS，似乎一切正常。

你可能需要检查以下几点来解决问题：

  1. 确保LoadBalancer example-service的EXTERNAL-IP已经分配，并且状态正常。
  2. 检查Security Group和Network ACL规则，确保它们允许流量通过LoadBalancer到达Pod。
  3. 确保你的Spring Boot应用程序在端口8080上正在监听，并且路径"/api/v1/info"已正确设置。
  4. 检查CoreDNS是否正确配置，确保DNS解析正常工作。
  5. 如果你有网络策略(Network Policies)或其他Kubernetes网络配置，请确保它们没有阻止流量到达你的应用程序。

希望这些提示对你有所帮助，帮助你解决问题。

英文:

I am trying to create EKS Fargate cluster and deploy example Spring Boot application with 1 endpoint, I successfully create stack with following CloudFormation script:

  1. ---
  2. AWSTemplateFormatVersion: &#39;2010-09-09&#39;
  3. Description: &#39;AWS CloudFormation template for EKS Fargate managed Kubernetes cluster with exposed endpoints&#39;
  5. Resources:
  6.   VPC:
  7.     Type: AWS::EC2::VPC
  8.     Properties:
  9.       CidrBlock: 10.0.0.0/16
  10.       EnableDnsSupport: true
  11.       EnableDnsHostnames: true
  13.   InternetGateway:
  14.     Type: AWS::EC2::InternetGateway
  16.   VPCGatewayAttachment:
  17.     Type: AWS::EC2::VPCGatewayAttachment
  18.     Properties:
  19.       VpcId: !Ref VPC
  20.       InternetGatewayId: !Ref InternetGateway
  22.   PublicSubnet:
  23.     Type: AWS::EC2::Subnet
  24.     Properties:
  25.       VpcId: !Ref VPC
  26.       CidrBlock: 10.0.2.0/24
  27.       MapPublicIpOnLaunch: true
  28.       AvailabilityZone: !Select [ 0, !GetAZs &#39;&#39; ]
  30.   PrivateSubnetA:
  31.     Type: AWS::EC2::Subnet
  32.     Properties:
  33.       VpcId: !Ref VPC
  34.       CidrBlock: 10.0.0.0/24
  35.       AvailabilityZone: !Select [ 0, !GetAZs &#39;&#39; ]
  37.   PrivateSubnetB:
  38.     Type: AWS::EC2::Subnet
  39.     Properties:
  40.       VpcId: !Ref VPC
  41.       CidrBlock: 10.0.1.0/24
  42.       AvailabilityZone: !Select [ 1, !GetAZs &#39;&#39; ]
  44.   PublicRouteTable:
  45.     Type: AWS::EC2::RouteTable
  46.     Properties:
  47.       VpcId: !Ref VPC
  49.   PublicRoute:
  50.     Type: AWS::EC2::Route
  51.     Properties:
  52.       RouteTableId: !Ref PublicRouteTable
  53.       DestinationCidrBlock: 0.0.0.0/0
  54.       GatewayId: !Ref InternetGateway
  56.   SubnetRouteTableAssociationA:
  57.     Type: AWS::EC2::SubnetRouteTableAssociation
  58.     Properties:
  59.       SubnetId: !Ref PublicSubnet
  60.       RouteTableId: !Ref PublicRouteTable
  62.   EIP:
  63.     Type: AWS::EC2::EIP
  65.   NatGateway:
  66.     Type: AWS::EC2::NatGateway
  67.     Properties:
  68.       SubnetId: !Ref PublicSubnet
  69.       AllocationId: !GetAtt EIP.AllocationId
  71.   PrivateRouteTable:
  72.     Type: AWS::EC2::RouteTable
  73.     Properties:
  74.       VpcId: !Ref VPC
  76.   PrivateRoute:
  77.     Type: AWS::EC2::Route
  78.     Properties:
  79.       RouteTableId: !Ref PrivateRouteTable
  80.       DestinationCidrBlock: 0.0.0.0/0
  81.       NatGatewayId: !Ref NatGateway
  83.   PrivateSubnetRouteTableAssociationA:
  84.     Type: AWS::EC2::SubnetRouteTableAssociation
  85.     Properties:
  86.       SubnetId: !Ref PrivateSubnetA
  87.       RouteTableId: !Ref PrivateRouteTable
  89.   PrivateSubnetRouteTableAssociationB:
  90.     Type: AWS::EC2::SubnetRouteTableAssociation
  91.     Properties:
  92.       SubnetId: !Ref PrivateSubnetB
  93.       RouteTableId: !Ref PrivateRouteTable
  95.   EKSCluster:
  96.     Type: AWS::EKS::Cluster
  97.     Properties:
  98.       Name: EKSFargateCluster
  99.       Version: &#39;1.26&#39;
  100.       ResourcesVpcConfig:
  101.         SubnetIds:
  102.           - !Ref PrivateSubnetA
  103.           - !Ref PrivateSubnetB
  104.       RoleArn: !GetAtt EKSClusterRole.Arn
  106.   FargateProfile:
  107.     Type: AWS::EKS::FargateProfile
  108.     Properties:
  109.       ClusterName: !Ref EKSCluster
  110.       FargateProfileName: FargateProfile
  111.       PodExecutionRoleArn: !GetAtt FargatePodExecutionRole.Arn
  112.       Selectors:
  113.         - Namespace: default
  114.       Subnets:
  115.         - !Ref PrivateSubnetA
  116.         - !Ref PrivateSubnetB
  118.   FargateProfileCoredns:
  119.     Type: AWS::EKS::FargateProfile
  120.     Properties:
  121.       ClusterName: !Ref EKSCluster
  122.       FargateProfileName: CorednsProfile
  123.       PodExecutionRoleArn: !GetAtt FargatePodExecutionRole.Arn
  124.       Selectors:
  125.         - Namespace: kube-system
  126.           Labels:
  127.             - Key: k8s-app
  128.               Value: kube-dns
  129.       Subnets:
  130.         - !Ref PrivateSubnetA
  131.         - !Ref PrivateSubnetB
  133.   FargatePodExecutionRole:
  134.     Type: AWS::IAM::Role
  135.     Properties:
  136.       AssumeRolePolicyDocument:
  137.         Version: &#39;2012-10-17&#39;
  138.         Statement:
  139.           - Effect: Allow
  140.             Principal:
  141.               Service:
  142.                 - eks-fargate-pods.amazonaws.com
  143.             Action:
  144.               - sts:AssumeRole
  145.       ManagedPolicyArns:
  146.         - arn:aws:iam::aws:policy/AmazonEKSFargatePodExecutionRolePolicy
  148.   EKSClusterRole:
  149.     Type: AWS::IAM::Role
  150.     Properties:
  151.       AssumeRolePolicyDocument:
  152.         Version: &#39;2012-10-17&#39;
  153.         Statement:
  154.           - Effect: Allow
  155.             Principal:
  156.               Service:
  157.                 - eks.amazonaws.com
  158.             Action:
  159.               - sts:AssumeRole
  160.       ManagedPolicyArns:
  161.         - arn:aws:iam::aws:policy/AmazonEKSClusterPolicy
  162.         - arn:aws:iam::aws:policy/AmazonEKSVPCResourceController

I run following command to path the CoreDNS for Fargate:

  1. kubectl patch deployment coredns \
  2.     -n kube-system \
  3.     --type json \
  4.     -p=&#39;[{&quot;op&quot;: &quot;remove&quot;, &quot;path&quot;: &quot;/spec/template/metadata/annotations/eks.amazonaws.com~1compute-type&quot;}]&#39;

Then I deploy my example application image from public ECR with following kubernetes manifest:

  1. ---
  2. apiVersion: apps/v1
  3. kind: Deployment
  4. metadata:
  5.   name: example-app
  6. spec:
  7.   replicas: 2
  8.   selector:
  9.     matchLabels:
  10.       app: example-app
  11.   template:
  12.     metadata:
  13.       labels:
  14.         app: example-app
  15.     spec:
  16.       containers:
  17.         - name: ventu
  18.           image: public.ecr.aws/not_real_url/public_ecr_name:latest
  19.           ports:
  20.             - containerPort: 8080
  22. ---
  23. apiVersion: v1
  24. kind: Service
  25. metadata:
  26.   name: example-service
  27. spec:
  28.   type: LoadBalancer
  29.   selector:
  30.     app: example-app
  31.   ports:
  32.     - protocol: TCP
  33.       port: 80
  34.       targetPort: 8080

Then when I run:

  1. kubectl get svc

I see result:

  1. NAME              TYPE           CLUSTER-IP      EXTERNAL-IP                                                                  PORT(S)        AGE
  2. example-service   LoadBalancer   172.20.228.77   aa0116829ac2647a7bf39a97bffb0183-1208408433.eu-central-1.elb.amazonaws.com   80:31915/TCP   16m
  3. kubernetes        ClusterIP      172.20.0.1      &lt;none&gt;                                                                       443/TCP        29m

However when I try to reach the EXTERNAL-IP on my LoadBalancer example-service, I get empty response, I can't reach my application on only path defined in my Spring Boot application: /api/v1/info

  1. server.port=8080
  2. server.servlet.context-path=/api/v1

What am I missing?

Couple of information:

  • my pods spin up successfully, I can see Spring Boot logging when I run kubectl logs pod-name
  • my coredns pods spin up correctly as well
  • I use busybox to test my cluster's dns, and everything seems to be working too

答案1

得分: 2

I solved my issue, by following this guide

然后，我将生成的堆栈导出到我的CloudFormation脚本中。

然后，为了部署我的应用程序，我更新了我的Kubernetes清单如下：

apiVersion: v1
kind: Namespace
metadata:
name: example

apiVersion: apps/v1
kind: Deployment
metadata:
namespace: example
name: deployment-example-be-app
spec:
selector:
matchLabels:
app.kubernetes.io/name: example-be-app
replicas: 2
template:
metadata:
labels:
app.kubernetes.io/name: example-be-app
spec:
containers:
- name: example-be-app
image: public.ecr.aws/fake_url/example:latest
imagePullPolicy: Always
ports:
- containerPort: 8080

apiVersion: v1
kind: Service
metadata:
namespace: example
name: service-example-be-app
annotations:
service.beta.kubernetes.io/aws-load-balancer-nlb-target-type: ip
service.beta.kubernetes.io/aws-load-balancer-type: external
service.beta.kubernetes.io/aws-load-balancer-scheme: internet-facing
spec:
type: LoadBalancer
ports:
- port: 80
targetPort: 8080
protocol: TCP
selector:
app.kubernetes.io/name: example-be-app

现在我可以通过浏览器访问我的示例应用程序。

英文:

I solved my issue, by following this guide

I then exported resulting stack into my CloudFormation script.

Then to deploy my application I updated my kubernetes manifest to:

  1. ---
  2. apiVersion: v1
  3. kind: Namespace
  4. metadata:
  5.   name: example
  6. ---
  7. apiVersion: apps/v1
  8. kind: Deployment
  9. metadata:
  10.   namespace: example
  11.   name: deployment-example-be-app
  12. spec:
  13.   selector:
  14.     matchLabels:
  15.       app.kubernetes.io/name: example-be-app
  16.   replicas: 2
  17.   template:
  18.     metadata:
  19.       labels:
  20.         app.kubernetes.io/name: example-be-app
  21.     spec:
  22.       containers:
  23.         - name: example-be-app
  24.           image: public.ecr.aws/fake_url/example:latest
  25.           imagePullPolicy: Always
  26.           ports:
  27.             - containerPort: 8080
  28. ---
  29. apiVersion: v1
  30. kind: Service
  31. metadata:
  32.   namespace: example
  33.   name: service-example-be-app
  34.   annotations:
  35.     service.beta.kubernetes.io/aws-load-balancer-nlb-target-type: ip
  36.     service.beta.kubernetes.io/aws-load-balancer-type: external
  37.     service.beta.kubernetes.io/aws-load-balancer-scheme: internet-facing
  38. spec:
  39.   type: LoadBalancer
  40.   ports:
  41.     - port: 80
  42.       targetPort: 8080
  43.       protocol: TCP
  44.   selector:
  45.     app.kubernetes.io/name: example-be-app

Now I access my example application form browser.

huangapple
  • 本文由 发表于 2023年5月6日 18:22:58
  • 转载请务必保留本文链接：https://go.coder-hub.com/76188366.html
  • amazon-eks
  • amazon-web-services
  • aws-cloudformation
  • aws-fargate
  • kubernetes
匿名

发表评论

匿名网友

:?: :razz: :sad: :evil: :!: :smile: :oops: :grin: :eek: :shock: :???: :cool: :lol: :mad: :twisted: :roll: :wink: :idea: :arrow: :neutral: :cry: :mrgreen:

确定