EKS部署的Laravel应用无法通过Secrets和ConfigMap连接RDS

环境背景 #

• 已在Amazon EKS通过节点组部署Laravel应用
• 使用Secrets和ConfigMap管理敏感信息并集成到部署配置
• RDS实例与EKS集群处于同一VPC内

错误信息 #

Illuminate\Database\QueryException: SQLSTATE[HY000] [2002] Connection refused (Connection: mysql, SQL: select count(*) as aggregate from 'users' where 'email' = jhon@gmail.com) in file /var/www/vendor/laravel/framework/src/Illuminate/Database/Connection.php on line 829

#0 /var/www/vendor/laravel/framework/src/Illuminate/Database/Connection.php(983):

Illuminate\Database\Connection->runQueryCallback('select count(*)...', Array, Object

配置文件 #

deployment.yml文件： #

apiVersion: apps/v1
kind: Deployment
metadata:
  name: ecom-deployment
  namespace: ecom-eks
spec:
  replicas: 2
  selector:
    matchLabels:
      app.kubernetes.io/name: ecom
  template:
    metadata:
      labels:
        app.kubernetes.io/name: ecom
    spec:
      containers:
      - name: ecom
        image: public.ecr.aws/v9v3b4i5/ecom-api:latest
        imagePullPolicy: Always
        ports:
        - containerPort: 8010
        envFrom:
        - configMapRef:
            name: ecom-configmap
        env:
        - name: DB_USERNAME
          valueFrom:
            secretKeyRef:
              name: ecom-secret
              key: db_username
        - name: DB_PASSWORD
          valueFrom:
            secretKeyRef:
              name: ecom-secret
              key: db_password

secret.yml： #

apiVersion: v1
kind: Secret
metadata:
  name: ecom-secret
  namespace: ecom-eks
type: Opaque
data:
  db_username: rds_username
  db_password: rds_password

configmap.yml： #

apiVersion: v1
kind: ConfigMap
metadata:
  name: ecom-configmap
  namespace: ecom-eks
data:
  APP_NAME: Laravel
  APP_ENV: local
  APP_KEY: 'base64:BPCsfQr+Wk46OcItjF0tXeHI8088jJA1Dr218vfL7is='
  APP_DEBUG: 'true'
  APP_URL: http://localhost

  LOG_CHANNEL: stack
  LOG_DEPRECATIONS_CHANNEL: null
  LOG_LEVEL: debug

  DB_CONNECTION: mysql
  DB_HOST: ecom.c7ebhqk.us-east-1.rds.amazonaws.com
  DB_PORT: '3306'
  DB_DATABASE: ecom

  BROADCAST_DRIVER: log
  CACHE_DRIVER: file
  FILESYSTEM_DISK: local
  QUEUE_CONNECTION: sync
  SESSION_DRIVER: file
  SESSION_LIFETIME: '120'

  MEMCACHED_HOST: 127.0.0.1

  REDIS_HOST: 127.0.0.1
  REDIS_PASSWORD: null
  REDIS_PORT: '6379'

  MAIL_MAILER: smtp
  MAIL_HOST: mailpit
  MAIL_PORT: '1025'
  MAIL_USERNAME: null
  MAIL_PASSWORD: null
  MAIL_ENCRYPTION: null
  MAIL_FROM_ADDRESS: 'hello@example.com'
  MAIL_FROM_NAME: "${APP_NAME}"

  PUSHER_APP_ID: ''
  PUSHER_APP_KEY: ''
  PUSHER_APP_SECRET: ''
  PUSHER_HOST: ''
  PUSHER_PORT: '443'
  PUSHER_SCHEME: https
  PUSHER_APP_CLUSTER: mt1

  VITE_PUSHER_APP_KEY: "${PUSHER_APP_KEY}"
  VITE_PUSHER_HOST: "${PUSHER_HOST}"
  VITE_PUSHER_PORT: "${PUSHER_PORT}"
  VITE_PUSHER_SCHEME: "${PUSHER_SCHEME}"
  VITE_PUSHER_APP_CLUSTER: "${PUSHER_APP_CLUSTER}"

已完成验证 #

• 通过Pod打印环境变量确认ConfigMap和Secrets的配置值正确
• 使用命令mysql -h ecom.c7ebhqk.us-east-1.rds.amazonaws.com -u admin -p xxxxx可成功连接RDS，但Laravel API操作数据库时仍报错

排查解决建议 #

• 检查RDS安全组入站规则：确认RDS安全组允许EKS Pod所在CIDR段的3306端口访问（注意：节点能连接不代表Pod能连，Pod IP属于单独的网段）
• 验证Laravel环境变量加载优先级：进入Pod查看是否存在.env文件，Laravel会优先读取该文件而非系统环境变量，若存在冲突配置需删除镜像中的.env
• 测试Pod内直接连接RDS：在Laravel Pod中安装mysql客户端，执行mysql -h ${DB_HOST} -u ${DB_USERNAME} -p${DB_PASSWORD} ${DB_DATABASE}，确认Pod内部能否正常访问
• 检查EKS网络策略：执行kubectl get networkpolicies -n ecom-eks，确认是否有网络策略限制Pod访问RDS的3306端口
• 确认RDS实例状态与权限：检查RDS控制台确认实例处于可用状态，且所用用户拥有ecom数据库的访问权限
• 调整DB_PORT格式：将ConfigMap中的DB_PORT: '3306'改为DB_PORT: 3306（去掉引号，确保Laravel解析为整数端口），重新部署后测试

内容的提问来源于stack exchange，提问作者Muhammad AbuBaker