使用Kubernetes容器化ASP.NET应用时数据库连接异常Pod重启求助

问题背景 #

将ASP.NET应用容器化部署至Kubernetes环境，SQL Server的StatefulSet及Service已正常运行，但ASP.NET应用的Pod每隔25秒尝试重启。怀疑是Deployment的环境变量未覆盖appsettings.json中的数据库连接字符串，请求协助解决应用Pod连接SQL服务的问题。

SQL Server部署配置 #

apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: sql-server-dentist
spec:
  replicas: 1
  serviceName: "sql-server"
  selector:
    matchLabels:
      app: sql-server
  template:
    metadata:
      labels:
        app: sql-server
    spec:
      containers:
        - name: sql-server-dentist-container
          image: mcr.microsoft.com/mssql/server:2022-latest
          env:
            - name: ACCEPT_EULA
              value: "Y"
            - name: SA_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: sql-server-secret
                  key: SA_PASSWORD
          ports:
            - containerPort: 1433
  volumeClaimTemplates:
    - metadata:
        name: data
      spec:
        accessModes: ["ReadWriteOnce"]
        storageClassName: "standard"
        resources:
          requests:
            storage: 1Gi
---
apiVersion: v1
kind: Service
metadata:
  name: sql-server
spec:
  ports:
    - port: 1433
  selector:
    app: sql-server

Secret配置 #

apiVersion: v1
kind: Secret
metadata:
  name: sql-server-secret
type: Opaque
data:
  SA_PASSWORD: <hashed-password-changed-to-ask>

ASP.NET应用部署配置 #

apiVersion: apps/v1
kind: Deployment
metadata:
  name: dentist-web-app
spec:
  replicas: 2
  selector:
    matchLabels:
      app: dentist-web-app
  template:
    metadata:
      labels:
        app: dentist-web-app
    spec:
      containers:
        - name: dentist-web-app-container
          image: guimarkes457/odonto-control:latest
          resources:
            limits:
              memory: "128Mi"
              cpu: "500m"
          ports:
            - containerPort: 80
          env:
            - name: ConnectionStrings_DefaultConnection
              value: "Server=sql-server-dentist;Database=OdontoControlDb;User Id=sa;Password=<my-password>;MultipleActiveResultSets=true;"
---
apiVersion: v1
kind: Service
metadata:
  name: dentist-service-app
spec:
  selector:
    app: dentist-web-app
  ports:
    - protocol: TCP
      port: 80
      targetPort: 80
  type: LoadBalancer

appsettings.json连接字符串 #

"ConnectionStrings": {
    "DefaultConnection": "Server=sqlserver;Database=OdontoControlDb;User Id=SA;Password=<my-password>;MultipleActiveResultSets=true;TrustServerCertificate=True;Encrypt=false"
  },

当前集群运行状态 #

NAME                                   READY   STATUS    RESTARTS        AGE
pod/dentist-web-app-7b79bf8664-crvp8   1/1     Running   5 (3h41m ago)   3h44m
pod/dentist-web-app-7b79bf8664-lsj8l   1/1     Running   5 (3h41m ago)   3h44m
pod/sql-server-dentist-0               1/1     Running   3 (3h40m ago)   2d3h

NAME                          TYPE           CLUSTER-IP       EXTERNAL-IP   PORT(S)        AGE
service/dentist-service-app   LoadBalancer   10.100.200.193   <pending>     80:31858/TCP   2d3h
service/kubernetes            ClusterIP      10.96.0.1        <none>        443/TCP        27d
service/sql-server            ClusterIP      10.106.76.73     <none>        1433/TCP       2d3h

NAME                              READY   UP-TO-DATE   AVAILABLE   AGE
deployment.apps/dentist-web-app   2/2     2            2           3h44m

NAME                                         DESIRED   CURRENT   READY   AGE
replicaset.apps/dentist-web-app-7b79bf8664   2         2         2       3h44m

NAME                                  READY   AGE
statefulset.apps/sql-server-dentist   1/1     2d3h

问题排查与解决方案 #

1. 核心配置错误点 #

• 连接地址错误：环境变量中指定的SQL地址是sql-server-dentist（Pod名称），但Kubernetes中应使用稳定的Service名称sql-server作为访问入口
• 环境变量命名格式错误：ASP.NET Core中覆盖ConnectionStrings:DefaultConnection需要用双下划线ConnectionStrings__DefaultConnection，单下划线无法解析配置层级
• 缺少加密信任参数：SQL Server 2022默认要求加密连接，环境变量中的连接字符串缺少TrustServerCertificate=True;Encrypt=false，会导致连接失败
• 密码明文暴露：直接在环境变量中写密码存在安全风险，应从Secret读取

2. 修改后的ASP.NET Deployment配置 #

apiVersion: apps/v1
kind: Deployment
metadata:
  name: dentist-web-app
spec:
  replicas: 2
  selector:
    matchLabels:
      app: dentist-web-app
  template:
    metadata:
      labels:
        app: dentist-web-app
    spec:
      containers:
        - name: dentist-web-app-container
          image: guimarkes457/odonto-control:latest
          resources:
            limits:
              memory: "128Mi"
              cpu: "500m"
          ports:
            - containerPort: 80
          env:
            - name: ConnectionStrings__DefaultConnection
              value: "Server=sql-server;Database=OdontoControlDb;User Id=sa;Password=$(SA_PASSWORD);MultipleActiveResultSets=true;TrustServerCertificate=True;Encrypt=false;"
            - name: SA_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: sql-server-secret
                  key: SA_PASSWORD

3. 验证步骤 #

1. 应用修改后的Deployment：

   kubectl apply -f <你的部署文件路径>
   

2. 查看Pod日志确认连接状态：

   kubectl logs -f <ASP.NET Pod名称>
   

3. 测试集群内网络连通性：

   kubectl exec -it <ASP.NET Pod名称> -- nc -zv sql-server 1433
   

内容的提问来源于stack exchange，提问作者GuilhermeMarques