Bitbucket部署至GKE执行rollout restart时遇API连接超时问题求助

需求 #

• 构建仓库镜像并推送至Artifact Registry
• 重启该镜像对应的GKE Deployment

已配置的Bitbucket Pipeline YAML #

services:
  - docker
name: Build and Deploy to Staging
deployment: staging
image: google/cloud-sdk:latest
script:
  - export DOCKER_BUILDKIT=0
  - echo $KEY_FILE_STAGING | base64 -d > ${BITBUCKET_CLONE_DIR}/gcp-key.json
  - gcloud auth activate-service-account --key-file=${BITBUCKET_CLONE_DIR}/gcp-key.json
  - gcloud config set project $GOOGLE_PROJECT_ID_STAGING
  - gcloud auth configure-docker us-north1-docker.pkg.dev
  - gcloud auth print-access-token | docker login -u oauth2accesstoken --password-stdin https://us-north1-docker.pkg.dev
  - docker build -t $GCP_ARTIFACT_REGISTRY_STAGING/$IMAGE_NAME:latest .
  - docker push $GCP_ARTIFACT_REGISTRY_STAGING/$IMAGE_NAME:latest
  - gcloud container clusters get-credentials $GKE_CLUSTER_NAME_STAGING --region=$GKE_REGION_STAGING --project=$GOOGLE_PROJECT_ID_STAGING
  # - kubectl rollout restart deployment/$DEPL_NAME  << gives same below error
  - export KUBECONFIG=$KUBE_CONFIG                   << used for getting auth not found error
  - pipe: atlassian/google-gke-kubectl-run:3.1.0
    variables:
      KUBE_CONFIG: $KUBECONFIG
      KEY_FILE: $KEY_FILE_STAGING
      PROJECT: $GOOGLE_PROJECT_ID_STAGING
      COMPUTE_ZONE: $GKE_REGION_STAGING
      CLUSTER_NAME: $GKE_CLUSTER_NAME_STAGING
      KUBECTL_COMMAND: 'rollout restart deployment'
      ROLLOUT_RESOURCE_TYPE: deployment
      KUBECTL_ARGS: ['${DEPL_NAME}']
      DEBUG: 'true'
      #KUBECTL_ARGS: ["restart","deployment/${DEPL_NAME}"]

问题现象 #

镜像已成功构建并推送至Registry，但执行kubectl相关操作时出现超时错误：

✔ 已成功更新kube config。
48 memcache.go:265] couldn't get current server API group list: Get "https://104.100.200.200/api?timeout=32s": dial tcp 104.154.207.216:443: i/o timeout
Unable to connect to the server: dial tcp 104.100.200.200:443: i/o timeout
✖ kubectl rollout restart deployment执行失败。

尝试直接使用- kubectl rollout restart deployment/$DEPL_NAME替代pipe工具，仍出现相同超时错误。

问题原因与解决方法 #

• 原因：该GKE集群为私有集群，其控制平面默认仅允许授权IP地址访问，Bitbucket Pipeline的出口IP不在授权列表内，导致无法建立连接。
• 解决方法：将Bitbucket Pipeline的出口IP添加至GKE集群控制平面的授权地址列表中，即可正常执行kubectl命令完成Deployment重启。

内容的提问来源于stack exchange，提问作者dev21