无法在浏览器访问Kubernetes Pod内应用的技术求助

问题描述 #

已通过以下YAML创建Namespace、ConfigMap、Deployment、Service、HPA及PodDisruptionBudget，但无法在浏览器中访问Pod内运行的applicare应用：

---
apiVersion: v1
kind: Namespace
metadata:
  name: applicare1
  labels:
    name: applicare1
---
apiVersion: v1
data:
  app.properties: |
    applicare.dbVendor=MySql
    applicare.autoPersist=true
    applicare.useSNMP=0
    applicare.stuckthread.max=600
    applicare.updateUrl=http\://support.arcturustech.com
    applicare.systemUser=JFUuyKJT1Ls\=
    applicare.smtp_auth_pwd=Ni2Bih3nCUU\=
    applicare.useRSTATD=1
    applicare.blackboxSaveType=all
    applicare.invokeRSTATD=1
    applicare.enableChartScrollbar=true
    heapTracker.interval=240
    applicare.serverPort=8880
    applicare.dbDriverClass=com.mysql.jdbc.Driver
    applicare.SMTPSSL=false 
    applicare.adminName=AdminServer
    applicare.dbPassword=Applicare01$1
    applicare.alertDuration=3
    applicare.dbUsername=applicare01
    applicare.smtp_host=localhost
    applicare.dburl=jdbc\:mysql\://192.168.1.209\:3306/applicarenew?allowPublicKeyRetrieval\=true&useSSL\=false
    applicare.smtp_auth_user=test
    applicare.custAlertClass=
    applicare.serverIP=192.168.1.209
    applicare.agentJobInterval=1
    applicare.dbTestSQL=SELECT 1
     applicare.smtp_from=
    applicare.enable_readonly_mode=false
    applicare.sendMailTo=test@localhost.com
    applicare.alertMonitorJobInterval=1
    applicare.alertOn=1
    applicare.intellitrace.auto_refresh=60000
    applicare.SMTPPort=25
    applicare.enable_server_time=false
    applicare.systemPassword=JFUuyKJT1Ls\=
    applicare.serverName=
    applicare.httpErrorCode=400
    applicare.monitorOn=1
    applicare.ipLocUpdate.jobInterval=60
    applicare.alertClearanceNotificationDuration=3
    applicare.logDir=/usr/local/Applicare/logs
    applicare.dataSource=Applicare-DataSource
    applicare.minTimeBetweenAlerts=5
kind: ConfigMap
metadata:
  name: applicare-config
  namespace: applicare1

---
apiVersion: apps/v1
kind: Deployment
metadata:
  namespace: applicare1
  labels:
    run: applicare1
  name: applicare1
spec:
  replicas: 3
  selector:
    matchLabels:
      run: applicare1
  template:
    metadata:
      annotations:
      labels:
        run: applicare1
    spec:
      containers:
      - image: applicare:latest
        imagePullPolicy: Never
        name: applicare1
        resources:
          requests:
            memory: "2000Mi"
            cpu: "200m"
          limits:
            memory: "5000Mi"
            cpu: "2000m"
        volumeMounts:
        - name: app-config
          mountPath: /usr/local/Applicare/Applicare.props
          subPath: app.properties
        livenessProbe:
          httpGet:
            path: /applicare/login/console.jsp
            port: 8880
          failureThreshold: 5
          periodSeconds: 60
         #  terminationGracePeriodSeconds: 200
          initialDelaySeconds: 180
        startupProbe:
          httpGet:
            path: /applicare/login/console.jsp
            port: 8880
          failureThreshold: 3
          periodSeconds: 90
      volumes:
      - name: app-config
        configMap:
          name: applicare-config



---
apiVersion: v1
kind: Service
metadata:
  namespace: applicare1
  name: applicare-service
spec:
  selector:
    run: applicare1
  ports:
    - port: 8811
      targetPort: 8880
      name: port

---

apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: applicare1
  namespace: applicare1
spec:
  maxReplicas: 3
  minReplicas: 1
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: applicare1
  metrics:
  - type: Resource
    resource:
      name: cpu
      target:
        type: Utilization
        averageUtilization: 80
  - type: Resource
    resource:
      name: memory
      target:
        type: Utilization
        averageUtilization: 97

---
apiVersion: policy/v1
kind: PodDisruptionBudget
metadata:
  name: applicare-pdb
  namespace: applicare1
spec:
  minAvailable: 1
  selector:
    matchLabels:
      run: applicare1

执行kubectl describe service -n applicare1得到以下结果：

kubectl describe service -n applicare1

Name:              applicare-service
Namespace:         applicare1
Labels:            <none>
Annotations:       <none>
Selector:          run=applicare1
Type:              ClusterIP
IP Family Policy:  SingleStack
IP Families:       IPv4
IP:                10.109.86.137
IPs:               10.109.86.137
Port:              port  8811/TCP
TargetPort:        8880/TCP
Endpoints:         10.1.0.153:8880,10.1.0.154:8880,10.1.0.155:8880
Session Affinity:  None
Events:            <none>

可以查看Pod日志、进入Pod内部，但无法通过浏览器访问应用。

排查方案 #

1. 确认Service外部访问能力 #

当前Service类型为ClusterIP，仅允许集群内部访问，外部浏览器无法直接连接。要实现外部访问，可选择以下方式：

• 修改Service为NodePort类型：在Service的spec中添加type: NodePort，之后通过任意集群节点IP:NodePort访问（NodePort会自动分配30000-32767之间的端口，也可手动指定）。
• 使用LoadBalancer类型（如果集群支持云厂商负载均衡器）。
• 配置Ingress资源（需集群已部署Ingress Controller）。
• 临时测试用端口转发：执行kubectl port-forward -n applicare1 service/applicare-service 8811:8811，然后在本地浏览器访问http://localhost:8811/applicare/login/console.jsp，如果能访问，说明应用本身无问题，只是缺少外部暴露方式。

2. 验证集群内部访问是否正常 #

先排除应用本身的问题，在集群内节点或Pod中测试访问：

• 访问Service地址：kubectl exec -n applicare1 <任意Pod名称> -- curl http://10.109.86.137:8811/applicare/login/console.jsp
• 直接访问Pod地址：kubectl exec -n applicare1 <任意Pod名称> -- curl http://10.1.0.153:8880/applicare/login/console.jsp
  如果集群内访问失败，说明问题出在应用或Pod配置。

3. 检查应用监听地址 #

进入Pod内部，执行netstat -tulpn或ss -tulpn，查看应用是否监听在0.0.0.0:8880。如果应用仅监听127.0.0.1，则集群内也无法访问，需要修改应用配置，让其监听所有网卡地址。

4. 核对配置文件中的绑定IP #

ConfigMap中applicare.serverIP设置为192.168.1.209（外部主机IP），应用可能会绑定到该IP而非Pod内部IP或0.0.0.0，导致Service无法转发请求。尝试将该值改为0.0.0.0，然后更新ConfigMap并重启Deployment：

kubectl edit configmap applicare-config -n applicare1
# 修改applicare.serverIP=0.0.0.0
kubectl rollout restart deployment applicare1 -n applicare1

5. 检查应用启动状态 #

查看Pod日志，确认应用是否完成启动：

• 检查是否有数据库连接失败的错误（ConfigMap中配置的MySQL地址为192.168.1.209:3306，需确认Pod能访问该地址，且数据库账号密码正确）。
• 确认应用启动日志中是否有绑定端口成功、服务就绪的信息。

内容的提问来源于stack exchange，提问作者anandarc