如何在Kubernetes集群内访问MinIO实例？配置问题求助

我通过cdk8s在Kubernetes上部署了MinIO服务器，使用minio1作为Service名称，原本预期同命名空间内的Prometheus、Loki、Mimir等实例能通过http://minio1:9000访问，但实际无法访问。MinIO启动无报错，推测是网络配置问题。

MinIO启动命令：

command: ["minio"],
args: [
  "server",
  "/data",
  "--address",
  `:9000`,
  "--console-address",
  `:9001`,
],

我用补丁修改K8s配置暴露端口的代码：

const d = ApiObject.of(minioDeployment);

//Create the empty port list
d.addJsonPatch(JsonPatch.add("/spec/template/spec/containers/0/ports", []));

//add port for console
d.addJsonPatch(
  JsonPatch.add("/spec/template/spec/containers/0/ports/0", {
    name: "console",
    containerPort: 9001,
  })
);
// add port for bucket
d.addJsonPatch(
  JsonPatch.replace("/spec/template/spec/containers/0/ports/1", {
    name: "bucket",
    containerPort: 9000,
  })
);

cdk8s生成的Deployment和Service定义：

apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    use-default-egress-policy: "true"
  name: minio1
  namespace: ns-monitoring
spec:
  minReadySeconds: 0
  progressDeadlineSeconds: 600
  replicas: 1
  selector:
    matchExpressions: []
    matchLabels:
      cdk8s.deployment: monitoring-stack-minio1-minio1-deployment-c8e6c44f
  strategy:
    rollingUpdate:
      maxSurge: 50%
      maxUnavailable: 50%
    type: RollingUpdate
  template:
    metadata:
      labels:
        cdk8s.deployment: monitoring-stack-minio1-minio1-deployment-c8e6c44f
    spec:
      automountServiceAccountToken: true
      containers:
        - args:
            - server
            - /data/minio/
            - --address
            - :9000
            - --console-address
            - :9001
          command:
            - minio
          env:
            - name: MINIO_ROOT_USER
              value: userminio
            - name: MINIO_ROOT_PASSWORD
              value: XXXXXXXXXXXXXX
            - name: MINIO_BROWSER
              value: "on"
            - name: MINIO_PROMETHEUS_AUTH_TYPE
              value: public
          image: minio/minio
          imagePullPolicy: Always
          name: minio1-docker
          ports:
            - containerPort: 9001
              name: console
            - containerPort: 9000
              name: bucket
          securityContext:
            privileged: false
            readOnlyRootFilesystem: false
            runAsNonRoot: false
          volumeMounts:
            - mountPath: /data
              name: data
      dnsConfig:
        nameservers: []
        options: []
        searches: []
      dnsPolicy: ClusterFirst
      hostAliases: []
      initContainers: []
      restartPolicy: Always
      securityContext:
        fsGroupChangePolicy: Always
        runAsNonRoot: false
        sysctls: []
      setHostnameAsFQDN: false
      volumes:
        - emptyDir: {}
          name: data
---
apiVersion: v1
kind: Service
metadata:
  labels:
    use-default-egress-policy: "true"
  name: minio1
  namespace: ns-monitoring
spec:
  externalIPs: []
  ports:
    - port: 443
      targetPort: 9001
  selector:
    cdk8s.deployment: stack-minio1-minio1-deployment-c8e6c44f
  type: ClusterIP

疑问：这是否和多端口配置有关？有没有办法显式把hostname定义为Service ID，让它在命名空间内可访问？

核心问题 #

1. Service未映射9000端口：生成的Service仅配置了443端口指向容器9001（控制台），完全没映射MinIO核心服务的9000端口，这是minio1:9000无法访问的直接原因。
2. Service标签选择器不匹配：Deployment的Pod标签是cdk8s.deployment: monitoring-stack-minio1-minio1-deployment-c8e6c44f，但Service的选择器少了monitoring-前缀，导致Service无法关联到MinIO Pod，即使端口配置正确也没用。

修复步骤 #

1. 修正Service标签选择器 #

将Service的spec.selector改为和Deployment Pod标签一致：

selector:
  cdk8s.deployment: monitoring-stack-minio1-minio1-deployment-c8e6c44f

2. 添加9000端口的Service映射 #

在Service的ports数组中新增9000端口配置，让Service暴露9000端口指向容器9000端口：

ports:
  - port: 443
    targetPort: 9001
    name: console
  - port: 9000
    targetPort: 9000
    name: bucket

3. （可选）直接用cdk8s代码配置Service #

如果不想用补丁，建议直接在cdk8s中定义正确的Service：

const minioService = new k8s.Service(this, 'minio1', {
  metadata: { name: 'minio1', namespace: 'ns-monitoring' },
  spec: {
    type: 'ClusterIP',
    selector: {
      'cdk8s.deployment': 'monitoring-stack-minio1-minio1-deployment-c8e6c44f'
    },
    ports: [
      { port: 9000, targetPort: 9000, name: 'bucket' },
      { port: 443, targetPort: 9001, name: 'console' }
    ]
  }
});

关于Hostname的疑问 #

Kubernetes中，Service名称本身就是集群内的DNS hostname，同命名空间内直接用http://<service-name>:<port>访问即可，无需额外显式定义hostname。只要Service配置正确（选择器匹配、端口映射正确），同命名空间的Pod就能通过minio1:9000访问MinIO服务。

内容的提问来源于stack exchange，提问作者wsdfgfkdl