无法从外部访问Nginx Deployment 技术咨询

Alright, let's work through why your Nginx NodePort service isn't reachable from outside the cluster. Since you can successfully curl it from the node itself, we know the Deployment, Pods, and Service are functioning correctly internally—so the problem lies in external network access. Here are the key steps to diagnose and fix this:

1. Verify You're Using the Correct Node IP #

First, make sure you're trying to access the public/external IP address of your Kubernetes node, not its internal cluster IP (like 192.168.x.x or 10.x.x.x). Many cloud or on-prem clusters use private IPs for internal communication, which aren't reachable from outside the network.

To get your node's external IP:

# Run this directly on the node
curl ifconfig.me
# Or use this alternative
curl ipinfo.io/ip

Then try accessing http://<node-external-ip>:30000 from your external device.

2. Check Firewall/Security Group Rules #

This is the most common culprit for NodePort access issues:

Cloud Platform Security Groups #

If you're running on AWS, Azure, GCP, or another cloud provider, you must update the security group attached to your node to allow inbound traffic on port 30000. Set the source to 0.0.0.0/0 (for all external IPs) or restrict it to your specific external IP range for security.

Node Local Firewall #

On the node itself, check if the local firewall is blocking port 30000:

For UFW (Ubuntu/Debian):

# Check current rules
sudo ufw status
# Allow port 30000 if missing
sudo ufw allow 30000/tcp

For Firewalld (RHEL/CentOS):

# List open ports
sudo firewall-cmd --list-ports
# Add port permanently and reload
sudo firewall-cmd --add-port=30000/tcp --permanent
sudo firewall-cmd --reload

3. Confirm Service Configuration is Correct #

Double-check that your NodePort Service is properly configured and linked to your Nginx Pods:

# Describe the service to get detailed status
kubectl describe service web-dep-nodeport-service

Look for these key details:

• Type: NodePort (confirm it's not set to ClusterIP by mistake)
• NodePort: 30000 (matches your configured port)
• Endpoints lists the IP addresses of your two Nginx Pods (this means the Service is correctly routing to the Pods)

You can also get a quick overview with:

kubectl get svc

4. Validate Cluster Network Plugin Functionality #

If you're using a CNI plugin like Calico, Flannel, or Weave, ensure it's running properly—sometimes NodePort forwarding can fail if the CNI isn't working:

# Check CNI pods in the kube-system namespace
kubectl get pods -n kube-system

All CNI-related pods (e.g., calico-node-xxxx, flannel-xxxx) should be in the Running state. If any are stuck, restart them or check their logs for errors.

5. Test Network Path from External Device #

If you're still having issues, trace the network path to see where traffic is being blocked:

# On your external machine, run traceroute (Linux/macOS)
traceroute <node-external-ip> -p 30000
# Or use mtr for more detailed info
mtr --tcp --port 30000 <node-external-ip>

This will show you which hop is dropping the traffic—helping you identify if it's a gateway, proxy, or NAT issue in your network.

内容的提问来源于stack exchange，提问作者category