Kubernetes Pod 无法访问互联网，而主机可以答案

【问题标题】：Kubernetes pods can't access the internet while host canKubernetes Pod 无法访问互联网，而主机可以
【发布时间】：2021-10-09 09:50:12
【问题描述】：

我正在使用具有以下配置的 Microk8s 设置 -

deployment.yaml

apiVersion: apps/v1
kind: Deployment
metadata:
  name: jenkins
  labels:
    app: jenkins
spec:
  selector:
    matchLabels:
      app: jenkins
  replicas: 1
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 1
      maxUnavailable: 0
  template:
    metadata:
      labels:
        app: jenkins
    spec:
      serviceAccountName: jenkins
      containers:
      - name: jenkins
        image: jenkins/jenkins:2.235.1-lts-alpine
        imagePullPolicy: IfNotPresent
        env:
        - name: JAVA_OPTS
          value: -Xmx2048m -Dhudson.slaves.NodeProvisioner.MARGIN=50 -Dhudson.slaves.NodeProvisioner.MARGIN0=0.85
        ports:
        - containerPort: 8080
          protocol: TCP
        - containerPort: 50000
          protocol: TCP
        volumeMounts:
        - mountPath: /var/jenkins_home
          name: jenkins
      restartPolicy: Always
      securityContext:
        runAsUser: 0
      terminationGracePeriodSeconds: 30
      volumes:
      - name: jenkins
        persistentVolumeClaim:
          claimName: jenkins-claim

pv.yaml

apiVersion: v1
kind: PersistentVolume
metadata:
  name: jenkins
  labels:
    type: local
spec:
  storageClassName: manual
  capacity:
    storage: 4Gi
  accessModes:
    - ReadWriteOnce
  hostPath:
    path: "/mnt/data"

pvc.yaml

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: jenkins-claim
spec:
  storageClassName: manual
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 4Gi

rbac.yaml

---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: jenkins
---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: jenkins
rules:
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["create","delete","get","list","patch","update","watch"]
- apiGroups: [""]
  resources: ["pods/exec"]
  verbs: ["create","delete","get","list","patch","update","watch"]
- apiGroups: [""]
  resources: ["pods/log"]
  verbs: ["get","list","watch"]
- apiGroups: [""]
  resources: ["secrets"]
  verbs: ["create","delete","get","list","patch","update"]
- apiGroups: [""]
  resources: ["configmaps"]
  verbs: ["create","delete","get","list","patch","update"]
- apiGroups: ["apps"]
  resources: ["deployments"]
  verbs: ["create","delete","get","list","patch","update"]
- apiGroups: [""]
  resources: ["services"]
  verbs: ["create","delete","get","list","patch","update"]
- apiGroups: [""]
  resources: ["ingresses"]
  verbs: ["create","delete","get","list","patch","update"]

---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: jenkins
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: jenkins
subjects:
- kind: ServiceAccount
  name: jenkins
  namespace: jenkins

service.yaml

apiVersion: v1
kind: Service
metadata:
  name: jenkins
  labels:
    app: jenkins
spec:
  type: NodePort
  ports:
    - name: ui
      port: 8080
      targetPort: 8080
      protocol: TCP
    - name: slave
      port: 50000
      protocol: TCP
    - name: http
      port: 80
      targetPort: 8080
  selector:
    app: jenkins

我可以从我的节点（主机）访问互联网，但不能从我的 pod。我的节点是一个运行在 vSphere 上的 ubuntu 18.04.2 LTS 机器，在 VPN 中。

在官方文档 (https://microk8s.io/docs/troubleshooting) 中，它对任何一个都说

sudo iptables -P FORWARD ACCEPT
sudo apt-get install iptables-persistent

或

sudo ufw default allow routed

两者都不能为我解决问题。

还尝试了https://github.com/ubuntu/microk8s/issues/1484中的建议，但没有成功。

【问题讨论】：

是否有任何活动的网络策略可能会拒绝来自您的 pod 的出口流量？确切的问题是什么？可以提取图像并且实际的 pod 与外界通信有问题吗？您的集群中是否部署了 CNI 插件？
@meaningqo 我上传了 k8s 配置，没有应该拒绝出口流量的政策。确切的问题是，我的 pod 无法与外界通信，而我的节点可以，如前所述 - 例如，如果我从我的节点 ping google.com，它会按预期工作，但如果我将“kubectl exec -it”进入我的pod 并从那里尝试它不起作用。
嗯，从我在 github 问题上读到的内容来看，它似乎也发生在新的 microk8s 安装上。我以前认为它可能是一个现有的集群，并且已经应用了网络策略。但是，这个问题似乎是 microk8s 特有的。如果没有 netpol 处于活动状态，您的 pod 应该能够在标准 kubernetes 环境中访问互联网。所以不幸的是，我认为我无法进一步帮助您，因为我还没有大量使用 microk8s
@meaningqo 好的，谢谢。如果接下来几天找不到解决方案，请切换到 kubeadm。
嗨@Yahm Levi Firseck。您能否通过运行 microk8s status 检查您的 microk8s 集群是否安装了 dns 插件？在 pod 上，您可以 ping 外部 IP（例如 ping 8.8.8.8）吗？

标签： ubuntu jenkins kubernetes vsphere microk8s

【解决方案1】：

为了在 Microk8s 上解决这个问题，请在部署前使用命令 microk8s enable dns 启用 dns 插件

【讨论】：