Docker/K8：OpenSSL SSL_connect：SSL_ERROR_SYSCALL

Question

在端点上运行 k8 cronjob。测试在本地就像一个魅力，即使我在入口点的末尾sleep infinity 然后在容器内卷曲。但是，一旦 cron 启动，我就会遇到一些时髦的错误：

[ec2-user@ip-10-122-8-121 device-purge]$ kubectl logs appgate-device-cron-job-1618411080-29lgt -n device-purge
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
curl: (35) OpenSSL SSL_connect: SSL_ERROR_SYSCALL in connection to 52.61.245.214:444

docker-entrypoint.sh

#! /bin/sh
export api_vs_hd=$API_VS_HD
export controller_ip=$CONTROLLER_IP
export password=$PASSWORD
export uuid=$UUID
export token=$TOKEN

# should be logged in after token export
# Test API call: list users
curl -k -H "Content-Type: application/json" \
     -H "$api_vs_hd" \
     -H "Authorization: Bearer $token" \
     -X GET \
     https://$controller_ip:444/admin/license/users

# test
# sleep infinity

Dockerfile

FROM harbor/privateop9/python38:latest

# Use root user for packages installation
USER root

# Install packages
RUN yum update -y && yum upgrade -y

# Install curl
RUN yum install curl -y \
    && curl --version

# Install zip/unzip/gunzip
RUN yum install zip unzip -y \
    && yum install gzip -y

# Install wget 
RUN yum install wget -y

# Install jq
RUN wget -O jq https://github.com/stedolan/jq/releases/download/jq-1.6/jq-linux64
RUN chmod +x ./jq
RUN cp jq /usr/bin

# Install aws cli
RUN curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip"
RUN unzip awscliv2.zip
RUN ./aws/install

## set working directory
WORKDIR /home/app

# Add user
RUN groupadd --system user && adduser --system user --no-create-home --gid user
RUN chown -R user:user /home/app && chmod -R 777 /home/app

# Make sure that your shell script file is in the same folder as your dockerfile while running the docker build command as the below command will copy the file to the /home/root/ folder for execution
# COPY . /home/root/
COPY ./docker-entrypoint.sh /home/app
RUN chmod +x docker-entrypoint.sh

# Switch to non-root user
USER user

# Run service
ENTRYPOINT ["/home/app/docker-entrypoint.sh"]

Cronjob.yaml

apiVersion: batch/v1beta1
kind: CronJob
metadata:
  name: device-cron-job
  namespace: device-purge
spec:
#Cron Time is set according to server time, ensure server time zone and set accordingly.
  schedule: "*/2 * * * *" # test
  jobTemplate:
    spec:
      template:
        spec:
          imagePullSecrets:
          - name: appgate-cron
          containers:
          - name: device-cron-pod
            image: harbor/privateop9/python38:device-purge
            env:
            - name: API_VS_HD
              value: "Accept:application/vnd.appgate.peer-v13+json"
            - name: CONTROLLER_IP
              value: "value"
            - name: UUID
              value: "value"
            - name: TOKEN
              value: >-
                curl -H "Content-Type: application/json" -H "${api_vs_hd}" --request POST
                --data "{\"providerName\":\"local\",\"username\":\"admin\",\"password\":\"$password\",\"deviceId\":\"$uuid\"}"
                https://$controller_ip:444/admin/login --insecure | jq -r '.token'
            - name: PASSWORD
              valueFrom:
                secretKeyRef: 
                  name: password
                  key: password

            imagePullPolicy: Always
          restartPolicy: OnFailure
      backoffLimit: 3

请帮忙！我的想法已经不多了......

Answer 1

我的帖子的问题在于服务器本身，因为在 AWS 云帐户上设置了 IP 白名单的防火墙。在帐户的安全团队解决了该问题后，我能够通过阻止程序。