如何使用 kubectl 检查 pod 正在侦听的端口而不查看 dockerFile？

Question

我有一个 pod 正在运行，并且想要进行端口转发，以便我可以从内部网络访问该 pod。 我不知道它在监听哪个端口，还没有服务。

我描述了 pod：

$ kubectl describe pod queue-l7wck 
Name:         queue-l7wck
Namespace:    default
Priority:     0
Node:         minikube/192.168.64.3
Start Time:   Wed, 18 Dec 2019 05:13:56 +0200
Labels:       app=work-queue
              chapter=jobs
              component=queue
Annotations:  <none>
Status:       Running
IP:           172.17.0.2
IPs:
  IP:           172.17.0.2
Controlled By:  ReplicaSet/queue
Containers:
  queue:
    Container ID:   docker://13780475170fa2c0d8e616ba1a3b1554d31f404cc0a597877e790cbf01838e63
    Image:          gcr.io/kuar-demo/kuard-amd64:blue
    Image ID:       docker-pullable://gcr.io/kuar-demo/kuard-amd64@sha256:1ecc9fb2c871302fdb57a25e0c076311b7b352b0a9246d442940ca8fb4efe229
    Port:           <none>
    Host Port:      <none>
    State:          Running
      Started:      Wed, 18 Dec 2019 05:14:02 +0200
    Ready:          True
    Restart Count:  0
    Environment:    <none>
    Mounts:
      /var/run/secrets/kubernetes.io/serviceaccount from default-token-mbn5b (ro)
Conditions:
  Type              Status
  Initialized       True 
  Ready             True 
  ContainersReady   True 
  PodScheduled      True 
Volumes:
  default-token-mbn5b:
    Type:        Secret (a volume populated by a Secret)
    SecretName:  default-token-mbn5b
    Optional:    false
QoS Class:       BestEffort
Node-Selectors:  <none>
Tolerations:     node.kubernetes.io/not-ready:NoExecute for 300s
                 node.kubernetes.io/unreachable:NoExecute for 300s
Events:
  Type    Reason     Age        From               Message
  ----    ------     ----       ----               -------
  Normal  Scheduled  <unknown>  default-scheduler  Successfully assigned default/queue-l7wck to minikube
  Normal  Pulling    31h        kubelet, minikube  Pulling image "gcr.io/kuar-demo/kuard-amd64:blue"
  Normal  Pulled     31h        kubelet, minikube  Successfully pulled image "gcr.io/kuar-demo/kuard-amd64:blue"
  Normal  Created    31h        kubelet, minikube  Created container queue
  Normal  Started    31h        kubelet, minikube  Started container queue

即使是 JSON 也一无所有：

$ kubectl get pods queue-l7wck -o json
{
    "apiVersion": "v1",
    "kind": "Pod",
    "metadata": {
        "creationTimestamp": "2019-12-18T03:13:56Z",
        "generateName": "queue-",
        "labels": {
            "app": "work-queue",
            "chapter": "jobs",
            "component": "queue"
        },
        "name": "queue-l7wck",
        "namespace": "default",
        "ownerReferences": [
            {
                "apiVersion": "apps/v1",
                "blockOwnerDeletion": true,
                "controller": true,
                "kind": "ReplicaSet",
                "name": "queue",
                "uid": "a9ec07f7-07a3-4462-9ac4-a72226f54556"
            }
        ],
        "resourceVersion": "375402",
        "selfLink": "/api/v1/namespaces/default/pods/queue-l7wck",
        "uid": "af43027d-8377-4227-b366-bcd4940b8709"
    },
    "spec": {
        "containers": [
            {
                "image": "gcr.io/kuar-demo/kuard-amd64:blue",
                "imagePullPolicy": "Always",
                "name": "queue",
                "resources": {},
                "terminationMessagePath": "/dev/termination-log",
                "terminationMessagePolicy": "File",
                "volumeMounts": [
                    {
                        "mountPath": "/var/run/secrets/kubernetes.io/serviceaccount",
                        "name": "default-token-mbn5b",
                        "readOnly": true
                    }
                ]
            }
        ],
        "dnsPolicy": "ClusterFirst",
        "enableServiceLinks": true,
        "nodeName": "minikube",
        "priority": 0,
        "restartPolicy": "Always",
        "schedulerName": "default-scheduler",
        "securityContext": {},
        "serviceAccount": "default",
        "serviceAccountName": "default",
        "terminationGracePeriodSeconds": 30,
        "tolerations": [
            {
                "effect": "NoExecute",
                "key": "node.kubernetes.io/not-ready",
                "operator": "Exists",
                "tolerationSeconds": 300
            },
            {
                "effect": "NoExecute",
                "key": "node.kubernetes.io/unreachable",
                "operator": "Exists",
                "tolerationSeconds": 300
            }
        ],
        "volumes": [
            {
                "name": "default-token-mbn5b",
                "secret": {
                    "defaultMode": 420,
                    "secretName": "default-token-mbn5b"
                }
            }
        ]
    },
    "status": {
        "conditions": [
            {
                "lastProbeTime": null,
                "lastTransitionTime": "2019-12-18T03:13:56Z",
                "status": "True",
                "type": "Initialized"
            },
            {
                "lastProbeTime": null,
                "lastTransitionTime": "2019-12-18T03:14:02Z",
                "status": "True",
                "type": "Ready"
            },
            {
                "lastProbeTime": null,
                "lastTransitionTime": "2019-12-18T03:14:02Z",
                "status": "True",
                "type": "ContainersReady"
            },
            {
                "lastProbeTime": null,
                "lastTransitionTime": "2019-12-18T03:13:56Z",
                "status": "True",
                "type": "PodScheduled"
            }
        ],
        "containerStatuses": [
            {
                "containerID": "docker://13780475170fa2c0d8e616ba1a3b1554d31f404cc0a597877e790cbf01838e63",
                "image": "gcr.io/kuar-demo/kuard-amd64:blue",
                "imageID": "docker-pullable://gcr.io/kuar-demo/kuard-amd64@sha256:1ecc9fb2c871302fdb57a25e0c076311b7b352b0a9246d442940ca8fb4efe229",
                "lastState": {},
                "name": "queue",
                "ready": true,
                "restartCount": 0,
                "started": true,
                "state": {
                    "running": {
                        "startedAt": "2019-12-18T03:14:02Z"
                    }
                }
            }
        ],
        "hostIP": "192.168.64.3",
        "phase": "Running",
        "podIP": "172.17.0.2",
        "podIPs": [
            {
                "ip": "172.17.0.2"
            }
        ],
        "qosClass": "BestEffort",
        "startTime": "2019-12-18T03:13:56Z"
    }
}

如何使用 kubectl 检查 pod 正在侦听的端口？

更新

如果我按照 cmets 中的建议 ssh 进入 pod 并运行 netstat -tulpn，我会得到：

$ kubectl exec -it queue-pfmq2 -- sh
~ $ netstat -tulpn
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name    
tcp        0      0 :::8080                 :::*                    LISTEN      1/kuard

但是这个方法没有使用kubectl。

Answer 1

尝试结合使用 kubectl 和您的 Linux 命令以获取 Port 容器正在侦听：

kubectl exec <pod name here> -- netstat -tulpn

如果需要，您还可以使用grep 管理此结果以缩小发现范围，例如。

kubectl exec <pod name here> -- netstat -tulpn | grep "search string"

注意：只有当你的容器的基础镜像支持命令netstat时它才会起作用。根据您的 Update 部分，它似乎支持。 上面的解决方案只不过是巧妙地使用您在两部分中使用的命令，首先在容器中以交互模式使用exec，然后在容器中使用-it，以列出侦听端口。

Answer 2

您的容器映像在构建期间使用EXPOSE command in the Dockerfile 打开了一个端口（在您的情况下看起来像端口 8080）。由于暴露的端口被烘焙到镜像中，k8s 不会跟踪这个打开的端口，因为 k8s 不需要采取步骤来打开它。

由于 k8s 不负责打开端口，所以使用 kubectl 或检查 pod YAML 将无法找到监听端口

Answer 3

通常。一个容器将能够运行 curl 。所以你可以使用 curl 来检查端口是否打开。

   for port in 8080 50000 443 8443;do curl -I - connect-timeout 1 127.0.0.1:$port;done

这可以用 sh 运行。