环境:
1.在hadoop36机器，ping hadoop38机器的pod的ip，为172.30.1.4
2.该pod的service的external-ip的ip为hadoop36的ip
3.下面机器的ip，已经使用 xx.xx.xx.来替代和加图层覆盖掉
问题: 无法通过服务EXTERNAL-IP+port,访问对应的pod的服务，说白了，就是无法访问pod ip+port,无法ping通172.30.1.4
步骤:
1.先把服务停掉
[root@hadoop38 ~]# systemctl stop etcd flanneld docker kubelet kube-proxy
2.查看当前规则，然后清空
[root@hadoop38 ~]# iptables -L -n
[root@hadoop38 ~]# iptables -F && iptables -X && iptables -F -t nat && iptables -X -t nat
[root@hadoop38 ~]# iptables -L -n
Chain INPUT (policy ACCEPT)
target prot opt source destination
Chain FORWARD (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
[root@hadoop38 ~]#
3.重启iptables 和 开启服务
[root@hadoop38 ~]# systemctl restart iptables
[root@hadoop38 ~]# systemctl start etcd flanneld docker kubelet kube-proxy
4.再次查看防火墙策略 和清空掉
[root@hadoop38 ~]# iptables -L -n
[root@hadoop38 ~]# iptables -F && iptables -X && iptables -F -t nat && iptables -X -t nat
5.等待一会 最终查看防火墙策略
[root@hadoop38 ~]# iptables -L -n
Chain INPUT (policy ACCEPT)
target prot opt source destination
KUBE-FIREWALL all -- 0.0.0.0/0 0.0.0.0/0
Chain FORWARD (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
KUBE-FIREWALL all -- 0.0.0.0/0 0.0.0.0/0
KUBE-SERVICES all -- 0.0.0.0/0 0.0.0.0/0 /* kubernetes service portals */
Chain KUBE-FIREWALL (2 references)
target prot opt source destination
DROP all -- 0.0.0.0/0 0.0.0.0/0 /* kubernetes firewall for dropping marked packets */ mark match 0x8000/0x8000
Chain KUBE-SERVICES (1 references)
target prot opt source destination
[root@hadoop38 ~]# destination
6.在36机器验证ping 和 telnet检验
[root@hadoop36 dns]# kubectl get all -n cdh -o wide
NAME READY STATUS RESTARTS AGE IP NODE
po/mysql-master-64k8r 1/1 Running 5 1h 172.30.1.4 xx.xx.xx.38
NAME DESIRED CURRENT READY AGE CONTAINER(S) IMAGE(S) SELECTOR
rc/mysql-master 1 1 1 1h master hadoop35.jiuye/k8sregister/jiuye/mysql5.6-master:v1.6 name=mysql-master
NAME CLUSTER-IP EXTERNAL-IP PORT(S) AGE SELECTOR
svc/mysql-master 10.254.56.245 xx.xx.xx.36 13307/TCP 1h name=mysql-master
[root@hadoop36 dns]#
[root@hadoop36 dns]# ping 172.30.1.4
PING 172.30.1.4 (172.30.1.4) 56(84) bytes of data.
64 bytes from 172.30.1.4: icmp_seq=1 ttl=63 time=0.388 ms
^Z
[31]+ Stopped ping 172.30.1.4
[root@hadoop36 dns]# telnet xx.xx.xx.36 13307
Trying xx.xx.xx..36...
Connected to xx.xx.xx..36.
Escape character is '^]'
备注:
1.这种情况发生过两次(都是因为vm机器重启)，特此记录一下步骤，备查。
1.在hadoop36机器，ping hadoop38机器的pod的ip，为172.30.1.4
2.该pod的service的external-ip的ip为hadoop36的ip
3.下面机器的ip，已经使用 xx.xx.xx.来替代和加图层覆盖掉
问题: 无法通过服务EXTERNAL-IP+port,访问对应的pod的服务，说白了，就是无法访问pod ip+port,无法ping通172.30.1.4
步骤:
1.先把服务停掉
[root@hadoop38 ~]# systemctl stop etcd flanneld docker kubelet kube-proxy
2.查看当前规则，然后清空
[root@hadoop38 ~]# iptables -L -n
[root@hadoop38 ~]# iptables -F && iptables -X && iptables -F -t nat && iptables -X -t nat
[root@hadoop38 ~]# iptables -L -n
Chain INPUT (policy ACCEPT)
target prot opt source destination
Chain FORWARD (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
[root@hadoop38 ~]#
3.重启iptables 和 开启服务
[root@hadoop38 ~]# systemctl restart iptables
[root@hadoop38 ~]# systemctl start etcd flanneld docker kubelet kube-proxy
4.再次查看防火墙策略 和清空掉
[root@hadoop38 ~]# iptables -L -n
[root@hadoop38 ~]# iptables -F && iptables -X && iptables -F -t nat && iptables -X -t nat
5.等待一会 最终查看防火墙策略
[root@hadoop38 ~]# iptables -L -n
Chain INPUT (policy ACCEPT)
target prot opt source destination
KUBE-FIREWALL all -- 0.0.0.0/0 0.0.0.0/0
Chain FORWARD (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
KUBE-FIREWALL all -- 0.0.0.0/0 0.0.0.0/0
KUBE-SERVICES all -- 0.0.0.0/0 0.0.0.0/0 /* kubernetes service portals */
Chain KUBE-FIREWALL (2 references)
target prot opt source destination
DROP all -- 0.0.0.0/0 0.0.0.0/0 /* kubernetes firewall for dropping marked packets */ mark match 0x8000/0x8000
Chain KUBE-SERVICES (1 references)
target prot opt source destination
[root@hadoop38 ~]# destination
6.在36机器验证ping 和 telnet检验
[root@hadoop36 dns]# kubectl get all -n cdh -o wide
NAME READY STATUS RESTARTS AGE IP NODE
po/mysql-master-64k8r 1/1 Running 5 1h 172.30.1.4 xx.xx.xx.38
NAME DESIRED CURRENT READY AGE CONTAINER(S) IMAGE(S) SELECTOR
rc/mysql-master 1 1 1 1h master hadoop35.jiuye/k8sregister/jiuye/mysql5.6-master:v1.6 name=mysql-master
NAME CLUSTER-IP EXTERNAL-IP PORT(S) AGE SELECTOR
svc/mysql-master 10.254.56.245 xx.xx.xx.36 13307/TCP 1h name=mysql-master
[root@hadoop36 dns]#
[root@hadoop36 dns]# ping 172.30.1.4
PING 172.30.1.4 (172.30.1.4) 56(84) bytes of data.
64 bytes from 172.30.1.4: icmp_seq=1 ttl=63 time=0.388 ms
^Z
[31]+ Stopped ping 172.30.1.4
[root@hadoop36 dns]# telnet xx.xx.xx.36 13307
Trying xx.xx.xx..36...
Connected to xx.xx.xx..36.
Escape character is '^]'
备注:
1.这种情况发生过两次(都是因为vm机器重启)，特此记录一下步骤，备查。
