K8s nginx -ingress для MySQL - без ошибок, но все еще не можете подключиться? ⇐ MySql

[Anonymous]

Я настраиваю контроллер Ingress, частично в качестве опыта обучения, чтобы обеспечить прямой доступ от нашей корпоративной локальной сети к экземпляру MySQL, работающему в нашем экземпляре Kubernetes. MySQL работает просто отлично, но попытки правильно настроить контроллер Ingress. Я использовал файл yaml по умолчанию для среды Ingress-nginx в качестве основы для моей собственной .yaml ниже: < /p>

Код: Выделить всё

apiVersion: v1
automountServiceAccountToken: true
kind: ServiceAccount
metadata:
labels:
app.kubernetes.io/component: controller
app.kubernetes.io/instance: mysql-ingress
app.kubernetes.io/name: mysql-ingress
app.kubernetes.io/part-of: mysql-ingress
app.kubernetes.io/version: 1.12.3
name: mysql-ingress
namespace: default
---
apiVersion: v1
automountServiceAccountToken: true
kind: ServiceAccount
metadata:
labels:
app.kubernetes.io/component: admission-webhook
app.kubernetes.io/instance: mysql-ingress
app.kubernetes.io/name: mysql-ingress
app.kubernetes.io/part-of: mysql-ingress
app.kubernetes.io/version: 1.12.3
name: mysql-ingress-admission
namespace: default
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
labels:
app.kubernetes.io/component: controller
app.kubernetes.io/instance: mysql-ingress
app.kubernetes.io/name: mysql-ingress
app.kubernetes.io/part-of: mysql-ingress
app.kubernetes.io/version: 1.12.3
name: mysql-ingress
namespace: default
rules:
- apiGroups:
- ""
resources:
- namespaces
verbs:
- get
- apiGroups:
- ""
resources:
- configmaps
- pods
- secrets
- endpoints
verbs:
- get
- list
- watch
- apiGroups:
- ""
resources:
- services
verbs:
- get
- list
- watch
- apiGroups:
- networking.k8s.io
resources:
- ingresses
verbs:
- get
- list
- watch
- apiGroups:
- networking.k8s.io
resources:
- ingresses/status
verbs:
- update
- apiGroups:
- networking.k8s.io
resources:
- ingressclasses
verbs:
- get
- list
- watch
- apiGroups:
- coordination.k8s.io
resourceNames:
- mysql-ingress-leader
resources:
- leases
verbs:
- get
- update
- apiGroups:
- coordination.k8s.io
resources:
- leases
verbs:
- create
- apiGroups:
- ""
resources:
- events
verbs:
- create
- patch
- apiGroups:
- discovery.k8s.io
resources:
- endpointslices
verbs:
- list
- watch
- get
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
labels:
app.kubernetes.io/component: admission-webhook
app.kubernetes.io/instance: mysql-ingress
app.kubernetes.io/name: mysql-ingress
app.kubernetes.io/part-of: mysql-ingress
app.kubernetes.io/version: 1.12.3
name: mysql-ingress-admission
namespace: default
rules:
- apiGroups:
- ""
resources:
- secrets
verbs:
- get
- create
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
labels:
app.kubernetes.io/instance: mysql-ingress
app.kubernetes.io/name: mysql-ingress
app.kubernetes.io/part-of: mysql-ingress
app.kubernetes.io/version: 1.12.3
name: mysql-ingress
namespace: default
rules:
- apiGroups:
- ""
resources:
- configmaps
- endpoints
- nodes
- pods
- secrets
- namespaces
verbs:
- list
- watch
- apiGroups:
- coordination.k8s.io
resources:
- leases
verbs:
- list
- watch
- apiGroups:
- ""
resources:
- nodes
verbs:
- get
- apiGroups:
- ""
resources:
- services
verbs:
- get
- list
- watch
- apiGroups:
- networking.k8s.io
resources:
- ingresses
verbs:
- get
- list
- watch
- apiGroups:
- ""
resources:
- events
verbs:
- create
- patch
- apiGroups:
- networking.k8s.io
resources:
- ingresses/status
verbs:
- update
- apiGroups:
- networking.k8s.io
resources:
- ingressclasses
verbs:
- get
- list
- watch
- apiGroups:
- discovery.k8s.io
resources:
- endpointslices
verbs:
- list
- watch
- get
---
apiVersion: rbac.authorization.k8s.io/v1
kind:  ClusterRole
metadata:
labels:
app.kubernetes.io/component: admission-webhook
app.kubernetes.io/instance: mysql-ingress
app.kubernetes.io/name: mysql-ingress
app.kubernetes.io/part-of: mysql-ingress
app.kubernetes.io/version: 1.12.3
name: mysql-ingress-admission
namespace: default
rules:
- apiGroups:
- admissionregistration.k8s.io
resources:
- validatingwebhookconfigurations
verbs:
- get
- update
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
labels:
app.kubernetes.io/component: controller
app.kubernetes.io/instance: mysql-ingress
app.kubernetes.io/name: mysql-ingress
app.kubernetes.io/part-of: mysql-ingress
app.kubernetes.io/version: 1.12.3
name: mysql-ingress
namespace: default
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: mysql-ingress
subjects:
- kind: ServiceAccount
name: mysql-ingress
namespace: default
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
labels:
app.kubernetes.io/component: admission-webhook
app.kubernetes.io/instance: mysql-ingress
app.kubernetes.io/name: mysql-ingress
app.kubernetes.io/part-of: mysql-ingress
app.kubernetes.io/version: 1.12.3
name: mysql-ingress-admission
namespace: default
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: mysql-ingress-admission
subjects:
- kind: ServiceAccount
name: mysql-ingress-admission
namespace: default
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
labels:
app.kubernetes.io/instance: mysql-ingress
app.kubernetes.io/name: mysql-ingress
app.kubernetes.io/part-of: mysql-ingress
app.kubernetes.io/version: 1.12.3
name: mysql-ingress
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: mysql-ingress
subjects:
- kind: ServiceAccount
name: mysql-ingress
namespace: default
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
labels:
app.kubernetes.io/component: admission-webhook
app.kubernetes.io/instance: mysql-ingress
app.kubernetes.io/name: mysql-ingress
app.kubernetes.io/part-of: mysql-ingress
app.kubernetes.io/version: 1.12.3
name: mysql-ingress-admission
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: mysql-ingress-admission
subjects:
- kind: ServiceAccount
name: mysql-ingress-admission
namespace: default
---
apiVersion: v1
data:
"3306": default/mysql-service:3306
kind: ConfigMap
metadata:
name: tcp-services
namespace: default
---
apiVersion: v1
data: null
kind: ConfigMap
metadata:
labels:
app.kubernetes.io/component: controller
app.kubernetes.io/instance: mysql-ingress
app.kubernetes.io/name: mysql-ingress
app.kubernetes.io/part-of: mysql-ingress
app.kubernetes.io/version: 1.12.3
name: mysql-ingress-controller
namespace: default
---
apiVersion: v1
kind: Service
metadata:
labels:
app.kubernetes.io/component: controller
app.kubernetes.io/instance: mysql-ingress
app.kubernetes.io/name: mysql-ingress
app.kubernetes.io/part-of: mysql-ingress
app.kubernetes.io/version: 1.12.3
name: mysql-ingress-controller
namespace: default
spec:
externalTrafficPolicy: Local
ipFamilies:
- IPv4
ipFamilyPolicy: SingleStack
ports:
- appProtocol: http
name: http
port: 80
protocol: TCP
targetPort: http
# - appProtocol: https
#   name: https
#   port: 443
#   protocol: TCP
#   targetPort: https
- appProtocol: mysql
name: mysql
port: 3306
protocol: TCP
targetPort: 3306
selector:
app.kubernetes.io/component: controller
app.kubernetes.io/instance: mysql-ingress
app.kubernetes.io/name: mysql-ingress
type: LoadBalancer
---
apiVersion: v1
kind: Service
metadata:
labels:
app.kubernetes.io/component: controller
app.kubernetes.io/instance: mysql-ingress
app.kubernetes.io/name: mysql-ingress
app.kubernetes.io/part-of: mysql-ingress
app.kubernetes.io/version: 1.12.3
name: mysql-ingress-controller-admission
namespace: default
spec:
ports:
- appProtocol: mysql
name: mysql-webhook
port: 3306
targetPort: webhook
selector:
app.kubernetes.io/component: controller
app.kubernetes.io/instance: mysql-ingress
app.kubernetes.io/name: mysql-ingress
type: ClusterIP
---
apiVersion: apps/v1
kind: Deployment
metadata:
labels:
app.kubernetes.io/component: controller
app.kubernetes.io/instance: mysql-ingress
app.kubernetes.io/name: mysql-ingress
app.kubernetes.io/part-of: mysql-ingress
app.kubernetes.io/version: 1.12.3
name: mysql-ingress-controller
namespace: default
spec:
minReadySeconds: 0
revisionHistoryLimit: 10
selector:
matchLabels:
app.kubernetes.io/component: controller
app.kubernetes.io/instance: mysql-ingress
app.kubernetes.io/name: mysql-ingress
strategy:
rollingUpdate:
maxUnavailable: 1
type: RollingUpdate
template:
metadata:
labels:
app.kubernetes.io/component: controller
app.kubernetes.io/instance: mysql-ingress
app.kubernetes.io/name: mysql-ingress
app.kubernetes.io/part-of: mysql-ingress
app.kubernetes.io/version: 1.12.3
spec:
containers:
- args:
- /nginx-ingress-controller
- --publish-service=$(POD_NAMESPACE)/mysql-ingress-controller
- --election-id=mysql-ingress-leader
- --controller-class=k8s.io/ingress-nginx
- --ingress-class=nginx
- --configmap=$(POD_NAMESPACE)/mysql-ingress-controller
- --tcp-services-configmap=$(POD_NAMESPACE)/tcp-services
- --udp-services-configmap=$(POD_NAMESPACE)/udp-services
# - --validating-webhook=:8443
# - --validating-webhook-certificate=/usr/local/certificates/cert
# - --validating-webhook-key=/usr/local/certificates/key
env:
- name: POD_NAME
valueFrom:
fieldRef:
fieldPath: metadata.name
- name: POD_NAMESPACE
valueFrom:
fieldRef:
fieldPath: metadata.namespace
- name: LD_PRELOAD
value: /usr/local/lib/libmimalloc.so
image: registry.k8s.io/ingress-nginx/controller:v1.12.3@sha256:ac444cd9515af325ba577b596fe4f27a34be1aa330538e8b317ad9d6c8fb94ee
imagePullPolicy: IfNotPresent
lifecycle:
preStop:
exec:
command:
- /wait-shutdown
livenessProbe:
failureThreshold: 5
httpGet:
path: /healthz
port: 10254
scheme: HTTP
initialDelaySeconds: 10
periodSeconds: 10
successThreshold: 1
timeoutSeconds: 1
name: controller
ports:
- containerPort: 3306
name: mysql
protocol: TCP
# - containerPort: 443
#   name: https
#   protocol: TCP
# - containerPort: 8443
#   name: webhook
#   protocol: TCP
readinessProbe:
failureThreshold: 3
httpGet:
path: /healthz
port: 10254
scheme: HTTP
initialDelaySeconds: 10
periodSeconds: 10
successThreshold: 1
timeoutSeconds: 1
resources:
requests:
cpu: 100m
memory: 90Mi
securityContext:
allowPrivilegeEscalation: false
capabilities:
add:
- NET_BIND_SERVICE
drop:
- ALL
readOnlyRootFilesystem: false
runAsGroup: 82
runAsNonRoot: true
runAsUser: 101
seccompProfile:
type: RuntimeDefault
volumeMounts:
- mountPath: /usr/local/certificates/
name: webhook-cert
readOnly: true
dnsPolicy: ClusterFirst
nodeSelector:
kubernetes.io/os: linux
serviceAccountName: mysql-ingress
terminationGracePeriodSeconds: 300
volumes:
- name: webhook-cert
secret:
secretName: mysql-ingress-admission
---
apiVersion: batch/v1
kind: Job
metadata:
labels:
app.kubernetes.io/component: admission-webhook
app.kubernetes.io/instance: mysql-ingress
app.kubernetes.io/name: mysql-ingress
app.kubernetes.io/part-of:  mysql-ingress
app.kubernetes.io/version: 1.12.3
name: ingress-nginx-admission-create
namespace: default
spec:
template:
metadata:
labels:
app.kubernetes.io/component: admission-webhook
app.kubernetes.io/instance: mysql-ingress
app.kubernetes.io/name: mysql-ingress
app.kubernetes.io/part-of: mysql-ingress
app.kubernetes.io/version: 1.12.3
name: ingress-nginx-admission-create
spec:
containers:
- args:
- create
- --host=mysql-ingress-controller-admission,mysql-ingress-controller-admission.$(POD_NAMESPACE).svc
- --namespace=$(POD_NAMESPACE)
- --secret-name=mysql-ingress-admission
env:
- name: POD_NAMESPACE
valueFrom:
fieldRef:
fieldPath: metadata.namespace
image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.5.4@sha256:7a38cf0f8480775baaee71ab519c7465fd1dfeac66c421f28f087786e631456e
imagePullPolicy: IfNotPresent
name: create
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
readOnlyRootFilesystem: true
runAsGroup: 65532
runAsNonRoot: true
runAsUser: 65532
seccompProfile:
type: RuntimeDefault
nodeSelector:
kubernetes.io/os: linux
restartPolicy: OnFailure
serviceAccountName: mysql-ingress-admission
ttlSecondsAfterFinished: 0
---
apiVersion: batch/v1
kind: Job
metadata:
labels:
app.kubernetes.io/component: admission-webhook
app.kubernetes.io/instance: mysql-ingress
app.kubernetes.io/name: mysql-ingress
app.kubernetes.io/part-of: mysql-ingress
app.kubernetes.io/version: 1.12.3
name: ingress-nginx-admission-patch
namespace: default
spec:
template:
metadata:
labels:
app.kubernetes.io/component: admission-webhook
app.kubernetes.io/instance: mysql-ingress
app.kubernetes.io/name: mysql-ingress
app.kubernetes.io/part-of: mysql-ingress
app.kubernetes.io/version: 1.12.3
name: ingress-nginx-admission-patch
spec:
containers:
- args:
- patch
- --webhook-name=mysql-ingress-admission
- --namespace=$(POD_NAMESPACE)
- --patch-mutating=false
- --secret-name=mysql-ingress-admission
- --patch-failure-policy=Fail
env:
- name: POD_NAMESPACE
valueFrom:
fieldRef:
fieldPath: metadata.namespace
image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.5.4@sha256:7a38cf0f8480775baaee71ab519c7465fd1dfeac66c421f28f087786e631456e
imagePullPolicy: IfNotPresent
name: patch
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
readOnlyRootFilesystem: true
runAsGroup: 65532
runAsNonRoot: true
runAsUser: 65532
seccompProfile:
type: RuntimeDefault
nodeSelector:
kubernetes.io/os: linux
restartPolicy: OnFailure
serviceAccountName: mysql-ingress-admission
ttlSecondsAfterFinished: 0
---
apiVersion: networking.k8s.io/v1
kind: IngressClass
metadata:
labels:
app.kubernetes.io/component: controller
app.kubernetes.io/instance: mysql-ingress
app.kubernetes.io/name: mysql-ingress
app.kubernetes.io/part-of: mysql-ingress
app.kubernetes.io/version: 1.12.3
name: nginx
spec:
controller: k8s.io/ingress-nginx
---
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingWebhookConfiguration
metadata:
labels:
app.kubernetes.io/component: admission-webhook
app.kubernetes.io/instance: mysql-ingress
app.kubernetes.io/name: mysql-ingress
app.kubernetes.io/part-of: mysql-ingress
app.kubernetes.io/version: 1.12.3
name: mysql-ingress-admission
webhooks:
- admissionReviewVersions:
- v1
clientConfig:
service:
name: mysql-ingress-controller-admission
namespace: default
path: /networking/v1/ingresses
port: 3306
failurePolicy: Fail
matchPolicy: Equivalent
name:  validate.nginx.ingress.kubernetes.io
rules:
- apiGroups:
- networking.k8s.io
apiVersions:
- v1
operations:
- CREATE
- UPDATE
resources:
- ingresses
sideEffects: None

---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: mysql-ingress
namespace: default
annotations:
nginx.ingress.kubernetes.io/rewrite-target: /

spec:
ingressClassName: mysql-ingress
rules:
- host: mdhnaplapp7016.ra-int.com
http:
paths:
- backend:
service:
name: mysql
port:
number: 3306
path: /
pathType: Prefix
< /code>
Когда я применяю конфигурацию, я был рад видеть никаких ошибок, но я все еще не могу добраться до 3306 на Localhost или снаружи и установить соединение.  NetStat не показывает, что ничто не открывается на 3306 Service MySQL, настроено следующим образом: < /p>
kind: Service
metadata:
name: mysql-service

spec:
type: ClusterIP
selector:
app: mysql
environment: dev
ports:
- protocol: TCP
port: 3306
targetPort: 3306

К сожалению, несмотря на отсутствие ошибок, я все еще не вижу 3306 в NetStat - кто -нибудь может помочь?


Подробнее здесь: https://stackoverflow.com/questions/796 ... nt-connect