如何在 kubernetes 上从 pgadmin 访问 pgsql

Question

我在玩 kubenetes。我创建了一个运行 postgresql 的 StatefulSet。我用ClusterIP: None 创建了一个服务。我用 pgadmin4 启动了一个 pod。我可以从我的浏览器访问 pgadmin。当我尝试从 pgadmin 访问我的 pgsql 服务器时，它告诉我 ip 或端口不可访问。错误消息显示 ip 地址，所以我知道它正在解析正确的 pod 名称。

这是 Ubuntu 上的 MicroK8s。

这是我的配置。

--- pomodoro-pgsql StatefulSet ---

apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: pomodoro-pgsql
  namespace: pomodoro-services  
spec:
  selector:
    matchLabels:
      app: pomodoro-pgsql
      env: development
  serviceName: pomodoro-pgsql
  replicas: 1
  template:
    metadata:
      labels:
        app: pomodoro-pgsql
        env: development
    spec:
      containers:
      - name: pomodoro-pgsql
        image: localhost:32000/pomodoro-pgsql
        env:
        - name: POSTGRES_PASSWORD
          value: blahblah
        - name: POSTGRES_USER
          value: blahblah
        - name: POSTGRES_DB
          value: blahblah
        ports:
        - name: pgsql
          containerPort: 5432
        volumeMounts:
        - name: data
          mountPath: /var/lib/postgresql/data
  volumeClaimTemplates:
  - metadata:
      name: data
    spec:
      resources:
        requests:
          storage: 1Gi
      accessModes:
      - ReadWriteOnce

--- pomodoro-pgsql 无头服务---

apiVersion: v1
kind: Service
metadata:
  name: pomodoro-pgsql
  namespace: pomodoro-services
spec:
  clusterIP: None
  selector:
    app: pomodoro-pgsql
    env: development
  ports:
  - name: pgsql
    port: 5432    

--- pgadmin4 Pod --

apiVersion: v1
kind: Pod
metadata:
  name: pomodoro-pgadmin
  namespace: pomodoro-services
  labels:
    env: development
spec:
  containers:
  - name: pomodoro-pgadmin
    image: localhost:32000/pomodoro-pgadmin
    env:
    - name: PGADMIN_DEFAULT_EMAIL
      value: blahblah
    - name: PGADMIN_DEFAULT_PASSWORD
      value: blahblah
    imagePullPolicy: IfNotPresent
  restartPolicy: Always 

--- pgadmin4 服务---

apiVersion: v1
kind: Service
metadata:
  name: pomodoro-pgadmin
  namespace: pomodoro-services
spec:
  type: NodePort
  ports:
  - port: 5002
    targetPort: 80
  selector:
      app: pomodoro-pgadmin
      env: development

我可以通过dig看到ip地址

microk8s.kubectl run `
    --namespace pomodoro-services `
    -it srvlookup `
    --image=tutum/dnsutils --rm `
    --restart=Never `
    -- dig SRV pomodoro-pgsql.pomodoro-services.svc.cluster.local

这是来自 pgadmin 的错误。请注意，该 pod 的 IP 是正确的。

Unable to connect to server:

could not connect to server: Operation timed out
Is the server running on host "pomodoro-pgsql-0.pomodoro-pgsql.pomodoro-
services.svc.cluster.local" (10.10.10.219) and accepting
TCP/IP connections on port 5432?

这是来自 pgsql pod 的日志

2019-01-02 04:23:05.576 UTC [1] LOG:  listening on IPv4 address "0.0.0.0", port 5432
2019-01-02 04:23:05.576 UTC [1] LOG:  listening on IPv6 address "::", port 5432
2019-01-02 04:23:05.905 UTC [1] LOG:  listening on Unix socket "/var/run/postgresql/.s.PGSQL.5432"
2019-01-02 04:23:06.430 UTC [21] LOG:  database system was shut down at 2019-01-01 20:01:36 UTC
2019-01-02 04:23:06.630 UTC [1] LOG:  database system is ready to accept connections

根据要求，这是来自kubectl get services 的结果（IP 已更改。）

NAME                 TYPE        CLUSTER-IP      EXTERNAL-IP   PORT(S)          AGE
pomodoro-pgadmin     NodePort    10.1.18.45      <none>        5002:30437/TCP   12h
pomodoro-pgsql       ClusterIP   None            <none>        5432/TCP         46h
pomodoro-ping-rapi   ClusterIP   10.1.18.36      <none>        8888/TCP         47h

[更新 1/2/2019] 我连接到集群中的另一个容器并尝试 telnet，然后将 psql 连接到 postgres。我无法连接任何一个程序。我可以在运行 postgresql 服务器的容器上运行 psql。我目前的理论是服务器在本地暴露了 5432，但是它是从其他 pod 中过滤出来的。

我已确认/var/lib/postgresql/data/postgresql.conf 包含以下内容：

listen_addresses = '*'

使用microk8s.kubctl port-forward pomodoro-pgsql-0 5432:5432我可以通过telnet连接到5432。

_> telnet localhost 5432
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.

[2019 年 1 月 2 日更新]

结果kubctl exec pomodoro-pgsql-0 -- nslookup pomodoro-pgsql

nslookup: can't resolve '(null)': Name does not resolve
nslookup: can't resolve 'pomodoro-pgsql': Try again
command terminated with exit code 1

结果kubctl exec pomodoro-pgsql-0 -- nslookup pomodoro-pgsql-0

Name:      pomodoro-pgsql-0
Address 1: 10.1.1.19 pomodoro-pgsql-0.pomodoro-pgsql.pomodoro-services.svc.cluster.local
nslookup: can't resolve '(null)': Name does not resolve

注意：重新启动计算机时 IP 会发生变化。

Answer 1

问题是运行 microk8s 的计算机的防火墙规则。我发现这记录在他们的web page 中，文档告诉我们这样做：

sudo iptables -P FORWARD ACCEPT
sudo apt-get install iptables-persistent