k3s nodePort 暴露服务，仅 pod 运行节点能通过端口访问，集群内部访问正常，别的访问不了

[cnbattle]

找相关文章,所有节点执行以下命令，依然不行，请大佬救命

K3S : k3s-v1.21.4

Linux: Debian 10

root@node2:~# iptables -P FORWARD ACCEPT
root@node2:~# iptables -I FORWARD -s 0.0.0.0/0 -d 0.0.0.0/0 -j ACCEPT

[defunct9]

开 ssh，让我上去看看

[miaowing]

这个不是正常的嘛

[cnbattle]

@defunct9 本地的虚拟机 0.0
@miaowing nodePort 不是暴露到所有节点的吗？ 我看一些文章说的的会负载带所有节点

[miaowing]

@cnbattle 据我所知好像不是，等其他大佬看看😅

[ss098]

检查一下云服务厂商的防火墙。

或者试一下 LoadBalancer ？ k3s 的 LoadBalancer 是开箱即用的。

[xx6412223]

service yaml 看下

[cnbattle]

@xx6412223 部署的 kubernetes-dashboard 加了 `type: NodePort` 和 `nodePort: 30001`

```
kind: Service
apiVersion: v1
metadata:
name: kubernetes-dashboard
namespace: kubernetes-dashboard
uid: bfcf6cae-4834-4447-8799-ed9e38b6593c
resourceVersion: '5989'
creationTimestamp: '2021-09-06T05:07:50Z'
labels:
k8s-app: kubernetes-dashboard
annotations:
kubectl.kubernetes.io/last-applied-configuration: >
{"apiVersion":"v1","kind":"Service","metadata":{"annotations":{},"labels":{"k8s-app":"kubernetes-dashboard"},"name":"kubernetes-dashboard","namespace":"kubernetes-dashboard"},"spec":{"ports":[{"nodePort":30001,"port":443,"targetPort":8443}],"selector":{"k8s-app":"kubernetes-dashboard"},"type":"NodePort"}}
managedFields:
- manager: kubectl-client-side-apply
operation: Update
apiVersion: v1
time: '2021-09-06T05:07:50Z'
fieldsType: FieldsV1
fieldsV1:
f:metadata:
f:annotations:
.: {}
f:kubectl.kubernetes.io/last-applied-configuration: {}
f:labels:
.: {}
f:k8s-app: {}
f:spec:
f:externalTrafficPolicy: {}
f:ports:
.: {}
k:{"port":443,"protocol":"TCP"}:
.: {}
f:nodePort: {}
f:port: {}
f:protocol: {}
f:targetPort: {}
f:selector:
.: {}
f:k8s-app: {}
f:sessionAffinity: {}
f:type: {}
spec:
ports:
- protocol: TCP
port: 443
targetPort: 8443
nodePort: 30001
selector:
k8s-app: kubernetes-dashboard
clusterIP: 10.43.16.174
clusterIPs:
- 10.43.16.174
type: NodePort
sessionAffinity: None
externalTrafficPolicy: Cluster
ipFamilies:
- IPv4
ipFamilyPolicy: SingleStack
status:
loadBalancer: {}

```

[xx6412223]

@cnbattle svc 没问题，
看看 kubeproxy 吧，不行就抓包了

[cnbattle]

@xx6412223 嗯 谢谢

[miaowing]

@cnbattle 再配一个 ingress，所有节点就都能访问了，不用 nodePort
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
name: kubernetes-dashboard-https-ingress
namespace: kubernetes-dashboard
annotations:
traefik.ingress.kubernetes.io/router.entrypoints: websecure
traefik.ingress.kubernetes.io/router.tls: "true"
spec:
tls:
- secretName: kubernetes-dashboard-certs
rules:
- host: dashboard.example.com
http:
paths:
- path: /
backend:
serviceName: kubernetes-dashboard
servicePort: 443

[cnbattle]

@miaowing 谢谢 我的虚拟机网络好像是有问题的，

k3s 自带的 traefik LoadBalancer，监听了所有节点的 80 443 端口，
所有节点都有其 svclb pod 和其中一个 traefik pod，
但只有运行 traefik pod 的节点对 80 443 端口访问正常返回，
其余均返回响应时间过长

[RRyo]

描述有点像 svc 的 externalTrafficPolicy 被配置成了 Local