Kubernetes pod无法通过IP连接到服务

我的入口吊舱无法通过IP连接到两个clusterIP服务。还有很多其他clusterIP服务，它可以轻松访问。包括在同一命名空间中。另一个pod在访问服务时没有问题（我在同一名称空间中尝试了默认后端，结果很好）

我应该去哪里看？以下是我的实际服务，它无法到达第一个，但可以到达第二个：

- apiVersion: v1
  kind: Service
  metadata:
    creationTimestamp: "2019-08-23T16:59:10Z"
    labels:
      app: pka-168-emtpy-id
      app.kubernetes.io/instance: palletman-pka-168-emtpy-id
      app.kubernetes.io/managed-by: Tiller
      helm.sh/chart: pal-0.0.1
      release: palletman-pka-168-emtpy-id
    name: pka-168-emtpy-id
    namespace: palletman
    resourceVersion: "108574168"
    selfLink: /api/v1/namespaces/palletman/services/pka-168-emtpy-id
    uid: 539364f9-c5c7-11e9-8699-0af40ce7ce3a
  spec:
    clusterIP: 100.65.111.47
    ports:
    - port: 80
      protocol: TCP
      targetPort: 8080
    selector:
      app: pka-168-emtpy-id
    sessionAffinity: None
    type: ClusterIP
  status:
    loadBalancer: {}
- apiVersion: v1
  kind: Service
  metadata:
    creationTimestamp: "2019-03-05T19:57:26Z"
    labels:
      app: production
      app.kubernetes.io/instance: palletman
      app.kubernetes.io/managed-by: Tiller
      helm.sh/chart: pal-0.0.1
      release: palletman
    name: production
    namespace: palletman
    resourceVersion: "81337664"
    selfLink: /api/v1/namespaces/palletman/services/production
    uid: e671c5e0-3f80-11e9-a1fc-0af40ce7ce3a
  spec:
    clusterIP: 100.65.82.246
    ports:
    - port: 80
      protocol: TCP
      targetPort: 8080
    selector:
      app: production
    sessionAffinity: None
    type: ClusterIP
  status:
    loadBalancer: {}

我的入口吊舱：

apiVersion: v1
kind: Pod
metadata:
  annotations:
    sumologic.com/format: text
    sumologic.com/sourceCategory: 103308/CT/LI/kube_ingress
    sumologic.com/sourceName: kube_ingress
  creationTimestamp: "2019-08-21T19:34:48Z"
  generateName: ingress-nginx-65877649c7-
  labels:
    app: ingress-nginx
    k8s-addon: ingress-nginx.addons.k8s.io
    pod-template-hash: "2143320573"
  name: ingress-nginx-65877649c7-5npmp
  namespace: kube-ingress
  ownerReferences:
  - apiVersion: extensions/v1beta1
    blockOwnerDeletion: true
    controller: true
    kind: ReplicaSet
    name: ingress-nginx-65877649c7
    uid: 97db28a9-c43f-11e9-920a-0af40ce7ce3a
  resourceVersion: "108278133"
  selfLink: /api/v1/namespaces/kube-ingress/pods/ingress-nginx-65877649c7-5npmp
  uid: bcd92d96-c44a-11e9-8699-0af40ce7ce3a
spec:
  containers:
  - args:
    - /nginx-ingress-controller
    - --default-backend-service=$(POD_NAMESPACE)/nginx-default-backend
    - --configmap=$(POD_NAMESPACE)/ingress-nginx
    - --publish-service=$(POD_NAMESPACE)/ingress-nginx
    env:
    - name: POD_NAME
      valueFrom:
        fieldRef:
          apiVersion: v1
          fieldPath: metadata.name
    - name: POD_NAMESPACE
      valueFrom:
        fieldRef:
          apiVersion: v1
          fieldPath: metadata.namespace
    image: gcr.io/google_containers/nginx-ingress-controller:0.9.0-beta.13
    imagePullPolicy: Always
    livenessProbe:
      failureThreshold: 3
      httpGet:
        path: /healthz
        port: 10254
        scheme: HTTP
      initialDelaySeconds: 30
      periodSeconds: 10
      successThreshold: 1
      timeoutSeconds: 5
    name: ingress-nginx
    ports:
    - containerPort: 80
      name: http
      protocol: TCP
    resources: {}
    terminationMessagePath: /dev/termination-log
    terminationMessagePolicy: File
    volumeMounts:
    - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
      name: default-token-dg5wn
      readOnly: true
  dnsPolicy: ClusterFirst
  nodeName: ip-10-55-131-177.eu-west-1.compute.internal
  restartPolicy: Always
  schedulerName: default-scheduler
  securityContext: {}
  serviceAccount: default
  serviceAccountName: default
  terminationGracePeriodSeconds: 60
  tolerations:
  - effect: NoExecute
    key: node.kubernetes.io/not-ready
    operator: Exists
    tolerationSeconds: 300
  - effect: NoExecute
    key: node.kubernetes.io/unreachable
    operator: Exists
    tolerationSeconds: 300
  volumes:
  - name: default-token-dg5wn
    secret:
      defaultMode: 420
      secretName: default-token-dg5wn
status:
  conditions:
  - lastProbeTime: null
    lastTransitionTime: "2019-08-21T19:34:48Z"
    status: "True"
    type: Initialized
  - lastProbeTime: null
    lastTransitionTime: "2019-08-21T19:34:50Z"
    status: "True"
    type: Ready
  - lastProbeTime: null
    lastTransitionTime: "2019-08-21T19:34:48Z"
    status: "True"
    type: PodScheduled
  containerStatuses:
  - containerID: docker://d597673f4f38392a52e9537e6dd2473438c62c2362a30e3d58bf8a98e177eb12
    image: gcr.io/google_containers/nginx-ingress-controller:0.9.0-beta.13
    imageID: docker-pullable://gcr.io/google_containers/nginx-ingress-controller@sha256:c9d2e67f8096d22564a6507794e1a591fbcb6461338fc655a015d76a06e8dbaa
    lastState: {}
    name: ingress-nginx
    ready: true
    restartCount: 0
    state:
      running:
        startedAt: "2019-08-21T19:34:50Z"
  hostIP: 10.55.131.177
  phase: Running
  podIP: 172.6.218.18
  qosClass: BestEffort
  startTime: "2019-08-21T19:34:48Z"

---

它可以连接到Pod运行的节点。（或网络覆盖相关）您可以检查pod的运行位置：

$ kubectl get pod -o=json  | jq .items[0].spec.nodeName

检查节点是否“就绪”：

$ kubectl get node <node-from-above>

$kubectl获取节点

如果准备好了，请将ssh连接到节点以进一步排除故障：

$ ssh <node-from-above>

$ssh

覆盖吊舱是否在节点上运行？（印花布、织布、CNI等）

您可以进一步排除连接到吊舱/集装箱的故障

# From <node-from-above>
$ docker exec -it <container-id-in-pod> bash
# Check connectivity (ping, dig, curl, etc)

#来自
$docker exec-it bash
#检查连通性（ping、dig、curl等）

另外，通过使用kubectl命令行（如果您有到节点的网络连接）

$kubectl exec-it-c bash
#疑难解答。。。

您所说的“默认后端”是什么意思？它只是部署入口控制器吊舱的同一命名空间中的另一个吊舱。您可以发布入口吊舱的yaml吗？我使用weave。我可以看到每个节点上都有一个编织吊舱。我尝试从入口吊舱和另一个使用exec的bod中连接到服务，这就是我知道它无法连接的原因

curl

只是在那里坐了一会儿，然后抛出“连接超时”你能执行到使用curl无法访问的pod吗？我能。我试图访问入口服务群集IP，但发现主机无法访问。我还可以通过群集IP和google访问另一个服务。在同一个k8s节点上是否可以访问其他POD？我无法从节点上的其他POD访问入口服务。我可以从同一个吊舱很好地到达其他服务。我尝试在这个节点上反弹编织吊舱，但没有帮助

$ kubectl exec -it <pod-id> -c <container-name> bash 
# Troubleshoot...