创建GKE群集时
可以创建群集,但节点无法正常启动。在日志-节点(vm)的串行端口1(控制台)输出中,我可以看到以下错误:
[ 24.630930] configure.sh[1010]: Getting the service account access token configured for VM.
[ 24.673381] configure.sh[1010]: Service account access token is received. Downloading https://storage.googleapis.com/gke-release/npd-custom-plugins/v1.0.4/npd-custom-plugins-v1.0.4.tar.gz using this token.
[ 24.969664] configure.sh[1116]: curl: (7) Failed to connect to storage.googleapis.com port 443 after 292 ms: Connection refused
[ 24.969859] configure.sh[1116]: Warning: Problem : connection refused. Will retry in 10 seconds. 6 retries.
[ 66.167634] configure.sh[1116]: Warning: left.
[ 76.459028] configure.sh[1116]: curl: (7) Failed to connect to storage.googleapis.com port 443 after 281 ms: Connection refused
[ 76.459198] configure.sh[1116]: Warning: Problem : connection refused. Will retry in 10 seconds. 1 retries
[ 76.459252] configure.sh[1116]: Warning: left.
[ 86.759856] configure.sh[1116]: curl: (7) Failed to connect to storage.googleapis.com port 443 after 290 ms: Connection refused
[ 86.760211] configure.sh[1010]: == Failed to download https://storage.googleapis.com/gke-release/npd-custom-plugins/v1.0.4/npd-custom-plugins-v1.0.4.tar.gz. Retrying.
这看起来是一个权限问题,但我真的不知道错过了什么权限。我甚至给编辑,网络管理,和安全管理这些服务帐户,但仍然得到同样的错误。
service-abcde@container-engine-robot.iam.gserviceaccount.com
Compute Network User
Compute Network Admin
Compute Security Admin
Kubernetes Engine Host Service Agent User
Service Networking Service Agent
abcde@cloudservices.gserviceaccount.com
Compute Network User
我使用的命令是:
gcloud container clusters create poc-65 --project project-xyz \
--zone=us-west1-a --enable-ip-alias \
--network projects/project-xyz/global/networks/network-xyz \
--subnetwork projects/project-xyz/regions/us-west1/subnetworks/subnet-xyz \
--services-secondary-range-name uat-xyz-service \
--cluster-secondary-range-name uat-xyz-pod \
--no-enable-master-authorized-networks \
--master-ipv4-cidr 172.16.2.32/28 \
--enable-private-nodes --num-nodes 3 \
--default-max-pods-per-node 20
谢谢
1条答案
按热度按时间oknwwptz1#
对不起,我找到原因了。我们的代理机构有一个政策,所有到外部的流量都必须通过内部网络,我们确实替换了默认的0.0.0.0/0路由,将其指向内部。但内部防火墙规则阻止了流量,这就是为什么在创建集群期间,节点无法访问谷歌私有服务API。调整防火墙规则后,问题得到了解决。