Question: How can I provide reliable access from (non-K8s) services running in an GCE network to other services running inside Kubernetes?
Background: We are running a hosted K8s setup in the Google Cloud Platform. Most services are 12factor apps and run just fine within K8s. Some backing stores (databases) are run outside of K8s. Accessing them is easy by using headless services with manually defined endpoints to fixed internal IPs. Those services usually do not need to "talk back" to the services in K8s.
But some services running in the internal GCE network (but outside of K8s) need to access services running within K8s. We can expose the K8s services using spec.type: NodePort and talk to this port on any of the K8s Nodes IPs. But how can we automatically find the right NodePort and a valid Worker Node IP? Or maybe there is even a better way to solve this issue.
This setup is probably not a typical use-case for a K8s deployment, but we'd like to go this way until PetSets and Persistent Storage in K8s have matured enough.
As we are talking about internal services I'd like to avoid using an external loadbalancer in this case.
2条答案
按热度按时间u7up0aaq1#
您可以通过创建“堡垒路由”或在连接的机器上运行kube-proxy，使集群服务IP在集群外部（但在专用网络内部）有意义（请参阅此答案）。
我认为你也可以把resolv.conf指向集群的DNS服务，这样就可以解析服务DNS名称。
kkbh8khc2#
一种可能的方法是使用入口控制器。入口控制器的设计目的是提供从Kubernetes集群外部到集群内部运行的服务的访问。入口控制器作为集群内部的一个单元运行，将请求从集群外部路由到集群内部的正确服务，这为运行在GCE网络中的非Kubernetes服务访问运行在Kubernetes中的服务提供了一种安全可靠的方式。