Welcome to the Linux Foundation Forum!

Lab 8.1 routing issue

Options
Posts: 1
in LFS258 Class Forum

Hi all,
I deployed and exposed nginx-one, the pods landed on my second node (kube-worker-01) as expected

  1. ubuntu@kube-ctrl-01:~/labs/8.1-service$ kubectl -n accounting describe pod nginx-one-755bd7c7d5-kq777
  2. Name:         nginx-one-755bd7c7d5-kq777
  3. Namespace:    accounting
  4. Priority:     0
  5. Node:         kube-worker-01/10.20.0.5
  6. Start Time:   Thu, 28 May 2020 19:43:19 +0000
  7. Labels:       pod-template-hash=755bd7c7d5
  8.               system=secondary
  9. Annotations:  cni.projectcalico.org/podIP: 192.168.188.187/32
  10.               cni.projectcalico.org/podIPs: 192.168.188.187/32
  11. Status:       Running
  12. IP:           192.168.188.187

However, curl from the control node does not work (since there is no route)

  1. ubuntu@kube-ctrl-01:~/labs/8.1-service$ curl 192.168.188.187:80
  2. curl: (7) Failed to connect to 192.168.188.187 port 80: Connection refused
  3.  
  4. route -n
  5. 192.168.84.129  0.0.0.0         255.255.255.255 UH    0      0        0 cali8f6751be4be
  6. 192.168.84.130  0.0.0.0         255.255.255.255 UH    0      0        0 cali99d95d831c3
  7. 192.168.84.131  0.0.0.0         255.255.255.255 UH    0      0        0 calid152b729a3f

The pod itself if fine, I can curl it from the second node where it resides

  1. ubuntu@kube-worker-01:~$ curl 192.168.188.187:80
  2. <!DOCTYPE html>
  3. <html>

I would expect calico to handle inter-node communication via tunl0 interfaces, correct ?

Thanks and regards

Piotrek Z

Comments

  • Posts: 2,480

    Hi Piotrek,

    Your situation is consistently reported in the forum, and it reflects the cluster's inability to route traffic between nodes, typically because of a firewall that is blocking specific ports. When there is an infrastructure firewall and/or even an OS firewall, Kubernetes will not be able to go around it. Kubernetes does not manage the infrastructure on your behalf, it only uses it as-is.

    I would recommend revisiting your firewall rules. At the infrastructure level allow all ingress traffic from all sources, all protocols, to all ports, and at the nodes' OS level disable any firewall you may have running.

    Regards,
    -Chris

Welcome!

It looks like you're new here. Sign in or register to get started.
Sign In

Welcome!

It looks like you're new here. Sign in or register to get started.
Sign In

Quick Links

Categories

Upcoming Training