Not able to access service using <nodeip>:<nodeport>

user_8011693 0
Viewed 641

I have the following Services in GKE cluster:

NAME                  TYPE           CLUSTER-IP      EXTERNAL-IP     PORT(S)          AGE     SELECTOR
currency-conversion   NodePort       10.105.13.208   <none>          8100:30285/TCP   5h56m   app=currency-conversion
currency-exchange     LoadBalancer   10.105.6.251    34.72.191.147   8000:31396/TCP   5h59m   app=currency-exchange
kubernetes            ClusterIP      10.105.0.1      <none>          443/TCP          3d12h   <none>

I have the following Nodes in GKE:

NAME                                                STATUS   ROLES    AGE   VERSION         INTERNAL-IP   EXTERNAL-IP       OS-IMAGE                             KERNEL-VERSION   CONTAINER-RUNTIME
gke-my-first-cluster-1-default-pool-c2c915e7-818c   Ready    <none>   9h    v1.17.6-gke.7   10.128.0.9    35.194.22.175     Container-Optimized OS from Google   4.19.112+        docker://19.3.6
gke-my-first-cluster-1-default-pool-c2c915e7-xg0r   Ready    <none>   9h    v1.17.6-gke.7   10.128.0.8    104.197.190.232   Container-Optimized OS from Google   4.19.112+        docker://19.3.6
gke-my-first-cluster-1-default-pool-c2c915e7-z8fn   Ready    <none>   9h    v1.17.6-gke.7   10.128.0.10   35.188.75.231     Container-Optimized OS from Google   4.19.112+        docker://19.3.6

When I try to use command below:

  • curl http://35.194.22.175:30285/

I'm getting the Timeout error.

google-kubernetes-engine
1 Answers

You cannot access your service currency-conversion because of the firewall rules. Your requests are going to be blocked by default by VPC Firewall. To allow traffic to your currency-conversion service you can either:

  • Create a firewall rule that will allow the traffic to enter (you will be able to $ curl NODE_IP:NODE_PORT):
    • $ gcloud compute firewall-rules create test-node-port --allow tcp:NODE_PORT
  • Create a service of type LoadBalancer which will allocate public IP address and create a forwarding rule for access (you've already done it with currency-exchange):
    • $ kubectl expose deployment NAME --type=LoadBalancer --port=PORT-CONTAINER-IS-LISTENING-ON

You can read more about Kubernetes services here:

Disclaimer!

$ gcloud compute firewall-rules create test-node-port --allow tcp:node-port

Above rule will allow traffic to ALL instances in the default network.

For more secure approach you can use the below rule:

$ gcloud compute --project=PROJECT_NAME firewall-rules create allow-nodeport --direction=INGRESS --priority=1000 --network=default --action=ALLOW --rules=tcp:30285,udp:30285 --source-ranges=0.0.0.0/0 --target-tags=gke-gke-XYZ-ABC-node

Focusing on parts of above command:

  • --direction=INGRESS - it's for incoming requests
  • --network=default - use the name of the network your GKE cluster is in
  • --rules=tcp:30285,udp:30285 - use the port number (30285) your service is exposed on
  • --source-ranges=0.0.0.0/0 - this parameter will allow traffic from any IP
  • --target-tags=gke-gke-XYZ-ABC-node - use the network tag of your GKE cluster nodes. You can get this network tag by going into GCP -> Compute Engine -> GKE-NODE -> VM Instance details -> network tags. 

You can also take a look here:

user_122571340
Related