Reach pods with Services and DNS

هذا الجزء لم يُترجم بعد. أنت ترى النص الإنجليزي.

$ مستخدم عادي# بصلاحية root (أو مع sudo)

المهارات في هذا الفصل

الخدمات ونقاط النهاية و CoreDNS

Know the service types

The type decides who can reach the service.

Type	Reachable from	Notes
ClusterIP (default)	Inside the cluster	A virtual IP
NodePort	Every node's IP on a port 30000–32767	For tests or external load balancers
LoadBalancer	The internet / network	Asks the cloud for a load balancer
ExternalName	Inside the cluster	A DNS alias (CNAME) to an outside name
Headless (`clusterIP: None`)	Inside the cluster	DNS returns the pod IPs (StatefulSets)

8.2

Expose a Deployment

kubectl expose creates a Service with the Deployment's labels as selector.

$kubectl expose deployment web --port=80 --target-port=8080 -n shop
$kubectl expose deployment web --name=web-np --type=NodePort --port=80 --target-port=8080 -n shop
$kubectl get svc -n shop
NAME     TYPE        CLUSTER-IP     EXTERNAL-IP   PORT(S)        AGE
web      ClusterIP   10.96.41.12    <none>        80/TCP         10s
web-np   NodePort    10.96.200.7    <none>        80:31452/TCP   5s
$curl http://NODE_IP:31452/

service.yaml

apiVersion: v1
kind: Service
metadata: { name: web, namespace: shop }
spec:
  selector: { app: web }
  ports:
    - name: http
      port: 80
      targetPort: 8080

Field	Meaning
`port`	The port of the Service
`targetPort`	The port of the container
`nodePort`	The port on every node (NodePort type)
`selector`	Which pods get the traffic

8.3

Check the endpoints

The Service sends traffic only to ready pods that match the selector. The endpoints list shows them.

$kubectl get endpointslices -n shop -l kubernetes.io/service-name=web
$kubectl describe svc web -n shop | grep -i endpoints
Endpoints:         10.244.1.15:8080,10.244.2.9:8080

تذكّر

No endpoints = the selector labels do not match the pod labels, or the pods are not ready. This is the most common Service problem.

8.4

Use cluster DNS

Every Service gets a DNS name: SERVICE.NAMESPACE.svc.cluster.local. Inside the same namespace, the short name SERVICE works.

$kubectl run tmp --rm -it --image=busybox:1.36 --restart=Never -- nslookup web.shop.svc.cluster.local
Name:      web.shop.svc.cluster.local
Address 1: 10.96.41.12
$kubectl run tmp --rm -it --image=busybox:1.36 --restart=Never -- wget -qO- http://web.shop
$kubectl get pods -n kube-system -l k8s-app=kube-dns
$kubectl get configmap coredns -n kube-system -o yaml

Name	Resolves to
`web`	The Service in the same namespace
`web.shop`	The Service `web` in namespace `shop`
`web.shop.svc.cluster.local`	The full name
`10-244-1-15.shop.pod.cluster.local`	A pod by its IP

8.5

Know how kube-proxy routes

kube-proxy (or an eBPF CNI like Cilium) programs every node so traffic to a Service IP goes to one of its pods.

$kubectl get daemonset kube-proxy -n kube-system
$kubectl get configmap kube-proxy -n kube-system -o yaml | grep mode
#iptables-save | grep web | head

كل الأوامر في هذا الفصل