282 lines
6.6 KiB
Markdown
282 lines
6.6 KiB
Markdown
# 🔥 紧急修复：无法访问服务的问题
|
||
|
||
## 问题诊断
|
||
|
||
✅ **服务状态正常：**
|
||
```
|
||
argocd-server NodePort 80:31875/TCP,443:31064/TCP
|
||
gitea-http NodePort 3000:32158/TCP
|
||
demo-nginx NodePort 80:30080/TCP
|
||
test-app NodePort 80:30081/TCP
|
||
```
|
||
|
||
❌ **问题原因：阿里云ECS安全组未开放NodePort端口**
|
||
|
||
从本地无法访问这些端口，但从master节点内部可以访问，说明是云服务器安全组阻止了外部访问。
|
||
|
||
## 🔧 解决方案
|
||
|
||
### 方案1: 配置阿里云安全组（推荐）
|
||
|
||
#### 步骤1: 登录阿里云控制台
|
||
1. 访问 https://ecs.console.aliyun.com/
|
||
2. 登录你的阿里云账号
|
||
|
||
#### 步骤2: 找到安全组
|
||
1. 左侧菜单选择 **网络与安全** → **安全组**
|
||
2. 找到你的ECS实例所在的安全组
|
||
|
||
#### 步骤3: 添加入方向规则
|
||
点击 **配置规则** → **入方向** → **手动添加**，添加以下规则：
|
||
|
||
| 端口范围 | 授权对象 | 描述 |
|
||
|---------|---------|------|
|
||
| 30080/30080 | 0.0.0.0/0 | Demo App |
|
||
| 30081/30081 | 0.0.0.0/0 | Test App |
|
||
| 31875/31875 | 0.0.0.0/0 | ArgoCD HTTP |
|
||
| 31064/31064 | 0.0.0.0/0 | ArgoCD HTTPS |
|
||
| 32158/32158 | 0.0.0.0/0 | Gitea HTTP |
|
||
| 30625/30625 | 0.0.0.0/0 | Gitea SSH |
|
||
|
||
或者一次性开放NodePort范围：
|
||
| 端口范围 | 授权对象 | 描述 |
|
||
|---------|---------|------|
|
||
| 30000/32767 | 0.0.0.0/0 | K3s NodePort范围 |
|
||
|
||
**注意：** 如果只想允许特定IP访问，将 `0.0.0.0/0` 改为你的公网IP。
|
||
|
||
#### 步骤4: 保存并等待生效
|
||
保存规则后，等待1-2分钟生效。
|
||
|
||
### 方案2: 使用Traefik Ingress（推荐用于生产）
|
||
|
||
Traefik已经部署并监听在80和443端口，我们可以通过Ingress访问服务。
|
||
|
||
#### 2.1 配置ArgoCD Ingress
|
||
|
||
```bash
|
||
ssh fei@8.216.38.248
|
||
kubectl apply -f - <<EOF
|
||
apiVersion: networking.k8s.io/v1
|
||
kind: Ingress
|
||
metadata:
|
||
name: argocd-server
|
||
namespace: argocd
|
||
annotations:
|
||
traefik.ingress.kubernetes.io/router.entrypoints: web
|
||
traefik.ingress.kubernetes.io/router.tls: "false"
|
||
spec:
|
||
rules:
|
||
- host: argocd.jpc.net3w.com
|
||
http:
|
||
paths:
|
||
- path: /
|
||
pathType: Prefix
|
||
backend:
|
||
service:
|
||
name: argocd-server
|
||
port:
|
||
number: 80
|
||
EOF
|
||
```
|
||
|
||
#### 2.2 配置Gitea Ingress
|
||
|
||
```bash
|
||
kubectl apply -f - <<EOF
|
||
apiVersion: networking.k8s.io/v1
|
||
kind: Ingress
|
||
metadata:
|
||
name: gitea
|
||
namespace: gitea
|
||
annotations:
|
||
traefik.ingress.kubernetes.io/router.entrypoints: web
|
||
spec:
|
||
rules:
|
||
- host: git.jpc.net3w.com
|
||
http:
|
||
paths:
|
||
- path: /
|
||
pathType: Prefix
|
||
backend:
|
||
service:
|
||
name: gitea-http
|
||
port:
|
||
number: 3000
|
||
EOF
|
||
```
|
||
|
||
#### 2.3 配置Demo App Ingress
|
||
|
||
```bash
|
||
kubectl apply -f - <<EOF
|
||
apiVersion: networking.k8s.io/v1
|
||
kind: Ingress
|
||
metad name: demo-app
|
||
namespace: default
|
||
annotations:
|
||
traefik.ingress.kubernetes.io/router.entrypoints: web
|
||
spec:
|
||
rules:
|
||
- host: demo.jpc.net3w.com
|
||
http:
|
||
paths:
|
||
- path: /
|
||
pathType: Prefix
|
||
backend:
|
||
service:
|
||
name: demo-nginx
|
||
port:
|
||
number: 80
|
||
EOF
|
||
```
|
||
|
||
#### 2.4 配置DNS或hosts文件
|
||
|
||
**选项A: 配置DNS（生产环境）**
|
||
在DNS管理面板添加A记录：
|
||
```
|
||
argocd.jpc.net3w.com → 8.216.38.248
|
||
git.jpc.net3w.com → 8.216.38.248
|
||
demo.jpc.net3w.com → 8.216.38.248
|
||
test.jpc.net3w.com → 8.216.38.248
|
||
```
|
||
|
||
**选项B: 配置本地hosts文件（测试）**
|
||
|
||
Linux/Mac:
|
||
```bash
|
||
sudo tee -a /etc/hosts <<EOF
|
||
8.216.38.248 argocd.jpc.net3w.com
|
||
8.216.38.248 git.jpc.net3w.com
|
||
8.216.38.248 demo.jpc.net3w.com
|
||
8.216.38.248 test.jpc.net3w.com
|
||
EOF
|
||
```
|
||
|
||
Windows (管理员权限):
|
||
```
|
||
编辑 C:\Windows\System32\drivers\etc\hosts
|
||
添加：
|
||
8.216.38.248 argocd.jpc.net3w.com
|
||
8.216.38.248 git.jpc.net3w.com
|
||
8.216.38.248 demo.jpc.net3w.com
|
||
8.216.38.248 test.jpc.net3w.com
|
||
```
|
||
|
||
然后访问：
|
||
- http://argocd.jpc.net3w.com
|
||
- http://git.jpc.net3w.com
|
||
- http://demo.jpc.net3w.com
|
||
- http://test.jpc.net3w.com
|
||
|
||
### 方案3: 使用SSH端口转发（临时测试）
|
||
|
||
如果暂时无法修改安全组，可以使用SSH端口转发：
|
||
|
||
```bash
|
||
# 转发Arsh -L 8080:localhost:31875 fei@8.216.38.248 -N &
|
||
|
||
# 转发Gitea
|
||
ssh -L 8081:localhost:32158 fei@8.216.38.248 -N &
|
||
|
||
# 转发Demo App
|
||
ssh -L 8082:localhost:30080 fei@8.216.38.248 -N &
|
||
|
||
# 转发Test App
|
||
ssh -L 8083:localhost:30081 fei@8.216.38.248 -N &
|
||
```
|
||
|
||
然后在本地浏览器访问：
|
||
- ArgoCD: http://localhost:8080
|
||
- Gitea: http://localhost:8081
|
||
- Demo App: http://localhost:8082
|
||
- Test App: http://localhost:8083
|
||
|
||
## 🎯 推荐方案
|
||
|
||
### 短期（立即可用）
|
||
1. **使用SSH端口转发**（方案3）- 立即可用，无需等待
|
||
2. **配置阿里云安全组**（方案1）- 开放NodePort端口
|
||
|
||
### 长期（生产环境）
|
||
1. **使用Traefik Ingress**（方案2）- 只需开放80/443端口
|
||
2. **配置HTTPS证书** - 使用cert-manager + Let's Encrypt
|
||
3. **配置DNS解析** - 使用域名访问
|
||
|
||
## 📊 验证访问
|
||
|
||
### 验证NodePort访问（需要开放安全组）
|
||
```bash
|
||
# 从本地测试
|
||
curl http://8.216.38.248:30080 # Demo App
|
||
curl http://8.216.38.248:30081 # Test App
|
||
curl http://8.216.38.248:32158 # Gitea
|
||
curl -k https://8.216.38.248:31875 # ArgoCD
|
||
```
|
||
|
||
### 验证Ingress访问（需要配置DNS或hosts）
|
||
```bash
|
||
curl http://demo.jpc.net3w.com
|
||
curl http://test.jpc.net3w.com
|
||
curl http://git.jpc.net3w.com
|
||
curl http://argocd.jpc.net3w.com
|
||
```
|
||
|
||
### 从master节点内部测试（已验证可用）
|
||
```bash
|
||
ssh fei@8.216.38.248
|
||
curl http://localhost:30080 # Demo App ✅
|
||
curl http://localhost:30081 # Test App ✅
|
||
curl http://localhost:32158 # Gitea ✅
|
||
curl -k https://localhost:31875 # ArgoCD ✅
|
||
```
|
||
|
||
## 🔍 故障排查
|
||
|
||
### 1. 检查服务状态
|
||
```bash
|
||
kubectl get svc -A | grep NodePort
|
||
kubectl get ingress -A
|
||
```
|
||
|
||
### 2. 检查Pod状态
|
||
```bash
|
||
kubectl get pods -A
|
||
kubectl logs -n argocd deployment/argocd-server
|
||
kubectl logs -n gitea -l app.kubernetes.io/name=gitea
|
||
```
|
||
|
||
### 3. 检查Traefik
|
||
```bash
|
||
kubectl get pods -n kube-system -l app.kubernetes.io/name=traefik
|
||
kubectl logs -n kube-system -l app.kubernetes.io/name=traefik
|
||
```
|
||
|
||
### 4. 测试端口连通性
|
||
```bash
|
||
# 从本地测试
|
||
nc -zv 8.216.38.248 80
|
||
nc -zv 8.216.38.248 443
|
||
nc -zv 8.216.38.248 30080
|
||
nc -zv 8.216.38.248 31875
|
||
```
|
||
|
||
## 📝 总结
|
||
|
||
**当前状态：**
|
||
- ✅ K3s集群运行正常
|
||
- ✅ 所有服务部署成功
|
||
- ✅ 从master节点内部可以访问
|
||
- ❌ 从外部无法访问（安全组未开放）
|
||
|
||
**立即可用的解决方案：**
|
||
1. 使用SSH端口转发（方案3）- 无需等待
|
||
2. 配置阿里云安全组（方案1）- 需要1-2分钟生效
|
||
|
||
**生产环境推荐：**
|
||
1. 使用Traefik Ingress（方案2）
|
||
2. 只开放80/443端口
|
||
3. 配置HTTPS证书
|
||
4. 使用域名访问
|