k8spod跨namespace访问service

###

1、场景需求

场景需求：
Kubernetes的三个Service（ServiceA0、serviceA1、ServiceB）和对应的Pod（PodA0、podA1、PodB）分别属于不同的namespace名称空间，
现需要PodA0、podA1跨namespace并通过servic实现访问PodB。如何实现？
说明：这里是指通过Service的Name进行通信访问，而不是通过Service的IP【因因为每次重启Service，NAME不会改变，而IP是会改变的】。
注释：此方法多用于 不同namespase01、namespace02、namespace03下pod 访问namespace04中的中间件服务(多对一)

2、主机配置简介

服务器名称(hostname) 　　系统版本 　　　　配置 　　　　服务器IP 　　　　　
k8s-master 　　　　CentOS7.5 2C/4G/20G 192.168.2.140
k8s-node01 　　　　CentOS7.5 2C/4G/20G 192.168.2.141
k8s-node02 　　　　CentOS7.5 2C/4G/20G 192.168.2.142

3、创建test-namespace-A命名空间、service、pod的yaml文件

[root@k8s-master service-pod-yarm]# pwd
/root/k8s_yarm/service-pod-yarm
[root@k8s-master service-pod-yarm]#
[root@k8s-master service-pod-yarm]# cat deply_service_service-pod-A0.yaml
apiVersion: v1
kind: Namespace
metadata:
name: test-namespace-A
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: pod-A0
namespace: test-namespace-A
spec:
replicas: 1
selector:
matchLabels:
app: test-A0
release: v1
template:
metadata:
labels:
app: test-A0
release: v1
spec:
containers:
- name: test-A0
image: registry.cn-beijing.aliyuncs.com/google_registry/nginx:v1
imagePullPolicy: IfNotPresent
ports:
- name: http
containerPort: 80
---
apiVersion: v1
kind: Service
metadata:
name: service-A0-svc
namespace: test-namespace-A
spec:
type: ClusterIP # 默认类型
selector:
app: test-A0
release: v1
ports:
- name: http
port: 80
targetPort: 80
#==================================================================================
#==================================================================================
[root@k8s-master service-pod-yarm]# cat deply_service_service-pod-A1.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
name: pod-A1
namespace: test-namespace-A
spec:
replicas: 1
selector:
matchLabels:
app: test-A1
release: v2
template:
metadata:
labels:
app: test-A1
release: v2
spec:
containers:
- name: test-A1
image: registry.cn-beijing.aliyuncs.com/google_registry/nginx:v2
imagePullPolicy: IfNotPresent
ports:
- name: http
containerPort: 80
---
apiVersion: v1
kind: Service
metadata:
name: service-A1-svc
namespace: test-namespace-A
spec:
type: ClusterIP # 默认类型
selector:
app: test-A1
release: v2
ports:
- name: http
port: 80
targetPort: 80

4、创建test-namespace-B命名空间、service、pod的yaml文件

[root@k8s-master service-pod-yarm]# pwd
/root/k8s_yarm/service-pod-yarm
[root@k8s-master service-pod-yarm]#
[root@k8s-master service-pod-yarm]# cat deply_service_service-pod-B0.yaml
apiVersion: v1
kind: Namespace
metadata:
name: test-namespace-B
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: pod-B0
namespace: test-namespace-B
spec:
replicas: 1
selector:
matchLabels:
app: test-B0
release: v1
template:
metadata:
labels:
app: test-B0
release: v1
spec:
containers:
- name: test-B0
image: registry.cn-beijing.aliyuncs.com/google_registry/test:v1
imagePullPolicy: IfNotPresent
ports:
- name: http
containerPort: 80
---
apiVersion: v1
kind: Service
metadata:
name: service-B0-svc
namespace: test-namespace-B
spec:
type: ClusterIP # 默认类型
selector:
app: test-B0
release: v1
ports:
- name: http
port: 80
targetPort: 80

5、运行yarm文件

kubectl apply -f deply_service_service-pod-A0.yaml
kubectl apply -f deply_service_service-pod-A1.yaml
kubectl apply -f deply_service_service-pod-B0.yaml

6、查看上述部署2个命名空间下 service、pod

[root@k8s-master service-pod-yarm]# kubectl get pod,svc -A -o wide|grep -E "(test-namespace-A)|(test-namespace-B)|(NAMESPACE)"
NAMESPACE NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES
test-namespace-A pod/pod-A0-5b9d78576c-wfw4n 1/1 Running 0 41m 10.244.2.136 k8s-node02
test-namespace-A pod/pod-A1-5b9d78576c-zsfjl 1/1 Running 0 41m 10.244.2.193 k8s-node01
test-namespace-B pod/pod-B0-dc8f96497-nnkqn 1/1 Running 0 41m 10.244.3.194 k8s-node01
NAMESPACE NAME 　　　　　TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE SELECTOR
test-namespace-A service/service-A0-svc ClusterIP 10.100.61.11 80/TCP 41m app=test-A0,release=v1
test-namespace-A service/service-A1-svc ClusterIP 10.100.61.141 80/TCP 41m app=test-A1,release=v1
test-namespace-B service/service-B0-svc ClusterIP 10.100.201.103 80/TCP 41m app=test-B0,release=v2

 7、测试同命名空间下pod 访问service(注：此处测试pod跨namespace无法访问service)

 7.1、进入ns名称空间下的一个Pod容器，测试在同一名称空间下，通信无问题

[root@k8s-master service-pod-yarm]# kubectl exec -it -n test-namespace-A pod-A0-5b9d78576c-wfw4n /bin/bash
/ # ping service-A0-svc -c 2
PING service-A0 (10.100.61.11): 56 data bytes
64 bytes from 10.100.61.11: icmp_seq=1 ttl=64 time=0.033 ms
64 bytes from 10.100.61.11: icmp_seq=2 ttl=64 time=0.035 ms
--- service-A0.test-namespace-A.svc.cluster.local ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1000ms
rtt min/avg/max/mdev = 0.033/0.034/0.035/0.001 ms
/ # curl -I service-A0-svc
HTTP/1.1 200 OK
Date: Tue, 07 Dec 2021 11:20:52 GMT
Content-Language: zh-CN
Content-Type: text/html;charset=utf-8
Content-Length: 16735
/ # ######################################################################/ # ping service-A1-svc -c 2
PING service-A1 (10.100.61.141): 56 data bytes
64 bytes from 10.100.61.141: icmp_seq=1 ttl=64 time=0.033 ms
64 bytes from 10.100.61.141: icmp_seq=2 ttl=64 time=0.035 ms
--- service-A1.test-namespace-A.svc.cluster.local ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1000ms
rtt min/avg/max/mdev = 0.033/0.034/0.035/0.001 ms
/ # curl -I service-A1-svc
HTTP/1.1 200 OK
Date: Tue, 07 Dec 2021 11:21:54 GMT
Content-Language: zh-CN
Content-Type: text/html;charset=utf-8
Content-Length: 16735

7.2、进入ns名称空间下的一个Pod容器，测试在不同一名称空间下通信（pod无法跨namespace访问service）

[root@k8s-master service-pod-yarm]# kubectl exec -it -n test-namespace-A pod-A0-5b9d78576c-wfw4n /bin/bash
/ # ping dservice-B0-svc
ping: service-B0-svc : Name or service not known
/ # curl dservice-B0-svc
curl: (6) Could not resolve host: service-B0-svc

8、实现跨namespace与Service通信

通过Service的ExternalName类型即可实现跨namespace名称空间与Service通信。
Service域名格式：$(service name).$(namespace).svc.cluster.local，其中 cluster.local 为指定的集群的域名

8.1、创建ExternalName类型service的yaml文件【实现 test-namespace-A 名称空间的pod，访问 test-namespace-B 名称空间的Service：service-B0-svc】

[root@k8s-master service-pod-yarm]# pwd
/root/k8s_yarm/service-pod-yarm
[root@k8s-master service-pod-yarm]# cat svc_ExternalName_visit.yaml 
apiVersion: v1
kind: Service
metadata:
name: access-ping-test-namespace-B-svc
namespace: test-namespace-A
spec:
type: ExternalName
externalName: service-B0-svc.test-namespace-B.svc.cluster.local
ports:
- name: http
port: 80
targetPort: 80

8.2、运行yarm文件

kubectl apply -fsvc_ExternalName_visit.yaml

9、查看此时2个命名空间svc，pod

[root@k8s-master service-pod-yarm]# kubectl get pod,svc -A -o wide|grep -E "(test-namespace-A)|(test-namespace-B)|(NAMESPACE)"
NAMESPACE NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES
test-namespace-A pod/pod-A0-5b9d78576c-wfw4n 1/1 Running 0 41m 10.244.2.136 k8s-node02
test-namespace-A pod/pod-A1-5b9d78576c-zsfjl 1/1 Running 0 41m 10.244.2.193 k8s-node01
test-namespace-B pod/pod-B0-dc8f96497-nnkqn 1/1 Running 0 41m 10.244.3.194 k8s-node01
NAMESPACE NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE SELECTOR
test-namespace-A service/service-A0-svc ClusterIP 10.100.61.11 80/TCP 41m app=test-A0,release=v1
test-namespace-A service/service-A1-svc ClusterIP 10.100.61.141 80/TCP 41m app=test-A1,release=v1
test-namespace-B service/service-B0-svc ClusterIP 10.100.201.103 80/TCP 41m app=test-B0,release=v2
test-namespace-A service/access-ping-test-namespace-B-svc ExternalName service-B0-svc.test-namespace-B.svc.cluster.local 92m

10、测试pod跨namespace 访问service(可以跨namespace访问)

[root@k8s-master service-pod-yarm]# kubectl exec -it -n test-namespace-A pod-A0-5b9d78576c-wfw4n /bin/bash
/ # ping service-B0-svc.test-namespace-B.svc.cluster.local -c 2
PING service-A0 (10.100.61.11): 56 data bytes
64 bytes from 10.100.61.11: icmp_seq=1 ttl=64 time=0.033 ms
64 bytes from 10.100.61.11: icmp_seq=2 ttl=64 time=0.035 ms
--- service-A0.test-namespace-A.svc.cluster.local ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1000ms
rtt min/avg/max/mdev = 0.033/0.034/0.035/0.001 ms
/ # curl -I service-B0-svc.test-namespace-B.svc.cluster.local
HTTP/1.1 200 OK
Date: Tue, 07 Dec 2021 11:20:52 GMT
Content-Language: zh-CN
Content-Type: text/html;charset=utf-8
Content-Length: 16735
[root@k8s-master service-pod-yarm]# kubectl exec -it -n test-namespace-A pod-A1-5b9d78576c-zsfjl /bin/bash
/ # ping service-B0-svc.test-namespace-B.svc.cluster.local -c 2
PING service-A0 (10.100.61.11): 56 data bytes
64 bytes from 10.100.61.11: icmp_seq=1 ttl=64 time=0.033 ms
64 bytes from 10.100.61.11: icmp_seq=2 ttl=64 time=0.035 ms
--- service-A0.test-namespace-A.svc.cluster.local ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1000ms
rtt min/avg/max/mdev = 0.033/0.034/0.035/0.001 ms
/ # curl -I service-B0-svc.test-namespace-B.svc.cluster.local
HTTP/1.1 200 OK
Date: Tue, 07 Dec 2021 11:20:52 GMT
Content-Language: zh-CN
Content-Type: text/html;charset=utf-8
Content-Length: 16735

11、附加：

如果想要
命名空间test-namespace-B下pod-B0-dc8f96497-nnkqn访问
命名空间test-namespace-A下所有servcie
需要在test-namespace-B命名空间下
创建两个不同ExternalName类型的svc
示例创建service的yarm文件：
[root@k8s-master service-pod-yarm]# vim svc_ExternalName_B0_to_A_visit.yaml
apiVersion: v1
kind: Service
metadata:
name: access-B0-to-A0-svc
namespace: test-namespace-B
spec:
type: ExternalName
externalName: service-A0-svc.test-namespace-A.svc.cluster.local
ports:
- name: http
port: 80
targetPort: 80
---
apiVersion: v1
kind: Service
metadata:
name: access-B0-to-A1-svc
namespace: test-namespace-B
spec:
type: ExternalName
externalName: service-A1-svc.test-namespace-A.svc.cluster.local
ports:
- name: http
port: 80
targetPort: 80

###