我在 RHEL8.6 上使用 podman 部署一个由两个容器（zabbix-server 和 postgres-server）组成的 pod。要部署容器，podman play kube请在 .yaml 文件上使用它来导入并运行 pod 配置。这是无根设置。
容器需要使用 DNS 通过内部网络进行通信。我用来podman create network mon创建一个名为“mon”的桥接网络，并启用了 DNS。
使用 时podman play kube monitoring.yaml --network mon，容器无法通过 DNS 相互通信。我通过手动创建 pod 和容器，在不使用 podman play kube 的情况下测试了设置。在手动设置中，Pod 中的容器能够使用 DNS 找到彼此。
手动的设置：
podman pod create --name monitoring
podman network create mon
podman run -d --rm --network=mon --pod=monitoring --name postgres-server docker.io/timescale/timescaledb:latest-pg14
podman run -d --rm --network=mon --pod=monitoring --name zabbix-server docker.io/zabbix/zabbix-server-pgsql
周一网络配置：
[
{
"cniVersion": "0.4.0",
"name": "mon",
"plugins": [
{
"bridge": "cni-podman1",
"hairpinMode": true,
"ipMasq": true,
"ipam": {
"ranges": [
[
{
"gateway": "10.89.0.1",
"subnet": "10.89.0.0/24"
}
]
],
"routes": [
{
"dst": "0.0.0.0/0"
}
],
"type": "host-local"
},
"isGateway": true,
"type": "bridge"
},
{
"capabilities": {
"portMappings": true
},
"type": "portmap"
},
{
"backend": "",
"type": "firewall"
},
{
"type": "tuning"
},
{
"capabilities": {
"aliases": true
},
"domainName": "dns.podman",
"type": "dnsname"
}
]
}
]
监控.yaml文件：
# Save the output of this file and use kubectl create -f to import
# it into Kubernetes.
#
# Created with podman-3.4.7
apiVersion: v1
kind: Pod
metadata:
creationTimestamp: "2022-05-24T13:40:30Z"
labels:
app: monitoring
name: monitoring
spec:
containers:
- args:
- postgres
image: docker.io/timescale/timescaledb:latest-pg14
name: postgres-server
resources: {}
securityContext:
capabilities:
drop:
- CAP_MKNOD
- CAP_NET_RAW
- CAP_AUDIT_WRITE
- args:
- /usr/sbin/zabbix_server
- --foreground
- -c
- /etc/zabbix/zabbix_server.conf
image: docker.io/zabbix/zabbix-server-pgsql:latest
name: zabbix-server
resources: {}
securityContext:
capabilities:
drop:
- CAP_MKNOD
- CAP_NET_RAW
- CAP_AUDIT_WRITE
volumeMounts:
- mountPath: /var/lib/zabbix/export
name: bdc06ccb2b092148bb78c353fccc104255a81a8735eb3a14974f6ede0e6516e8-pvc
- mountPath: /var/lib/zabbix/snmptraps
name: 196d7983e1b62995bae07beb7942e18ac46dcf6d3346e43fff2604c9a7bc30ec-pvc
restartPolicy: Never
volumes:
- name: bdc06ccb2b092148bb78c353fccc104255a81a8735eb3a14974f6ede0e6516e8-pvc
persistentVolumeClaim:
claimName: bdc06ccb2b092148bb78c353fccc104255a81a8735eb3a14974f6ede0e6516e8
- name: 196d7983e1b62995bae07beb7942e18ac46dcf6d3346e43fff2604c9a7bc30ec-pvc
persistentVolumeClaim:
claimName: 196d7983e1b62995bae07beb7942e18ac46dcf6d3346e43fff2604c9a7bc30ec
status: {}
故障排除
podman network createpodman 文档表明支持附加使用以下命令创建的网络：https://docs.podman.io/en/latest/markdown/podman-play-kube.1.html#network-mode-net
podman exec -it <container> /bin/bash在创建的容器上打开 shell ( )手动，我可以 ping zabbix-server 和 postgres-server：
$ podman exec -it zabbix-server /bin/bash
127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4
::1 localhost localhost.localdomain localhost6 localhost6.localdomain6
10.89.0.3 c61fdf070064 zabbix-server
10.89.0.1 host.containers.internal
bash-5.1$ ping postgres-server
PING postgres-server.dns.podman (10.89.0.2) 56(84) bytes of data.
64 bytes from postgres-server.dns.podman (10.89.0.2): icmp_seq=1 ttl=64 time=0.051 ms
64 bytes from postgres-server.dns.podman (10.89.0.2): icmp_seq=2 ttl=64 time=0.062 ms
64 bytes from postgres-server.dns.podman (10.89.0.2): icmp_seq=3 ttl=64 time=0.100 ms
^C
--- postgres-server.dns.podman ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2045ms
rtt min/avg/max/mdev = 0.051/0.071/0.100/0.021 ms
上玩库贝容器，pingmonitoring-<name>-server或者<name>-server失败。在手动和 play kube 设置上对 DNS 解析器执行 Ping 操作均成功返回。
bash-5.1$ cat /etc/hosts
127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4
::1 localhost localhost.localdomain localhost6 localhost6.localdomain6
10.89.0.2 monitoring be3df46ca68d-infra
10.89.0.1 host.containers.internal
bash-5.1$ ping postgres-server
ping: postgres-server: Name does not resolve
bash-5.1$ ping monitoring-postgres-server
ping: monitoring-postgres-server: Name does not resolve
bash-5.1$ cat /etc/resolv.conf
search dns.podman
nameserver 10.89.0.1
使用podman inspect <container>，手动和 kube play 设置都连接了“mon”网络。然而，关于玩库贝设置后，网络设置的输出如下：
"NetworkMode": "container:49e7b0bafd4619b9bcb50b1b841aeee3cb910bf3c555a9788dc297e71c948092"
这与手动的网络设置：
"NetworkMode": "bridge"
看起来好像“play kube”忽略了 --network 标志，而是创建了一个内部容器网络。查看容器网络设置库贝玩，两个容器上的ips是相同的。上手动的设置时，IP 不同：
"Networks": {
"mon": {
"EndpointID": "",
"Gateway": "10.89.0.1",
"IPAddress": "10.89.0.3",
"IPPrefixLen": 24,
"IPv6Gateway": "",
"GlobalIPv6Address": "",
"GlobalIPv6PrefixLen": 0,
"MacAddress": "3e:30:b7:e2:1d:00",
"NetworkID": "mon",
Networks": {
"mon": {
"EndpointID": "",
"Gateway": "10.89.0.1",
"IPAddress": "10.89.0.2",
"IPPrefixLen": 24,
"IPv6Gateway": "",
"GlobalIPv6Address": "",
"GlobalIPv6PrefixLen": 0,
"MacAddress": "fa:1a:6b:f3:02:3a",
"NetworkID": "mon",
我在强制模式下尝试过使用和不使用 SELinux 的 podman kube play。我也尝试过以 root 身份运行此设置，但无济于事。
我已经使用以下版本测试了此设置：
- 播客：3.4.7、4.0.2
- RHEL：8.5、8.6
任何帮助将非常感激！
答案1
我找到了解决方案。使用podman play kube共享网络命名空间创建的容器。因此，他们可以使用 相互访问localhost。