☰

在 Google 计算引擎上运行的 kubernetes pod 无法访问元数据服务

tag-icon • tag-icon kubernetes google-compute-engine
在 Google 计算引擎上运行的 kubernetes pod 无法访问元数据服务

我正在尝试从运行在 Google 计算引擎上的 K8 Pod 内部运行 Google Cloud Python SDK。有一个服务帐户附加到 VM，该帐户授予它访问机密管理器的权限。我能够从主机访问机密管理器，但是从 K8 Pod 运行 Python SDK 时会抱怨无法访问元数据服务

>>> secret_id = 'unskript_test'
>>> name = client.secret_path(project_id, secret_id)
>>> response = client.get_secret(request={"name": name})
Traceback (most recent call last):
  File "/opt/conda/lib/python3.7/site-packages/google/api_core/grpc_helpers.py", line 67, in error_remapped_callable
    return callable_(*args, **kwargs)
  File "/opt/conda/lib/python3.7/site-packages/grpc/_channel.py", line 946, in __call__
    return _end_unary_response_blocking(state, call, False, None)
  File "/opt/conda/lib/python3.7/site-packages/grpc/_channel.py", line 849, in _end_unary_response_blocking
    raise _InactiveRpcError(state)
grpc._channel._InactiveRpcError: <_InactiveRpcError of RPC that terminated with:
    status = StatusCode.UNAVAILABLE
    details = "Getting metadata from plugin failed with error: Failed to retrieve http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/?recursive=true from the Google Compute Enginemetadata service. Compute Engine Metadata server unavailable"
    debug_error_string = "{"created":"@1630634901.103779641","description":"Getting metadata from plugin failed with error: Failed to retrieve http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/?recursive=true from the Google Compute Enginemetadata service. Compute Engine Metadata server unavailable","file":"src/core/lib/security/credentials/plugin/plugin_credentials.cc","file_line":90,"grpc_status":14}"
>

metadata.google.internal 无法从 k8 pod 解析

jovyan@jovyan-25ca6c8c-157d-49e5-9366-f9d57fcb7a9f:~$ wget http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/?recursive=true
--2021-09-03 02:11:19--  http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/?recursive=true
Resolving metadata.google.internal (metadata.google.internal)... failed: Name or service not known.
wget: unable to resolve host address ‘metadata.google.internal’

但是，主持人能够解决这个问题

ubuntu@gcp-test-proxy:~$ wget http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/?recursive=true
--2021-09-03 02:11:27--  http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/?recursive=true
Resolving metadata.google.internal (metadata.google.internal)... 169.254.169.254
Connecting to metadata.google.internal (metadata.google.internal)|169.254.169.254|:80... connected.
HTTP request sent, awaiting response... 403 Forbidden
2021-09-03 02:11:27 ERROR 403: Forbidden.

我怎样才能让 pod 解析 metadata.google.internal？

答案1

这是因为 Kubernetes pod 无法将metadata.google.internalDNS 名称解析为正确的 IP。您的主机可能有一个条目，/etc/hosts该条目将该域硬编码为 IP：169.254.169.254。

您应该能够通过修改其/etc/hosts文件在您的 Pod 中复制它。

请记住，这仅适用于在 GCP 上运行的虚拟机。在外部，IP 地址 169.254.169.254 只是另一个没有特殊含义的 IP 地址。

编辑：刚刚检查了我的其中一台 GCP VM 上的 /etc/hosts，发现了以下内容：

$ cat /etc/hosts
127.0.0.1 localhost

# The following lines are desirable for IPv6 capable hosts
::1 ip6-localhost ip6-loopback
fe00::0 ip6-localnet
ff00::0 ip6-mcastprefix
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters
ff02::3 ip6-allhosts
169.254.169.254 metadata.google.internal metadata

因此，只需尝试将最后一行复制到您的 pods 中/etc/hosts。

答案2

问题在于 microk8s 不会将主机等主机条目复制到 pod。一旦我们转移到 k3，它就解决了

相关内容