0

I setup my own cluster using Kubespray on google cloud: 1 master, 1 node. I launched a jenkins app on it. The app does not show up in the browser even though everything appears to be correct. My service and deployment (copied from article on internet so that I don't introduce any potential errors):

apiVersion: v1
kind: Service
metadata:
  name: jenkins
spec:
  type: NodePort
  ports:
    - port: 8080
      targetPort: 8080
  selector:
    app: jenkins
---
apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  name: jenkins
spec:
  replicas: 1
  template:
    metadata:
      labels:
        app: jenkins
    spec:
      containers:
        - name: jenkins
          image: jenkins/jenkins
          env:
            - name: JAVA_OPTS
              value: -Djenkins.install.runSetupWizard=false
          ports:
            - name: http-port
              containerPort: 8080
            - name: jnlp-port
              containerPort: 50000

Everything looks as you would expect. Run a kubectl get pods and see that it is running:

NAME                      READY   STATUS    RESTARTS   AGE
jenkins-b64d4d96d-4vj48   1/1     Running   0          22m

Run a kubectl get svc for the nodeport:

NAME         TYPE        CLUSTER-IP      EXTERNAL-IP   PORT(S)          AGE
jenkins      NodePort    10.233.28.168   <none>        8080:31794/TCP   25m
kubernetes   ClusterIP   10.233.0.1      <none>        443/TCP          11h

If I visit < worker node ip >:31794 nothing comes up. I checked ports on worker node, I even manually opened 30000-32767 on the worker node just in case (by running: sudo iptables -A INPUT -p tcp --dport 30000:32767). Run a sudo netstat -tulpn | grep LISTEN to verify nodeport 31794 is open:

tcp6       0      0 :::10256                :::*                    LISTEN      9580/kube-proxy     
tcp6       0      0 :::80                   :::*                    LISTEN      1200/apache2        
tcp6       0      0 :::31794                :::*                    LISTEN      9580/kube-proxy     
tcp6       0      0 :::22                   :::*                    LISTEN      1428/sshd

So clearly 31794 is open on the worker node. Why then can I not access jenkins in the browser? Everything seems in order.

1 Answer 1

0

In the Service spec, you have to mention type: LoadBalancer to allow access from browser. When you do this, you will see an external ip coming up in kubectl get svc output.

Do note that, using type: LoadBalancer will expose your app to the internet. To restrict that, you may want to add a list of allowable IPs using the parameter - loadBalancerSourceRanges. Your final Service definition should be something like below

apiVersion: v1
kind: Service
metadata:
  name: jenkins
spec:
  type: NodePort
  ports:
    - port: 8080
      targetPort: 8080
  selector:
    app: jenkins
  type: LoadBalancer
  # Restrict access to this LoadBalancer to the below ips
  loadBalancerSourceRanges:
  - 100.100.100.100/32
  - 1.1.1.2/32
5
  • But type: NodePort in my .yaml should be enough to expose my deployment. A nodeport exposes the deployment to the internet on a specific port in the range 30000-32767.
    – Alias
    Aug 19, 2019 at 11:15
  • You are right. Even though my answer should solve the problem, it doesn't answer the question. I found this - stackoverflow.com/q/43789155/3007402. Please check if that works, you need to add the nodePort parameter. I will delete my answer post that.
    – Shiva
    Aug 19, 2019 at 11:46
  • I redeployed it with a loadbalancer type. The load balancer's ip is always in pending, so I believe external networking on my cluster is dead. This shouldn't be since I entered the default network in my terraform script.
    – Alias
    Aug 19, 2019 at 14:52
  • Does your account has permissions to create a new static ip? LoadBalancer creates a new static IP which is chargeable.
    – Shiva
    Aug 19, 2019 at 16:12
  • Hi Shiva, I resolved the issue, see my post here: serverfault.com/questions/979806/…
    – Alias
    Aug 19, 2019 at 20:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.