Docker/K8：OpenSSL SSL_connect：SSL_ERROR_SYSCALL

Question

运行端点上的 k8 cronjob。测试在本地就像一个魅力，甚至当我 sleep infinity 在我的入口点结束时，然后在容器内卷曲。但是，一旦 cron 启动，我就会收到一些奇怪的错误：

[ec2-user@ip-10-122-8-121 device-purge]$ kubectl logs appgate-device-cron-job-1618411080-29lgt -n device-purge
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
curl: (35) OpenSSL SSL_connect: SSL_ERROR_SYSCALL in connection to 52.61.245.214:444

docker-entrypoint.sh

#! /bin/sh
export api_vs_hd=$API_VS_HD
export controller_ip=$CONTROLLER_IP
export password=$PASSWORD
export uuid=$UUID
export token=$TOKEN

# should be logged in after token export
# Test API call: list users
curl -k -H "Content-Type: application/json" \
     -H "$api_vs_hd" \
     -H "Authorization: Bearer $token" \
     -X GET \
     https://$controller_ip:444/admin/license/users

# test
# sleep infinity

Docker 文件

FROM harbor/privateop9/python38:latest

# Use root user for packages installation
USER root

# Install packages
RUN yum update -y && yum upgrade -y

# Install curl
RUN yum install curl -y \
    && curl --version

# Install zip/unzip/gunzip
RUN yum install zip unzip -y \
    && yum install gzip -y

# Install wget 
RUN yum install wget -y

# Install jq
RUN wget -O jq https://github.com/stedolan/jq/releases/download/jq-1.6/jq-linux64
RUN chmod +x ./jq
RUN cp jq /usr/bin

# Install aws cli
RUN curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip"
RUN unzip awscliv2.zip
RUN ./aws/install

## set working directory
WORKDIR /home/app

# Add user
RUN groupadd --system user && adduser --system user --no-create-home --gid user
RUN chown -R user:user /home/app && chmod -R 777 /home/app

# Make sure that your shell script file is in the same folder as your dockerfile while running the docker build command as the below command will copy the file to the /home/root/ folder for execution
# COPY . /home/root/
COPY ./docker-entrypoint.sh /home/app
RUN chmod +x docker-entrypoint.sh

# Switch to non-root user
USER user

# Run service
ENTRYPOINT ["/home/app/docker-entrypoint.sh"]

Cronjob.yaml

apiVersion: batch/v1beta1
kind: CronJob
metadata:
  name: device-cron-job
  namespace: device-purge
spec:
#Cron Time is set according to server time, ensure server time zone and set accordingly.
  schedule: "*/2 * * * *" # test
  jobTemplate:
    spec:
      template:
        spec:
          imagePullSecrets:
          - name: appgate-cron
          containers:
          - name: device-cron-pod
            image: harbor/privateop9/python38:device-purge
            env:
            - name: API_VS_HD
              value: "Accept:application/vnd.appgate.peer-v13+json"
            - name: CONTROLLER_IP
              value: "value"
            - name: UUID
              value: "value"
            - name: TOKEN
              value: >-
                curl -H "Content-Type: application/json" -H "${api_vs_hd}" --request POST
                --data "{\"providerName\":\"local\",\"username\":\"admin\",\"password\":\"$password\",\"deviceId\":\"$uuid\"}"
                https://$controller_ip:444/admin/login --insecure | jq -r '.token'
            - name: PASSWORD
              valueFrom:
                secretKeyRef: 
                  name: password
                  key: password

            imagePullPolicy: Always
          restartPolicy: OnFailure
      backoffLimit: 3

请帮忙！我运行没主意....

Answer 1

我的 post 的问题出在服务器本身，因为某些防火墙在 AWS 云帐户上设置了 IP 白名单。在帐户的安全团队解决了该问题后，我能够通过拦截器。

Docker/K8：OpenSSL SSL_connect：SSL_ERROR_SYSCALL

Docker/K8 : OpenSSL SSL_connect: SSL_ERROR_SYSCALL

bash

openssl

docker

kubernetes

kubernetes-cronjob