通过 kubectl 从本地 machine (mac) 连接到 GKE

Question

奇怪的是，我无法通过 Kubectl 从本地 (Mac) 连接到 GKE 集群，但是我可以从 Google 云连接 shell？我已经获取了 K8s 证书，我可以看到 kubeconfig 文件，但我仍然超时。有什么建议可能是错的吗？

$ gcloud components install kubectl


Your current Cloud SDK version is: 367.0.0
Installing components from version: 367.0.0

┌─────────────────────────────────────────────┐
│     These components will be installed.     │
├────────────────────────┬─────────┬──────────┤
│          Name          │ Version │   Size   │
├────────────────────────┼─────────┼──────────┤
│ gke-gcloud-auth-plugin │   0.1.1 │  3.4 MiB │
│ kubectl                │  1.20.8 │ 89.0 MiB │
│ kubectl                │  1.20.8 │  < 1 MiB │
└────────────────────────┴─────────┴──────────┘

For the latest full release notes, please visit:
  https://cloud.google.com/sdk/release_notes

Do you want to continue (Y/n)?  Y

╔════════════════════════════════════════════════════════════╗
╠═ Creating update staging area                             ═╣
╠════════════════════════════════════════════════════════════╣
╠═ Installing: gke-gcloud-auth-plugin                       ═╣
╠════════════════════════════════════════════════════════════╣
╠═ Installing: gke-gcloud-auth-plugin                       ═╣
╠════════════════════════════════════════════════════════════╣
╠═ Installing: kubectl                                      ═╣
╠════════════════════════════════════════════════════════════╣
╠═ Installing: kubectl                                      ═╣
╠════════════════════════════════════════════════════════════╣
╠═ Creating backup and activating new installation          ═╣
╚════════════════════════════════════════════════════════════╝

Performing post processing steps...done.

Update done!


$ gcloud auth login
Your browser has been opened to visit:

    https://accounts.google.com/o/oauth2/auth?response_type=code&client_id=xxxxxxxxxxxxxxxxxxx
You are now logged in as [atul@xxxxx.com].
Your current project is [test-dev-k8s].  You can change this setting by running:

$ gcloud container clusters get-credentials test-dev-k8s-cluster --region asia-south1 --project test-dev-k8s
Fetching cluster endpoint and auth data.
kubeconfig entry generated for test-dev-k8s-cluster.

$ kubectl get ns
Unable to connect to the server: dial tcp 34.93.111.251:443: i/o timeout

Answer 1

首先使用 Google Cloud SDK

登录您的 GCP 帐户

gcloud auth login

https://cloud.google.com/sdk/gcloud/reference/auth/login

然后转到 GCP Kubernetes Cluster 页面，Select 您的集群，单击 Connect。复制 连接字符串 并将其粘贴到本地计算机上的 Google Cloud SDK 命令行。然后尝试使用 kubectl 命令。

Answer 2

您可能想尝试一下 kubectl 的完整集群配置访问权限，在这里您可以找到在 kubernetes 集群中配置 kubectl 所需的步骤。

如果这不起作用，这里是集群中相同连接问题的一些其他解决方法。

作为信息，您在部署中使用的是 minikube、docker 还是只使用 GKE？

Answer 3

NOTE You do not need to install kubectl with gcloud; any valid kubectl will do.

您可以确保 kubectl 正在查找配置文件的预期位置，方法是在命令前加上 KUBECONFIG，例如：

KUBECONFIG=/path/to/.kube/config kubectl get nodes

配置文件是否包含 GKE 集群的正确条目？

apiVersion: v1
clusters:
- cluster:
    certificate-authority-data: LS0tLS1C...
    server: https://${IP}
  name: gke_${PROJECT}_${LOCATION}_${NAME}
contexts:
- context:
    cluster: gke_${PROJECT}_${LOCATION}_${NAME}
    user: gke_${PROJECT}_${LOCATION}_${NAME}
  name: gke_${PROJECT}_${LOCATION}_${NAME}
current-context: gke_${PROJECT}_${LOCATION}_${NAME}
kind: Config
preferences: {}
users:
- name: gke_${PROJECT}_${LOCATION}_${NAME}
  user:
    auth-provider:
      config:
        access-token: ya29...
        cmd-args: config config-helper --format=json
        cmd-path: /path/to/gcloud
        expiry: "2021-12-20T00:00:00Z"
        expiry-key: '{.credential.token_expiry}'
        token-key: '{.credential.access_token}'
      name: gcp

其中 gke_${PROJECT}_${LOCATION}_${NAME} 值被适当替换。

是否设置了current-context？

你能从 Mac ping 集群的 IP (${IP}) 吗？

Answer 4

在分析了集群的所有配置后，我发现“控制平面授权网络”已启用实际上是“启用控制平面授权网络以阻止不受信任的非 GCP 源通过 HTTPS 从访问 Kubernetes 到控制平面的 IP。”我的本地 IP 显然是非 GCP IP。
一旦我禁用了它，我就可以从我的本地系统连接了。

通过 kubectl 从本地 machine (mac) 连接到 GKE

Connect to GKE via kubectl from local machine (mac)

macos

google-kubernetes-engine

kubectl