"kubernetes" service is pointing to the wrong port.

[cjcullen]

Trying to hit the read-write kubernetes service from inside a cluster does not work.

curl -k -v https://10.227.254.60                       
* Rebuilt URL to: https://10.227.254.60/
* Hostname was NOT found in DNS cache
*   Trying 10.227.254.60...
* Connected to 10.227.254.60 (10.227.254.60) port 443 (#0)
* successfully set certificate verify locations:
*   CAfile: none
  CApath: /etc/ssl/certs
* SSLv3, TLS handshake, Client hello (1):
* Unknown SSL protocol error in connection to 10.227.254.60:443 
* Closing connection 0
curl: (35) Unknown SSL protocol error in connection to 10.227.254.60:443 

tailing the kube-proxy logs shows:

I0206 18:06:02.272969   27054 proxier.go:105] Accepted TCP connection from 10.224.0.139:54710 to 10.224.0.1:40763
I0206 18:06:02.273053   27054 proxier.go:74] Mapped service "kubernetes" to endpoint 10.240.104.13:8080
E0206 18:06:02.277557   27054 proxier.go:79] Dial failed: dial tcp 10.240.104.13:8080: connection refused
I0206 18:06:02.277586   27054 proxier.go:74] Mapped service "kubernetes" to endpoint 10.240.104.13:8080
E0206 18:06:02.278676   27054 proxier.go:79] Dial failed: dial tcp 10.240.104.13:8080: connection refused
I0206 18:06:02.278709   27054 proxier.go:74] Mapped service "kubernetes" to endpoint 10.240.104.13:8080
E0206 18:06:02.279570   27054 proxier.go:79] Dial failed: dial tcp 10.240.104.13:8080: connection refused
I0206 18:06:02.279605   27054 proxier.go:74] Mapped service "kubernetes" to endpoint 10.240.104.13:8080
E0206 18:06:02.280366   27054 proxier.go:79] Dial failed: dial tcp 10.240.104.13:8080: connection refused
E0206 18:06:02.280391   27054 proxier.go:108] Failed to connect

And sure enough, kube-apiserver is not listening on the NIC on that port. 8080 is only for the localhost HTTP communications between master components (and nginx redirect after HTTPS termination).

netstat -lnptu
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 10.240.104.13:7080      0.0.0.0:*               LISTEN      14420/kube-apiserve
tcp        0      0 127.0.0.1:10250         0.0.0.0:*               LISTEN      2267/kubelet    
tcp        0      0 10.240.104.13:6443      0.0.0.0:*               LISTEN      14420/kube-apiserve
tcp        0      0 127.0.0.1:10251         0.0.0.0:*               LISTEN      5268/kube-scheduler
tcp        0      0 127.0.0.1:10252         0.0.0.0:*               LISTEN      5170/kube-controlle
tcp        0      0 127.0.0.1:8080          0.0.0.0:*               LISTEN      14420/kube-apiserve
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      2164/sshd       
tcp        0      0 0.0.0.0:4505            0.0.0.0:*               LISTEN      3710/python     
tcp        0      0 0.0.0.0:4506            0.0.0.0:*               LISTEN      3702/python     
tcp        0      0 0.0.0.0:443             0.0.0.0:*               LISTEN      5792/nginx      
tcp6       0      0 :::4001                 :::*                    LISTEN      4937/etcd       
tcp6       0      0 :::4194                 :::*                    LISTEN      2526/docker-proxy
tcp6       0      0 :::22                   :::*                    LISTEN      2164/sshd       
tcp6       0      0 :::7001                 :::*                    LISTEN      4937/etcd       
udp        0      0 0.0.0.0:2001            0.0.0.0:*                           1622/dhclient   
udp        0      0 0.0.0.0:68              0.0.0.0:*                           1622/dhclient   
udp        0      0 172.17.42.1:123         0.0.0.0:*                           20505/ntpd      
udp        0      0 10.240.104.13:123       0.0.0.0:*                           20505/ntpd      
udp        0      0 127.0.0.1:123           0.0.0.0:*                           20505/ntpd      
udp        0      0 0.0.0.0:123             0.0.0.0:*                           20505/ntpd      
udp6       0      0 :::23578                :::*                                1622/dhclient   
udp6       0      0 :::123                  :::*                                20505/ntpd   

The "kubernetes" master service needs to get created with Port set to 443.

[pires]

+1

[erictune]

This needs to be port 6443 the auth_port
On Feb 6, 2015 10:14 AM, "Paulo Pires" notifications@github.com wrote:

+1

—
Reply to this email directly or view it on GitHub
#4216 (comment)
.

[thockin]

The code says 8443, but then a flag changes to 6443. Will fix.

On Fri, Feb 6, 2015 at 11:38 AM, Eric Tune notifications@github.com wrote:

This needs to be port 6443 the auth_port
On Feb 6, 2015 10:14 AM, "Paulo Pires" notifications@github.com wrote:

+1

Reply to this email directly or view it on GitHub
<
#4216 (comment)

.

Reply to this email directly or view it on GitHub
#4216 (comment)
.

[thockin]

Holy macaroni this is a mess.

On Fri, Feb 6, 2015 at 4:17 PM, Tim Hockin thockin@google.com wrote:

The code says 8443, but then a flag changes to 6443. Will fix.

On Fri, Feb 6, 2015 at 11:38 AM, Eric Tune notifications@github.com
wrote:

This needs to be port 6443 the auth_port
On Feb 6, 2015 10:14 AM, "Paulo Pires" notifications@github.com wrote:

+1

Reply to this email directly or view it on GitHub
<
#4216 (comment)

.

Reply to this email directly or view it on GitHub
#4216 (comment)
.