I-kubectl ayikwazi ukuxazulula i-API yeklasta yangasese nge-OpenVPN

I-kubectl iyahluleka ekufuneni igama ngesikhathi ithuneli isebenza futhi ikheli langasese le-API lisaphendula i-ping. Indlela ilungile; iklayenti libuza isixazululi esingakaze sizwe ngendawo yangasese yeklasta. Izilungiso ezimbili zisetshenziswa kakhulu: ukuthumela isixazululi senethiwekhi ebonakalayo kuwo wonke iklayenti le-VPN, noma ukubophela igama endaweni ngokufaka i-entry ye-hosts noma isidluliseli esinemibandela. Zixazulula uphawu olufanayo ngobunikazi obuhlukile, futhi ukuzihlanganisa yikho okwenza amaqembu agcine ehlela amafayela e-hosts njalo lapho iphoyinti lokugcina lakhiwa kabusha.

Ukuxazulula nokufinyeleleka kuyahluleka ezingxenyeni ezihlukene

Yenza ukufuna ngokwakho ngaphambi kokushintsha noma yini. I-getent hosts ku-Linux noma i-nslookup ku-Windows ikutshela ukuthi iklayenti liyathola impendulo yini; isikhathi sokuphela noma i-NXDOMAIN kukhombisa isixazululi, kanti impendulo enekheli elingalungile ikhombisa irekhodi elidala noma indlela yomphakathi.

Ngemva kwalokho qinisekisa ukuthi i-kubectl ixhumana nasiphi iseva. Ingqikithi ye-kubeconfig igcina i-URL, futhi indlela ye-VPN ayiyibhali kabusha: uma ingqikithi isho iphoyinti lokugcina lomphakathi, i-DNS ingaba phelele futhi umyalo uhluleke.

getent hosts api.internal.example
kubectl config view --minify -o jsonpath='{.clusters[0].cluster.server}'
kubectl -v=8 get nodes 2>&1 | head -40

Isignali yesithathu ukuma kokuhluleka ngemva kokufuna. Igama elixazulula ekhelini langasese bese libhekana nokuphela kwesikhathi kwe-TCP kuyinkinga yocingo lomlilo noma inethiwekhi egunyaziwe. Igama elixazulula ekhelini lomphakathi lisho ukuthi umbuzo uphume endaweni yangasese. Hlukanisa le miphumela emithathu; ngayinye ikuholela kumnikazi ohlukile.

Inketho A: thumela isixazululi senethiwekhi ebonakalayo ethunelini

Uma iseva ye-VPN isebenza ngaphakathi kwenethiwekhi ebonakalayo, amaklayenti angasebenzisa isixazululi esifanayo nesiseva. Ku-OpenVPN Community iseva ithumela inketho ye-DNS; i-Access Server ikhombisa isilungiselelo esifanayo kusixhumi sokuphatha, futhi amaklayenti kufanele alande iphrofayela futhi ngoba umyalelo we-DNS uhamba ngaphakathi kwayo.

# server.conf
push "dhcp-option DNS 10.0.0.4"
push "route 10.0.0.4 255.255.255.255"

Umugqa wendlela ubalulekile kumaphrofayela e-split tunnel. Ukuthumela ikheli lesixazululi akufani nokwenza lifinyeleleke: uma kuphela isethi engaphansi yeklasta ehamba ngethuneli, umbuzo oya ku-10.0.0.4 uphuma nge-LAN yasendaweni futhi uyafa. Thumela indlela yesibambi sesixazululi, noma ufake isethi yawo engaphansi ethunelini.

Uhlangothi olwamukelayo lunomgomo futhi. Isixazululi esifinyeleleka kububanzi bamakheli eklayenti singakwazi ukwenqaba imibuzo evela kuso, futhi indawo yangasese exhunywe kunethiwekhi ebonakalayo iphendula kuphela amaklayenti afika ngendlela ye-DNS yaleyo nethiwekhi. Uma ukufuna kuphelelwa isikhathi ngemva kokuthumela, hlola amalogi esixazululi ngokwaso ngaphambi kokuthinta iklayenti futhi.

Kuklayenti, qinisekisa ukuthi kwasetshenziswa ini: i-resolvectl status ku-Linux ye-systemd-resolved, i-scutil --dns ku-macOS, i-ipconfig /all ku-Windows. Iseva ye-DNS ethunyelwe engaveli neze isho ukuthi iphrofayela ayilayishwanga kabusha.

Inketho B: ama-entry e-hosts nokudlulisela okunemibandela

I-entry ye-hosts iyisilungiso esincane kunakho konke futhi esintekenteke kakhulu. Ihlanganisa igama elilodwa nekheli elilodwa kumshini owodwa, ngakho iyasebenza kumbukiso futhi iyaphuka lapho iphoyinti lokugcina langasese noma i-IP yalo lakhiwa kabusha. Iphinde ifihle igebe langempela kwelinye iqembu.

Isidluliseli esinemibandela sikhula kangcono ngaphandle kokuthumela i-DNS kukho konke iklayenti. I-dnsmasq ingathumela indawo eyodwa kusixazululi se-VNet bese ishiya konke okunye: i-server=/cluster.internal/10.0.0.4. I-DNS ye-Windows inezidluliseli ezinemibandela, futhi amaklayenti e-Windows angasebenzisa umthetho we-NRPT ekwahlukaniseni okufanayo. Isidluliseli sisadinga indlela eya kusixazululi se-VNet.

Ukudlulisela kugcina ukuphequlula okujwayelekile kusendaweni, okubalulekile ku-split tunnel. Kukupha futhi indawo eyodwa yokuloga imibuzo yendawo yangasese, nendawo eyodwa ephukayo lapho isibambi sesidluliseli sithutha.

Khetha ngobunikazi, hhayi ngokulula

Thumela isixazululi uma ulawula iphrofayela ye-VPN futhi ufuna lonke igama langasese lisebenze, hhayi i-API kuphela. Khetha isidluliseli uma amaklayenti kufanele agcine i-DNS yasendaweni kukho konke okunye, noma uma i-VPN ilawulwa iqembu elihlukile kuneklasta.

Ama-entry e-hosts awukuhlola, hhayi ukusetshenziswa. Sebenzisa elilodwa ukufakazela ukuthi i-API iyafinyeleleka, bese ulisusa futhi ulungisa indlela yesixazululi; ukulishiya endaweni kuphendula umbuzo wendlela ube ukuzingela ingcebo ngemuva kwesikhathi. Noma iyiphi inketho oyikhethayo, bhala phansi indawo, ikheli lesixazululi kanye nendlela ethwala umbuzo.

Hlola iphoyinti lokugcina le-API, hhayi igama kuphela

Uma ukufuna kuphumelela, thola iphoyinti lokugcina lenguqulo ye-API nge-CA yeklasta. I-curl --cacert ca.crt https://api.internal.example:6443/version ihlukanisa ukuhluleka kwe-TLS nokugunyaza kwi-DNS. I-403 isho ukuthi igama nokuxhumana kuyasebenza futhi ubunikazi abusebenzi.

Hlola futhi ukuthi ububanzi bamakheli eklayenti buvunyelwe yinethiwekhi egunyaziwe noma ucingo lomlilo lweklasta. Amaklasta angasese avame ukwamukela uhambo lwe-API kuphela oluvela ku-VNet noma kububanzi obuhlanganisiwe, ngakho ithuneli elabela amakheli avela kwelinye ichibi lixhuma engxenyeni yenethiwekhi futhi lilahleke ku-API.

Bhala amaqiniso amane uma ukhuphula izinga: isixazululi esasetshenziswa yiklayenti, ikheli elibuyisile, i-URL yeseva engqikithini ye-kubeconfig ekhethiwe, nomsebenzi wokuqala ohlulekile. Lelo rekhodi litshela unjiniyela olandelayo ukuthi kufanele ashintshe i-DNS, indlela noma umgomo wocingo lomlilo, futhi livimbela ukuhlelwa okulandelayo kwefayela le-hosts.

Qala ngokufuna, khetha indlela yesixazululi ehambisana nomnikazi wendawo, bese uqinisekisa iphoyinti lokugcina. Uma zontathu zidlula, inkinga esele ukugunyaza, hhayi ukuxazulula amagama.