Change:
Trying to hit the read-write kubernetes service from inside a cluster does not work. tailing the kube-proxy logs shows: And sure enough, kube-apiserver is not listening on the NIC on that port. 8080 is only for the localhost HTTP communications between master components (and nginx redirect after HTTPS termination). The "kubernetes" master service needs to get created with Port set to 443.
+1
This needs to be port 6443 the auth_port On Feb 6, 2015 10:14 AM, "Paulo Pires" wrote:
The code says 8443, but then a flag changes to 6443. Will fix. , Eric Tune wrote:
Holy macaroni this is a mess. , Tim Hockin wrote:

Discussion:
// Defaults to 7080 if not set. ReadOnlyPort int // The port on PublicAddress where a read-write server will be installed. <del> // Defaults to 443 if not set. </del> <ins> // Defaults to 6443 if not set. </ins> ReadWritePort int // If nil, the first result from net.InterfaceAddrs will be used.

if c.ReadOnlyPort == 0 { c.ReadOnlyPort = 7080 } <ins> if c.ReadWritePort == 0 { c.ReadWritePort = 6443 } </ins> if c.CacheTimeout == 0 { c.CacheTimeout = 5 * time.Second } <del> if c.ReadWritePort == 0 { c.ReadWritePort = 443 } </del> for c.PublicAddress == nil { // Find and use the first non-loopback address. // TODO: potentially it'd be useful to skip the docker interface if it

func (m *Master) InstallSwaggerAPI() { // Enable swagger UI and discovery API swaggerConfig := swagger.Config{ <del> WebServicesUrl: net.JoinHostPort(m.publicIP.String(), strconv.Itoa(int(m.publicReadWritePort))), </del> <ins> WebServicesUrl: net.JoinHostPort(m.publicIP.String(), strconv.Itoa(m.publicReadWritePort)), </ins> WebServices:    m.handlerContainer.RegisteredWebServices(), // TODO: Parameterize the path? ApiPath:         "/swaggerapi/",

// APIServer runs a kubernetes api server. type APIServer struct { <del> Port                       int </del> <ins> WideOpenPort               int </ins> Address                    util.IP PublicAddressOverride      util.IP ReadOnlyPort               int

// NewAPIServer creates a new APIServer object with default parameters func NewAPIServer() *APIServer { s := APIServer{ <del> Port:                   8080, </del> <ins> WideOpenPort:           8080, </ins> Address:                util.IP(net.ParseIP("127.0.0.1")), PublicAddressOverride:  util.IP(net.ParseIP("")), ReadOnlyPort:           7080, APIRate:                10.0, APIBurst:               200, <del> SecurePort:             8443, </del> <ins> SecurePort:             6443, </ins> APIPrefix:              "/api", EventTTL:               48 * time.Hour, AuthorizationMode:      "AlwaysAllow",

func (s *APIServer) AddFlags(fs *pflag.FlagSet) { // Note: the weird ""+ in below lines seems to be the only way to get gofmt to // arrange these text blocks sensibly. Grrr. <del> fs.IntVar(&s.Port, "port", s.Port, ""+ </del> <ins> fs.IntVar(&s.WideOpenPort, "port", s.WideOpenPort, ""+ </ins> "The port to listen on. Default 8080. It is assumed that firewall rules are "+ "set up such that this port is not reachable from outside of the cluster. It is "+ "further assumed that port 443 on the cluster's public address is proxied to this "+

// TODO: expose same flags as client.BindClientConfigFlags but for a server clientConfig := &client.Config{ <del> Host:    net.JoinHostPort(s.Address.String(), strconv.Itoa(int(s.Port))), </del> <ins> Host:    net.JoinHostPort(s.Address.String(), strconv.Itoa(s.WideOpenPort)), </ins> Version: s.StorageVersion, } client, err := client.New(clientConfig)

APIPrefix:              s.APIPrefix, CorsAllowedOriginList:  s.CorsAllowedOriginList, ReadOnlyPort:           s.ReadOnlyPort, <del> ReadWritePort:          s.Port, </del> <ins> ReadWritePort:          s.SecurePort, </ins> PublicAddress:          net.IP(s.PublicAddressOverride), Authenticator:          authenticator, Authorizer:             authorizer,

} m := master.New(config) <del> // We serve on 3 ports.  See docs/reaching_the_api.md </del> <ins> // We serve on 3 ports.  See docs/accessing_the_api.md </ins> roLocation := "" if s.ReadOnlyPort != 0 { <del> roLocation = net.JoinHostPort(config.PublicAddress.String(), strconv.Itoa(config.ReadOnlyPort)) </del> <ins> roLocation = net.JoinHostPort(config.PublicAddress.String(), strconv.Itoa(s.ReadOnlyPort)) </ins> } secureLocation := "" if s.SecurePort != 0 { secureLocation = net.JoinHostPort(config.PublicAddress.String(), strconv.Itoa(s.SecurePort)) } <del> rwLocation := net.JoinHostPort(s.Address.String(), strconv.Itoa(int(s.Port))) </del> <ins> wideOpenLocation := net.JoinHostPort(s.Address.String(), strconv.Itoa(s.WideOpenPort)) </ins> // See the flag commentary to understand our assumptions when opening the read-only and read-write ports.

} http := &http.Server{ <del> Addr:           rwLocation, </del> <ins> Addr:           wideOpenLocation, </ins> Handler:        apiserver.RecoverPanics(m.InsecureHandler), ReadTimeout:    5 * time.Minute, WriteTimeout:   5 * time.Minute, MaxHeaderBytes: 1 << 20, } <del> glog.Infof("Serving insecurely on %s", rwLocation) </del> <ins> glog.Infof("Serving insecurely on %s", wideOpenLocation) </ins> glog.Fatal(http.ListenAndServe()) return nil }