现象，SSH登陆出现Permission denied (publickey)
[oracle@k8scloud ~]$ ssh oracle@xxx.xxx.xxx.xxxThe authenticity of host 'xxx.xxx.xxx.xxx (xxx.xxx.xxx.xxx)' can't be established.ECDSA key fingerprint is SHA256:aXDVFpERDzF1a00CAoBK5/CpFTcv4sI5Gp9vU+zewLU.ECDSA key fingerprint is MD5:00:a1:b8:24:bb:bd:ca:50:30:d0:fa:f6:4e:d7:20:c2.Are you sure you want to continue connecting (yes/no)? yesWarning: Permanently added 'xxx.xxx.xxx.xxx' (ECDSA) to the list of known hosts.Permission denied (publickey).
确认sshd的进程
发现进程里多了"/usr/sbin/sshd -D -E /var/log/gitlab/supervisor/sshd.log"。
[oracle@k8scloud ~]$ ps -ef|grep sshroot10281 0 09:20 ? 00:00:00 /usr/sbin/sshd -Droot1124 1028 0 09:20 ? 00:00:00 sshd: oracle [priv]oracle 1192 1124 0 09:20 ? 00:00:00 sshd: oracle@pts/0root1345 1028 0 09:20 ? 00:00:00 sshd: root@pts/1root12856 10579 0 09:21 ? 00:00:00 /usr/sbin/sshd -D -E /var/log/gitlab/supervisor/sshd.logoracle 26769 1198 0 09:34 pts/0 00:00:00 grep --color=auto ssh
分析原因
主机上运行的kubernetes集群，集群中安装了gitlab，gitlab服务使用TYPE为LoadBalancer，LoadBalancer的EXTERNAL-IP为本机IP（使用Metallb时设置IP取值方范围只用本机IP），并且在PORT(S)里使用了22端口，所以和主机发生了冲突。
[oracle@k8scloud ~]$ kubectl get svc -n public-serviceNAME TYPE CLUSTER-IP EXTERNAL-IPPORT(S) AGEgitlab-balancer LoadBalancer 10.96.94.71172.16.100.136 80:32545/TCP,22:30022/TCP 2d18h
解决方法
将gitlab服务使用的PORT(S)从22端口改为其他端口，比如2222。
kubectl edit svc gitlab-balancer -n public-service
确认修改结果
[oracle@k8scloud ~]$ kubectl get svc -n public-serviceNAME TYPE CLUSTER-IP EXTERNAL-IPPORT(S) AGEgitlab-balancer LoadBalancer 10.96.94.71172.16.100.136 80:32545/TCP,2222:30022/TCP 2d18h
再次尝试ssh链接，ok
[oracle@k8scloud ~]$ ssh oracle@xxx.xxx.xxx.xxxLast login: Sat Jan 9 09:44:44 from xxx.xxx.xxx.xxxWelcome to Alibaba Cloud Elastic Compute Service !
完结！
