apiserver | 基于 Go 实现的 API server | REST library

"Access-Control-Allow-Origin" Header is present in response but its value is: null and thus requests from any host appear to be being accepted.

That is not how it works. The header Access-Control-Allow-Origin should either contain the origin for the specific client making the request, or the wildcard *, in order to be accepted by the browser. If the origin header does not satisfy the origins you allowed, the response header will be an empty string as you can see in the source code.

Because Pods are how you run daemon processes (or really, all processes) inside Kubernetes. That's just how you run stuff. I suppose there is nothing stopping you from running it outside the cluster, manually setting up API configuration and authentication, doing all the needed networking bits yourself. But ... why?

As for replicas, you should indeed generally have more than one across multiple physical nodes for redundancy. A lot of the tutorials show it with replicas: 1 because either it's for a single-node dev cluster like Minikube or it's only an example.

The issue was with the metrics server.

Metrics server was configured to use kubelet-preferred-address-types=InternalIP but worker node didn't have any InternalIP listed:

Posting this as community wiki, please feel free and provide more details and findings about this topic.

The only one place where we can find information about comma separated list of ports and port ranges is minikube documentation:

Increasing the NodePort range

By default, minikube only exposes ports 30000-32767. If this does not work for >you, you can adjust the range by using:

minikube start --extra-config=apiserver.service-node-port-range=1-65535

This flag also accepts a comma separated list of ports and port ranges.

On the other hand from the k8s documentation:

--service-node-port-range Default: 30000-32767

Error you included states that you are misising bridge-nf-call-iptables.
bridge-nf-call-iptables is exported by br_netfilter.
What you need to do is issue the command

Flannel does not support NFT, and since you are using CentOS 8, you can't fallback to iptables.
Your best bet in this situation would be to switch to Calico.
You have to update Calico DaemonSet with:

It looks like you could use spec.api.extraArgs to pass the service-node-port-range parameter to api-server.

Spec api:

extraArgs: Map of key-values (strings) for any extra arguments you wish to pass down to Kubernetes api-server process

Example:

I am not familiar with the Azure Logic Apps designer, but the problem with the XPath expression is the namespace of the DoLoginResponse node. There are a few ways to deal with this, but if you really just want to ignore the namespace you can use an expression like:

The call to Plug.Builder.plug/2 (plug APIKeyAuthPlug, ...) in the router results in the call to init/1 during compilation time unless mode is explicitly set to :runtime instead of default :compile https://github.com/elixir-plug/plug/blob/v1.11.1/lib/plug/builder.ex#L275

Setting init_mode: :runtime would resolve the issue.