<p>I have a docker deployment using Kubernetes. Out of the blue on a running AWS K8 &quot;pod&quot;, I have started getting the following error:</p>
<pre><code>connect() failed (111: Connection refused) while connecting to upstream, client: X.0.XX.XX, server: _, request: &quot;GET /api/endpoint&amp; HTTP/1.1&quot;, upstream: &quot;fastcgi://127.0.0.1:9000&quot;, host: &quot;domain.com&quot;
</code></pre>
<p>It seems like it has something to do with the nginx configuration with php-fpm rather than the Dockerfile or the deployment. What fixes this error immediately is restarting the Kubernetes pods (whichever pod happens to give this error).</p>
<p>I suspect that if php-fpm happens to fail inside a given pod, that's when it stops listening on port 9000? I ssh'ed into the pod and did a netstat to verify this and it shows 9000 being alive.</p>
<p>For reference, here is the Dockerfile:</p>
<pre><code>FROM trafex/alpine-nginx-php7:1.9.0

USER root

RUN apk add --no-cache file
RUN apk --update add imagemagick
RUN apk --no-cache add php7-redis php7-simplexml php7-iconv php7-imagick
RUN curl -sS https://getcomposer.org/installer | php -- --install-dir=/usr/local/bin --filename=composer

ARG gh_token

ADD nginx-host.conf /etc/nginx/nginx.conf

RUN rm -Rf /var/www/html/
COPY . /var/www/html/

RUN composer config --global github-oauth.github.com ${gh_token}

RUN cd /var/www/html/ \
   &amp;&amp; composer update
   
RUN composer config --global github-oauth.github.com &quot;none&quot;

USER nobody
</code></pre>
<p>And here is the nginx.conf:</p>
<pre><code>worker_processes auto;
error_log stderr warn;
pid /run/nginx.pid;

events {
    worker_connections 1024;
}

http {
    include mime.types;
    default_type application/octet-stream;

    # Define custom log format to include reponse times
    log_format main_timed '$remote_addr - $remote_user [$time_local] &quot;$request&quot; '
                          '$status $body_bytes_sent &quot;$http_referer&quot; '
                          '&quot;$http_user_agent&quot; &quot;$http_x_forwarded_for&quot; '
                          '$request_time $upstream_response_time $pipe $upstream_cache_status';

    access_log /dev/stdout main_timed;
    error_log /dev/stderr notice;

    keepalive_timeout 65;

    # Write temporary files to /tmp so they can be created as a non-privileged user
    client_body_temp_path /tmp/client_temp;
    proxy_temp_path /tmp/proxy_temp_path;
    fastcgi_temp_path /tmp/fastcgi_temp;
    uwsgi_temp_path /tmp/uwsgi_temp;
    scgi_temp_path /tmp/scgi_temp;
    
    underscores_in_headers on;

    map $request_uri $version {
        ~(?&lt;captured_topdir&gt;^/[a-zA-Z0-9]+[/]) $captured_topdir;
    }

    # Default server definition
    server {
        listen [::]:8080 default_server;
        listen 8080 default_server;
        server_name _;

        sendfile off;
    
        client_max_body_size 6M;
    
        root /var/www/html;
        index index.php index.html;

        # Redirect server error pages to the static page /50x.html
        error_page 500 502 503 504 /50x.html;
        location = /50x.html {
            root /var/lib/nginx/html;
        }

        location / {
        rewrite ^/(v[0-9]+|stage|partner)?/(.*)$ /$2 last;
        set $new_uri $uri;
        try_files $uri $uri/ /index.php?$query_string;
    }

        # Pass the PHP scripts to PHP-FPM listening on 127.0.0.1:9000
        location ~ \.php$ {
            try_files $uri =404;
            fastcgi_split_path_info ^(.+\.php)(/.+)$;
            fastcgi_pass 127.0.0.1:9000;
            fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
            fastcgi_param SCRIPT_NAME $fastcgi_script_name;
            fastcgi_param PATH_INFO $fastcgi_path_info;
            fastcgi_param SCRIPT_NAME $fastcgi_script_name;
            fastcgi_param API_VERSION $version;
            fastcgi_index index.php;
            include fastcgi_params;
            fastcgi_param REQUEST_URI $new_uri;
        }

        location ~* \.(jpg|jpeg|gif|png|css|js|ico|xml)$ {
            expires 5d;
        }

        # Deny access to . files, for security
        location ~ /\. {
            log_not_found off;
            deny all;
        }

        # Allow fpm ping and status from localhost
        location ~ ^/(fpm-status|fpm-ping)$ {
            access_log off;
            allow 127.0.0.1;
            deny all;
            fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
            fastcgi_param SCRIPT_NAME $fastcgi_script_name;
            include fastcgi_params;
            fastcgi_pass 127.0.0.1:9000;
        }
    }
    
    gzip on;
    gzip_proxied any;
    gzip_types text/plain application/xml text/css text/js text/xml application/x-javascript text/javascript application/json application/xml+rss;
    gzip_vary on;
    gzip_disable &quot;msie6&quot;;
    
    # Include other server configs
    include /etc/nginx/conf.d/*.conf;
}
</code></pre>
<p>Any idea on the nginx config where this error could be surfacing from? It has happened completely out of the blue a few times now.</p>

<p>Looks like Nginx is getting the connection refuse from the stream.</p>
<p>i would suggest trying with simple Nginx config, store it inside the Kubernetes <code>configmap</code></p>
<pre><code>apiVersion: v1
kind: ConfigMap
metadata:
  name: nginxthroughpass
  namespace: development
data:
  default.conf: |-
    server {
            listen 80 default_server;
            root /var/www/html;
            server_name  _;
            index index.php;
            location / {
                try_files $uri $uri/ /index.php?$args;
            }
            location ~ \.php$ {
                fastcgi_split_path_info ^(.+\.php)(/.+)$;
                fastcgi_pass 127.0.0.1:9000;
                fastcgi_index index.php;
                include fastcgi_params;
                fastcgi_param   PATH_INFO       $fastcgi_path_info;
                fastcgi_param   SCRIPT_FILENAME $document_root$fastcgi_script_name;
            }
        }
</code></pre>
<p>Injecting the Nginx configmap along with the PHP fpm deployment</p>
<pre><code>apiVersion: extensions/v1
kind: Deployment
metadata:
  labels:
    app: wordpress-site
  name: wordpress-site
  namespace: development
spec:
  progressDeadlineSeconds: 600
  replicas: 1
  revisionHistoryLimit: 10
  selector:
    matchLabels:
      app: wordpress-site
      tier: frontend
  strategy:
    rollingUpdate:
      maxSurge: 25%
      maxUnavailable: 25%
    type: RollingUpdate
  template:
    metadata:
      creationTimestamp: null
      labels:
        app: wordpress-site
        tier: frontend
    spec:
      volumes:
      - configMap:
          defaultMode: 256
          name: nginxthroughpass
          optional: false
        name: nginxconf
      - name: shared-files
        emptyDir: {}
      containers:
        - name: app
          image: &lt;REPLACE WITH DOCKER PHP-FPM IMAGE URL&gt;
          imagePullPolicy : IfNotPresent
          volumeMounts:
            - name: shared-files
              mountPath: /var/www/html
          envFrom:
            - configMapRef:
                name: wordpress-configmap
        - name: nginx
          image: nginx
          imagePullPolicy : IfNotPresent
          volumeMounts:
          - name: shared-files
            mountPath: /var/www/html
          - mountPath: /etc/nginx/conf.d
            name: nginxconf
            readOnly: true
</code></pre>
<p>instead of <code>WordPress</code> image replace your <code>php-fpm</code> image and test.</p>
<p>You check this using <strong>Php-fpm WordPress</strong> with the <strong>Nginx</strong> pod and storing the config into the config map.</p>
<p><a href="https://github.com/harsh4870/Kubernetes-wordpress-php-fpm-nginx" rel="nofollow noreferrer">https://github.com/harsh4870/Kubernetes-wordpress-php-fpm-nginx</a></p>
