Ingress-Nginx Controller频繁因配置变更触发重载问题求助

云原生阿岚

2026-6-13

环境信息

系统信息

Ubuntu-24.04-noble-amd64

K8s版本

Client Version: v1.31.2
Kustomize Version: v5.4.2
Server Version: v1.31.7

Ingress-Nginx信息

使用镜像 registry.k8s.io/ingress-nginx/controller:v1.12.0 安装
版本：1.12.0

问题描述

Ingress-nginx-controller持续触发重载，提示："NGINX reload triggered due to a change in configuration"

当前Deployment配置如下：

apiVersion: apps/v1
kind: Deployment
metadata:
  name: ingress-nginx-controller
  namespace: ingress-nginx
  uid: 7af65198-0f4a-4b53-9d48-b2c6f37ccddb
  resourceVersion: '195468'
  generation: 33
  creationTimestamp: '2025-03-19T10:12:31Z'
  labels:
    app.kubernetes.io/component: controller
    app.kubernetes.io/instance: ingress-nginx
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/part-of: ingress-nginx
    app.kubernetes.io/version: 1.12.0
    k8slens-edit-resource-version: v1
  annotations:
    deployment.kubernetes.io/revision: '33'
    kubectl.kubernetes.io/last-applied-configuration: >
      {"apiVersion":"apps/v1","kind":"Deployment","metadata":{"annotations":{},"labels":{"app.kubernetes.io/component":"controller","app.kubernetes.io/instance":"ingress-nginx","app.kubernetes.io/name":"ingress-nginx","app.kubernetes.io/part-of":"ingress-nginx","app.kubernetes.io/version":"1.12.0"},"name":"ingress-nginx-controller","namespace":"ingress-nginx"},"spec":{"minReadySeconds":0,"revisionHistoryLimit":10,"selector":{"matchLabels":{"app.kubernetes.io/component":"controller","app.kubernetes.io/instance":"ingress-nginx","app.kubernetes.io/name":"ingress-nginx"}},"strategy":{"rollingUpdate":{"maxUnavailable":1},"type":"RollingUpdate"},"template":{"metadata":{"labels":{"app.kubernetes.io/component":"controller","app.kubernetes.io/instance":"ingress-nginx","app.kubernetes.io/name":"ingress-nginx","app.kubernetes.io/part-of":"ingress-nginx","app.kubernetes.io/version":"1.12.0"}},"spec":{"containers":[{"args":["/nginx-ingress-controller","--publish-service=$(POD_NAMESPACE)/ingress-nginx-controller","--election-id=ingress-nginx-leader","--controller-class=k8s.io/ingress-nginx","--ingress-class=nginx","--configmap=$(POD_NAMESPACE)/ingress-nginx-controller","--validating-webhook=:8443","--validating-webhook-certificate=/usr/local/certificates/cert","--validating-webhook-key=/usr/local/certificates/key"],"env":[{"name":"POD_NAME","valueFrom":{"fieldRef":{"fieldPath":"metadata.name"}}},{"name":"POD_NAMESPACE","valueFrom":{"fieldRef":{"fieldPath":"metadata.namespace"}}},{"name":"LD_PRELOAD","value":"/usr/local/lib/libmimalloc.so"}],"image":"registry.k8s.io/ingress-nginx/controller:v1.12.0@sha256:e6b8de175acda6ca913891f0f727bca4527e797d52688cbe9fec9040d6f6b6fa","imagePullPolicy":"IfNotPresent","lifecycle":{"preStop":{"exec":{"command":["/wait-shutdown"]}}},"livenessProbe":{"failureThreshold":5,"httpGet":{"path":"/healthz","port":10254,"scheme":"HTTP"},"initialDelaySeconds":10,"periodSeconds":10,"successThreshold":1,"timeoutSeconds":1},"name":"controller","ports":[{"containerPort":80,"name":"http","protocol":"TCP"},{"containerPort":443,"name":"https","protocol":"TCP"},{"containerPort":8443,"name":"webhook","protocol":"TCP"}],"readinessProbe":{"failureThreshold":3,"httpGet":{"path":"/healthz","port":10254,"scheme":"HTTP"},"initialDelaySeconds":10,"periodSeconds":10,"successThreshold":1,"timeoutSeconds":1},"resources":{"requests":{"cpu":"100m","memory":"90Mi"}},"securityContext":{"allowPrivilegeEscalation":false,"capabilities":{"add":["NET_BIND_SERVICE"],"drop":["ALL"]},"readOnlyRootFilesystem":false,"runAsGroup":82,"runAsNonRoot":true,"runAsUser":101,"seccompProfile":{"type":"RuntimeDefault"}},"volumeMounts":[{"mountPath":"/usr/local/certificates/","name":"webhook-cert","readOnly":true}]}],"dnsPolicy":"ClusterFirst","nodeSelector":{"kubernetes.io/os":"linux"},"serviceAccountName":"ingress-nginx","terminationGracePeriodSeconds":300,"volumes":[{"name":"webhook-cert","secret":{"secretName":"ingress-nginx-admission"}}]}}}}
  selfLink: /apis/apps/v1/namespaces/ingress-nginx/deployments/ingress-nginx-controller
status:
  observedGeneration: 33
  replicas: 1
  updatedReplicas: 1
  unavailableReplicas: 1
  conditions:
    - type: Available
      status: 'True'
      lastUpdateTime: '2025-03-19T10:12:31Z'
      lastTransitionTime: '2025-03-19T10:12:31Z'
      reason: MinimumReplicasAvailable
      message: Deployment has minimum availability.
    - type: Progressing
      status: 'True'
      lastUpdateTime: '2025-03-20T10:46:08Z'
      lastTransitionTime: '2025-03-19T10:12:31Z'
      reason: NewReplicaSetAvailable
      message: >-
        ReplicaSet "ingress-nginx-controller-8584ffb585" has successfully
        progressed.
spec:
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/component: controller
      app.kubernetes.io/instance: ingress-nginx
      app.kubernetes.io/name: ingress-nginx
  template:
    metadata:
      creationTimestamp: null
      labels:
        app.kubernetes.io/component: controller
        app.kubernetes.io/instance: ingress-nginx
        app.kubernetes.io/name: ingress-nginx
        app.kubernetes.io/part-of: ingress-nginx
        app.kubernetes.io/version: 1.12.0
      annotations:
        kubectl.kubernetes.io/restartedAt: '2025-03-20T10:46:06Z'
    spec:
      volumes:
        - name: webhook-cert
          secret:
            secretName: ingress-nginx-admission
            defaultMode: 420
      containers:
        - name: controller
          image: >-
            registry.k8s.io/ingress-nginx/controller:v1.12.0@sha256:e6b8de175acda6ca913891f0f727bca4527e797d52688cbe9fec9040d6f6b6fa
          args:
            - /nginx-ingress-controller
            - '--publish-service=$(POD_NAMESPACE)/ingress-nginx-controller'
            - '--election-id=ingress-nginx-leader'
            - '--controller-class=k8s.io/ingress-nginx'
            - '--ingress-class=nginx'
            - '--configmap=$(POD_NAMESPACE)/ingress-nginx-controller'
            - '--validating-webhook=:8443'
            - '--validating-webhook-certificate=/usr/local/certificates/cert'
            - '--validating-webhook-key=/usr/local/certificates/key'
          ports:
            - name: http
              containerPort: 80
              protocol: TCP
            - name: https
              containerPort: 443
              protocol: TCP
            - name: webhook
              containerPort: 8443
              protocol: TCP
          env:
            - name: POD_NAME
              valueFrom:
                fieldRef:
                  apiVersion: v1
                  fieldPath: metadata.name
            - name: POD_NAMESPACE
              valueFrom:
                fieldRef:
                  apiVersion: v1
                  fieldPath: metadata.namespace
            - name: LD_PRELOAD
              value: /usr/local/lib/libmimalloc.so
          resources:
            requests:
              cpu: 500m
              memory: 450Mi
          lifecycle:
            preStop:
              exec:
                command:
                  - /wait-shutdown
          terminationMessagePath: /dev/termination-log
          terminationMessagePolicy: File
          imagePullPolicy: IfNotPresent
          securityContext:
            capabilities:
              add:
                - NET_BIND_SERVICE
              drop:
                - ALL
            runAsUser: 101
            runAsGroup: 82
            runAsNonRoot: true
            readOnlyRootFilesystem: false
            allowPrivilegeEscalation: false
            seccompProfile:
              type: RuntimeDefault
      restartPolicy: Always
      terminationGracePeriodSeconds: 300
      dnsPolicy: ClusterFirst
      nodeSelector:
        kubernetes.io/os: linux
      serviceAccountName: ingress-nginx
      serviceAccount: ingress-nginx
      securityContext: {}
      schedulerName: default-scheduler
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxUnavailable: 1
      maxSurge: 25%
  revisionHistoryLimit: 10
  progressDeadlineSeconds: 600

已尝试的操作

修改SSL密钥存储路径
重启自动证书服务
重启Deployment
调整CPU/内存资源分配

需求

不希望使用Helm安装，解决Ingress-Nginx控制器频繁重载问题。

排查与解决步骤

查看控制器详细日志
执行命令获取控制器Pod的完整日志，定位具体触发重载的配置变更点：
```
kubectl logs -n ingress-nginx deployment/ingress-nginx-controller -f
```
重点关注日志中"NGINX reload triggered due to a change in configuration"前后的内容，通常会列出具体变更的资源（如Ingress、Secret、ConfigMap）。

检查动态变更的资源

Ingress资源：检查所有Ingress对象是否存在频繁更新（如注解、规则、TLS配置变动），执行命令查看Ingress的更新历史：

kubectl get ingress -A -o custom-columns=NAMESPACE:.metadata.namespace,NAME:.metadata.name,LAST_UPDATED:.metadata.annotations.kubectl.kubernetes.io/last-applied-configuration

Secret资源：如果使用了自动证书服务（如Cert-Manager），检查对应TLS Secret是否频繁轮换或更新：

kubectl get secrets -A -o custom-columns=NAMESPACE:.metadata.namespace,NAME:.metadata.name,TYPE:.type,LAST_UPDATED:.metadata.creationTimestamp

ConfigMap资源：检查Ingress-Nginx使用的ConfigMap是否有频繁修改：
```
kubectl get configmap ingress-nginx-controller -n ingress-nginx -o yaml
```

检查Webhook证书Secret
部署中挂载的ingress-nginx-admission Secret如果存在自动轮换机制，可能会触发控制器重载。可以临时移除Webhook相关参数测试：
修改Deployment的控制器args，去掉--validating-webhook=:8443、--validating-webhook-certificate、--validating-webhook-key这三个参数，重启控制器后观察是否还会频繁重载。
禁用不必要的配置同步
如果控制器监控了过多不必要的资源，可以通过调整启动参数限制监控范围：
- 添加--watch-ingress-without-class=true仅监控指定Ingress类的资源（如果你的Ingress都指定了ingressClassName: nginx）
- 检查是否有其他自定义控制器或Operator在频繁修改Ingress相关资源。
检查控制器版本兼容性
当前使用的Ingress-Nginx v1.12.0与K8s v1.31.x存在版本兼容问题，建议升级Ingress-Nginx到v1.14.x或更高版本（适配K8s 1.31的版本），手动更新Deployment的镜像地址即可：
```
image: registry.k8s.io/ingress-nginx/controller:v1.14.0@sha256:xxxxxx
```

内容的提问来源于stack exchange，提问作者Mr. Munsch

Ingress-Nginx Controller频繁因配置变更触发重载问题求助

系统信息 #

K8s版本 #

Ingress-Nginx信息 #

已尝试的操作 #

需求 #

系统信息

K8s版本

Ingress-Nginx信息

已尝试的操作

需求