在Kubernetes（Rancher Desktop）中配置Ingress支持WebSocket连接的问题

问题描述 #

本地使用Rancher Desktop运行Kubernetes集群，将Service设为NodePort时，本地客户端（如KX Platform）可通过WebSocket连接到Node.js服务器；但改用Ingress后，无法建立WebSocket连接。相关配置如下：

ingress-service.yaml #

# Ingress
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: app-ingress
  annotations:
    # nginx.ingress.kubernetes.io/rewrite-target: /
    # nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
    # nginx.ingress.kubernetes.io/secure-backends: "true"
    nginx.ingress.kubernetes.io/proxy-send-timeout: "3600"
    nginx.ingress.kubernetes.io/proxy-read-timeout: "3600"
    # nginx.ingress.kubernetes.io/configuration-snippet: |
    #   proxy_http_version 1.1;
    #   proxy_set_header Upgrade "websocket";
    #   proxy_set_header Connection "Upgrade";
    nginx.org/websocket-services: "server-service"
spec:
  ingressClassName: nginx
  rules:
    - host: example.com
      http:
        paths:
        - path: /ws/
          pathType: Prefix
          backend:
            service:
              name: server-service
              port: 
                number: 5005

server-service.yaml #

# Service exposing pod internally to other pods
apiVersion: v1
kind: Service
metadata:
  name: server-service
spec:
  # type: NodePort
  type: ClusterIP
  selector:
      nodejs-server: server
  ports:
    - protocol: TCP
      port: 5005
      targetPort: 5005
      # nodePort: 30005

集群内部hosts文件 #

# Kubernetes-managed hosts file.
127.0.0.1       localhost
::1     localhost ip6-localhost ip6-loopback
fe00::0 ip6-localnet
fe00::0 ip6-mcastprefix
fe00::1 ip6-allnodes
fe00::2 ip6-allrouters
10.42.0.178     server-deployment-8b9cf4977-mc779

问题排查与解决 #

1. 启用WebSocket核心转发配置 #

NGINX Ingress转发WebSocket请求必须依赖HTTP/1.1协议和Upgrade头传递，你当前注释掉的configuration-snippet是关键配置，取消注释并调整为更灵活的写法：

nginx.ingress.kubernetes.io/configuration-snippet: |
  proxy_http_version 1.1;
  proxy_set_header Upgrade $http_upgrade;
  proxy_set_header Connection "upgrade";

将硬编码的"websocket"改为$http_upgrade，能适配客户端发送的实际Upgrade请求头，避免兼容性问题。

2. 配置本地hosts解析 #

你提供的是集群内部Pod使用的hosts文件，本地客户端无法读取。要让本地访问example.com，需在本地机器的hosts文件中添加：

127.0.0.1 example.com

• Windows路径：C:\Windows\System32\drivers\etc\hosts
• macOS/Linux路径：/etc/hosts

3. 调整路径重写规则（若后端监听根路径） #

如果你的Node.js服务WebSocket监听的是根路径/，而Ingress配置的path是/ws/，请求会带着/ws/前缀发到后端，导致路径不匹配。需修改Ingress配置：

• 取消注释rewrite-target并调整为：nginx.ingress.kubernetes.io/rewrite-target: /$1
• 将path改为：/ws(/|$)(.*)

修改后的Ingress路径配置示例：

paths:
- path: /ws(/|$)(.*)
  pathType: Prefix
  backend:
    service:
      name: server-service
      port: 
        number: 5005

4. 确认Ingress Controller状态 #

执行以下命令检查NGINX Ingress Controller的运行状态，确保Pod正常运行：

kubectl get pods -n ingress-nginx

若Pod状态异常，需先排查Ingress Controller的部署问题。

内容的提问来源于stack exchange，提问作者kannic