AKS配置Application Gateway后持续出现502错误排查求助

云原生阿岚

2026-6-15

问题描述

按照Microsoft和Kubernetes教程，为两个演示REST API配置Ingress对接Application Gateway，期望将chat-service映射到/chat路径、session-service映射到/session路径，但请求始终返回502 Bad Gateway。使用Microsoft的单服务Ingress演示应用测试集群正常，端口转发Pod到本地后请求可正常响应。部署、服务及Ingress配置如下：

apiVersion: apps/v1
kind: Deployment
metadata:
  name: session-service
spec:
  replicas: 2
  selector:
    matchLabels:
      app: session-service
  template:
    metadata:
      labels:
        app: session-service
    spec:
      nodeSelector:
        app: scalable
      containers:
      - name: session-service-container
        imagePullPolicy: Always
        image: myacr.azurecr.io/scalable/session-service:latest
        ports:
        - containerPort: 8080
        env:
        - name: REDIS
          value: "scalable-redis.default.svc.cluster.local"
        resources:
          requests:
            cpu: 1m
            memory: 128Mi
          limits:
            cpu: 30m
            memory: 512Mi
---
apiVersion: v1
kind: Service
metadata:
  name: session-service
spec:
  ports:
  - port: 8080
    targetPort: 8080
    protocol: TCP
  type: ClusterIP
  selector:
    app: session-service
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: chat-service
spec:
  replicas: 2
  selector:
    matchLabels:
      app: chat-service
  template:
    metadata:
      labels:
        app: chat-service
    spec:
      nodeSelector:
        app: scalable
      containers:
      - name: chat-service-container
        imagePullPolicy: Always
        image: myacr.azurecr.io/scalable/chat-service:latest
        ports:
        - containerPort: 8080
        env:
        - name: REDIS
          value: "scalable-redis.default.svc.cluster.local"
        resources:
          requests:
            cpu: 1m
            memory: 128Mi
          limits:
            cpu: 30m
            memory: 512Mi
---
apiVersion: v1
kind: Service
metadata:
  name: chat-service
spec:
  type: ClusterIP
  ports:
  - port: 8080
    targetPort: 8080
    protocol: TCP
  selector:
    app: chat-service
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: scalable-ingress
spec:
  ingressClassName: azure-application-gateway
  rules:
  - http:
      paths:
      - path: /chat
        pathType: Prefix
        backend:
          service:
            name: chat-service
            port: 
              number: 8080
      - path: /session
        pathType: Prefix
        backend:
          service:
            name: session-service
            port: 
              number: 8080

集群资源状态：

$ kubectl get pods,svc,ingress
NAME                                   READY   STATUS    RESTARTS   AGE
pod/chat-front-5647f964bf-kt86z        1/1     Running   0          12h
pod/chat-front-5647f964bf-vkxhg        1/1     Running   0          12h
pod/chat-service-77cc84cf45-5ns8q      1/1     Running   0          12h
pod/chat-service-77cc84cf45-lqf6g      1/1     Running   0          12h
pod/scalable-redis-9f69d9f96-v7d69     1/1     Running   0          12h
pod/session-service-5b66cddcbf-sfmbg   1/1     Running   0          12h
pod/session-service-5b66cddcbf-z9v4h   1/1     Running   0          12h

NAME                      TYPE           CLUSTER-IP     EXTERNAL-IP      PORT(S)        AGE
service/chat-front-lb     LoadBalancer   10.0.146.62    20.250.xxx.yyy   80:31316/TCP   12h
service/chat-service      ClusterIP      10.0.166.152   <none>           8080/TCP       12h
service/kubernetes        ClusterIP      10.0.0.1       <none>           443/TCP        12h
service/scalable-redis    ClusterIP      10.0.90.162    <none>           6379/TCP       12h
service/session-service   ClusterIP      10.0.55.242    <none>           8080/TCP       12h

NAME                                         CLASS                       HOSTS   ADDRESS        PORTS   AGE
ingress.networking.k8s.io/scalable-ingress   azure-application-gateway   *       4.226.xxx.yyy   80      12h

疑问：遗漏了哪些配置？健康探针显示“unhealthy”会影响路由吗？

原因分析与解决步骤

1. 路径转发上下文不匹配（最可能原因）

Application Gateway Ingress Controller（AGIC）默认会将完整请求路径转发给后端服务。比如访问http://<AG-IP>/chat/xxx时，AGIC会把/chat/xxx直接转发给chat-service，而如果你的服务实际监听的是根路径/xxx，就会返回404，进而导致AGIC的健康探针失败，最终返回502。

解决方式：添加路径重写规则

在Ingress的metadata中添加appgw.ingress.kubernetes.io/backend-path-prefix注解，将路径前缀替换为服务的根路径：

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: scalable-ingress
  annotations:
    appgw.ingress.kubernetes.io/backend-path-prefix: "/"
spec:
  ingressClassName: azure-application-gateway
  rules:
  - http:
      paths:
      - path: /chat
        pathType: Prefix
        backend:
          service:
            name: chat-service
            port: 
              number: 8080
      - path: /session
        pathType: Prefix
        backend:
          service:
            name: session-service
            port: 
              number: 8080

如果两个服务需要不同的路径重写，可以为每个路径单独配置注解：

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: scalable-ingress
spec:
  ingressClassName: azure-application-gateway
  rules:
  - http:
      paths:
      - path: /chat
        pathType: Prefix
        backend:
          service:
            name: chat-service
            port: 
              number: 8080
        annotations:
          appgw.ingress.kubernetes.io/backend-path-prefix: "/"
      - path: /session
        pathType: Prefix
        backend:
          service:
            name: session-service
            port: 
              number: 8080
        annotations:
          appgw.ingress.kubernetes.io/backend-path-prefix: "/"

2. 健康探针配置错误

健康探针显示“unhealthy”会直接影响路由——Application Gateway会将不健康的后端从可用池中移除，返回502。AGIC默认使用服务的/路径作为健康探针端点，如果你的服务健康检查端点不是/（比如Spring Boot的/actuator/health），需要手动配置：

在Ingress的路径中添加健康探针注解：

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: scalable-ingress
spec:
  ingressClassName: azure-application-gateway
  rules:
  - http:
      paths:
      - path: /chat
        pathType: Prefix
        backend:
          service:
            name: chat-service
            port: 
              number: 8080
        annotations:
          appgw.ingress.kubernetes.io/health-probe-path: "/actuator/health"
          appgw.ingress.kubernetes.io/health-probe-port: "8080"
          appgw.ingress.kubernetes.io/health-probe-interval: "30"
          appgw.ingress.kubernetes.io/health-probe-timeout: "10"
      - path: /session
        pathType: Prefix
        backend:
          service:
            name: session-service
            port: 
              number: 8080
        annotations:
          appgw.ingress.kubernetes.io/health-probe-path: "/actuator/health"
          appgw.ingress.kubernetes.io/health-probe-port: "8080"

3. 验证集群内部服务可达性

在集群内的任意Pod中（比如chat-front Pod），测试服务的ClusterIP是否能正常响应：

# 测试chat-service根路径
curl http://10.0.166.152:8080/
# 测试chat-service的具体接口
curl http://10.0.166.152:8080/api/chat

如果返回404，说明服务本身没有对应路径，需要调整服务代码或Ingress路径规则。

4. 检查AGIC日志

查看AGIC Pod的日志，确认Ingress规则是否正确同步到Application Gateway，以及探针失败的具体原因：

# 获取AGIC Pod名称
kubectl get pods -n kube-system | grep application-gateway-ingress
# 查看日志
kubectl logs <agic-pod-name> -n kube-system

内容的提问来源于stack exchange，提问作者tonsteri

AKS配置Application Gateway后持续出现502错误排查求助

1. 路径转发上下文不匹配（最可能原因） #

解决方式：添加路径重写规则 #

2. 健康探针配置错误 #

3. 验证集群内部服务可达性 #

4. 检查AGIC日志 #

1. 路径转发上下文不匹配（最可能原因）

解决方式：添加路径重写规则

2. 健康探针配置错误

3. 验证集群内部服务可达性

4. 检查AGIC日志