Kubernetes部署NextJS+Duende Identity Server登录重定向失败求助

我正在开发一个基于微服务的拍卖应用（学校项目），采用Docker容器化，先做本地Kubernetes部署再迁移到Azure。当前遇到的核心问题：点击NextJS开发的Web应用的「Login」按钮时，无法重定向到C#开发的Duende Identity Server认证微服务。Docker配置正常，但Kubernetes环境下，除Web应用到认证服务的重定向外，其他微服务均能正常工作，怀疑是Nginx或Ingress配置导致异常。

错误日志 #

2024-06-19 21:46:12 [next-auth][error][SIGNIN_OAUTH_ERROR] 
2024-06-19 21:46:12 https://next-auth.js.org/errors#signin_oauth_error connect ECONNREFUSED 127.0.0.1:443 {
2024-06-19 21:46:12   error: {
2024-06-19 21:46:12     message: 'connect ECONNREFUSED 127.0.0.1:443',
2024-06-19 21:46:12     stack: 'Error: connect ECONNREFUSED 127.0.0.1:443\n' +
2024-06-19 21:46:12       '    at TCPConnectWrap.afterConnect [as oncomplete] (node:net:1555:16)\n' +
2024-06-19 21:46:12       '    at TCPConnectWrap.callbackTrampoline (node:internal/async_hooks:128:17)',
2024-06-19 21:46:12     name: 'Error'
2024-06-19 21:46:12   },
2024-06-19 21:46:12   providerId: 'id-server',
2024-06-19 21:46:12   message: 'connect ECONNREFUSED 127.0.0.1:443'
2024-06-19 21:46:12 }

已排查情况 #

• 多次修改Web应用配置中的AUTH_URL变量，尝试多种Nginx和Ingress配置均未解决问题
• 在Web应用Pod内ping auth.cube.com，结果正常
• 使用mkcert生成SSL证书，本地hosts文件已添加映射：

127.0.0.1 auth.cube.com app.cube.com api.cube.com

关键Kubernetes配置片段 #

Web应用部署变量 #

spec:
      containers:
        - name: webapp
          image: nelahio/web-app:latest
          env:
            - name: NEXTAUTH_SECRET
              value: something
            - name: NEXTAUTH_URL
              value: https://app.cube.com
            - name: API_URL
              value: http://gateway-clusterip/
            - name: AUTH_URL
              value: https://auth.cube.com
          ports:
            - containerPort: 3000

认证服务部署及ClusterIP Service #

spec:
      containers:
        - name: authentification-service
          image: nelahio/authentification-service:latest
          env:
            - name: ASPNETCORE_ENVIRONMENT
              value: Production
            - name: ASPNETCORE_URLS
              value: http://+:80
            - name: ClientApp
              value: https://app.cube.com
            - name: ConnectionStrings__DefaultConnection
              value: Server=postgres-clusterip:5432;User Id=postgres;Password=postgrespw;Database=identity
            - name: VIRTUAL_HOST
              value: auth.cube.com
---
apiVersion: v1
kind: Service
metadata:
  name: authentification-clusterip
spec:
  selector:
    app: authentification-service
  ports:
    - name: http
      port: 80
      targetPort: 80

Nginx代理部署及NodePort Service #

spec:
      containers:
        - name: nginx-proxy
          image: nginxproxy/nginx-proxy
          ports:
            - name: http
              containerPort: 80
            - name: https
              containerPort: 443
          volumeMounts:
            - mountPath: /tmp/docker.sock
              name: docker-sock
              readOnly: true
            - mountPath: /etc/nginx/certs
              name: nginx-certs
      volumes:
        - name: docker-sock
          hostPath:
            path: /var/run/docker.sock
        - name: nginx-certs
          hostPath:
            path: ./devcerts
---
apiVersion: v1
kind: Service
metadata:
  name: nginx-proxy
spec:
  type: NodePort
  selector:
    app: nginx-proxy
  ports:
    - name: http
      port: 80
      nodePort: 30080
    - name: https
      port: 443
      nodePort: 30443

Ingress配置 #

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: ingress-service
  labels:
    name: ingress-service
  annotations:
    nginx.ingress.kubernetes.io/rewrite-target: /
    nginx.ingress.kubernetes.io/ssl-redirect: "true"
    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
spec:
  ingressClassName: nginx
  tls:
    - hosts:
        - app.cube.com
        - api.cube.com
      secretName: cube-app-tls
    - hosts:
        - auth.cube.com
      secretName: cube-com-tls
  rules:
    - host: app.cube.com
      http:
        paths:
          - pathType: Prefix
            path: "/"
            backend:
              service:
                name: webapp-clusterip
                port:
                  number: 3000
    - host: api.cube.com
      http:
        paths:
          - pathType: Prefix
            path: "/"
            backend:
              service:
                name: gateway-clusterip
                port:
                  number: 80
    - host: auth.cube.com
      http:
        paths:
          - pathType: Prefix
            path: "/"
            backend:
              service:
                name: authentification-clusterip
                port:
                  number: 80

疑问 #

是否是SSL错误、Ingress或Nginx配置导致的重定向失败？

内容的提问来源于stack exchange，提问作者Nelahio