Kubernetes集群Ingress无法访问问题排查求助

问题背景 #

搭建4节点Kubernetes集群后，NodePort类型服务可通过任意节点IP正常访问，但Ingress已分配的IP（192.168.0.63）无法从控制平面或部署主机访问，集群整体运行正常，怀疑网络配置存在问题但无法定位。

环境信息 #

• OS: Ubuntu 22.04
• Kubernetes: 1.29.3
• CRI: containerd
• CNI: Calico
• Ingress Class: nginx
• 硬件: Raspberry Pi 4

UFW应用配置 #

ufw allow k8s-worker k8s-calico
ufw allow in vxlan.calico
ufw allow out vxlan.calico
ufw allow k8s-pods from 192.168.0.60/30
ufw allow k8s-nginx-ingress from 192.168.0.60/30

详细端口配置 #

# For control plane
[k8s-cp]
title=Kubernetes for control plane
description=Kubernetes for control plane
ports=80,443,2379,2380,6443,10250:10252,10259,10257,30000:32767/tcp

# For worker node
[k8s-worker]
title=Kubernetes for worker node
description=Kubernetes worker node
ports=80,443,10250,30000:32767/tcp

# Common config
[k8s-calico]
title=callico
description=callico for kubernetes CNI
ports=47,179/tcp|4789/udp|2379/tcp

[k8s-pods]
title=Kubernetes Pods Communication
description=Allow traffic from Kubernetes pods within the CIDR range.
ports=1:65535/tcp|1:65535/udp

[k8s-nginx-ingress]
title=Kubernetes Nginx Ingress Controller
description=Kubernetes Nginx Ingress Controller
ports=8443/tcp

测试资源部署清单 #

apiVersion: v1
kind: Namespace
metadata:
  name: nginx-test
  labels:
    name: nginx-test
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-deployment
  namespace: nginx-test
spec:
  selector:
    matchLabels:
      app: nginx
  replicas: 2
  template:
    metadata:
      labels:
        app: nginx
    spec:
      containers:
        - name: nginx
          image: nginx:1.14.2
          ports:
            - containerPort: 80
          resources:
            requests:
              memory: "128Mi"
              cpu: "0.1"
            limits:
              memory: "128Mi"
              cpu: "0.1"

---
apiVersion: v1
kind: Service
metadata:
  name: nginx-service
  namespace: nginx-test
  labels:
    app: nginx
spec:
  type: ClusterIP
  ports:
    - name: http
      port: 8080
      targetPort: 80
      protocol: TCP
  selector:
    app: nginx

---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: ingress-test
  namespace: nginx-test
  annotations:
    nginx.ingress.kubernetes.io/rewrite-target: /
  labels:
    app: nginx
spec:
  ingressClassName: nginx
  rules:
    - http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: nginx-service
                port:
                  number: 8080
      host: sparrow03.local

Ingress状态信息 #

Name:             ingress-test
Labels:           app=nginx
Namespace:        nginx-test
Address:          192.168.0.63
Ingress Class:    nginx
Default backend:  <default>
Rules:
  Host             Path  Backends
  ----             ----  --------
  sparrow03.local  
                   /   nginx-service:8080 (172.16.184.3:80,172.16.214.3:80)
Annotations:       nginx.ingress.kubernetes.io/rewrite-target: /
Events:
  Type    Reason  Age                   From                      Message
  ----    ------  ----                  ----                      -------
  Normal  Sync    4m12s (x3 over 5m3s)  nginx-ingress-controller  Scheduled for sync

排查与解决步骤 #

1. 补全UFW端口开放规则 #

当前k8s-nginx-ingress仅开放8443端口，但Ingress默认使用80/443处理HTTP/HTTPS流量，需修改配置：

• 将k8s-nginx-ingress的端口配置改为：ports=80/tcp|443/tcp|8443/tcp
• 重新加载UFW规则：

ufw reload

另外，当前规则仅允许192.168.0.60/30网段访问Ingress，若控制平面/部署主机IP不在该范围，需添加对应规则：

# 替换为实际主机IP
ufw allow k8s-nginx-ingress from 你的主机IP/32

2. 验证Ingress Controller服务暴露方式 #

检查Nginx Ingress Controller的Service类型：

kubectl get svc -n ingress-nginx

• 若为NodePort类型，确认80/443对应的NodePort已在UFW规则中开放（当前k8s-worker/k8s-cp已包含80/443，可跳过）；
• 若为LoadBalancer类型（Calico分配192.168.0.63），确认集群节点到该IP的路由可达，且UFW允许相关流量。

3. 验证域名解析 #

Ingress规则指定了host: sparrow03.local，需确保访问主机能解析该域名到192.168.0.63：

• 临时测试可修改/etc/hosts添加条目：

192.168.0.63 sparrow03.local

• 或直接用curl指定Host头访问：

curl -H "Host: sparrow03.local" http://192.168.0.63

4. 检查Ingress Controller日志 #

查看控制器Pod日志，确认流量是否到达或存在错误：

kubectl logs -n ingress-nginx -l app.kubernetes.io/name=ingress-nginx

5. 排查Calico网络策略 #

若Calico配置了网络策略，可能阻止Ingress Controller访问后端服务：

kubectl get networkpolicies --all-namespaces

确保允许ingress-nginx命名空间的Pod访问nginx-test命名空间的nginx-service 8080端口。

内容的提问来源于stack exchange，提问作者elda