Nginx反向代理Kubernetes资源API时Watch操作失效问题排查

问题背景 #

在服务器部署Minikube集群后，通过Nginx将仅能内部访问的Minikube IP 192.168.49.2 代理到域名 k8s.mydomain.com，常规Kubernetes操作（如k get pods、k apply -f deployment.yaml）可正常执行，但Watch类操作（如k logs -f podname、k get -w pods）无法实时获取更新，仅能显示历史内容。

原因分析 #

Kubernetes的Watch API依赖HTTP长连接持续推送资源更新，默认Nginx配置会在短时间内关闭空闲连接，且缺少维持长连接的必要参数，导致Watch连接被提前中断；同时当前配置存在重复的location规则，易引发匹配冲突。

修正后的Nginx配置 #

server {
    server_name k8s.mydomain.com;
    auth_basic "Administrator’s Area";
    auth_basic_user_file /etc/nginx/.htpasswd;

    # 合并所有请求到单个location，避免规则冲突
    location / {
        proxy_pass https://192.168.49.2:8443;
        proxy_ssl_certificate /home/admin/.minikube/profiles/minikube/client.crt;
        proxy_ssl_certificate_key /home/admin/.minikube/profiles/minikube/client.key;
        
        # 启用HTTP/1.1长连接，适配Kubernetes Watch API
        proxy_http_version 1.1;
        proxy_set_header Connection "";
        
        # 延长超时时间，防止长连接被过早关闭
        proxy_read_timeout 3600s;
        proxy_send_timeout 3600s;
        
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

    listen 443 ssl; # managed by Certbot
    ssl_certificate /etc/letsencrypt/live/k8s.mydomain.com/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/k8s.mydomain.com/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
}

server {
    if ($host = k8s.mydomain.com) {
        return 301 https://$host$request_uri;
    } # managed by Certbot

    server_name k8s.mydomain.com;
    listen 80;
    return 404; # managed by Certbot
}

配置说明 #

• 合并重复的location规则，消除匹配冲突
• 添加proxy_http_version 1.1和proxy_set_header Connection ""：强制使用HTTP/1.1协议，让Nginx自动管理长连接，适配Watch API需求
• 延长proxy_read_timeout和proxy_send_timeout至3600秒：避免Nginx过早关闭空闲的Watch连接
• 补充Host、X-Forwarded-*系列请求头：确保Kubernetes API能正确识别请求来源与协议

kube-config调整 #

当前kube-config无需修改，已正确指向代理域名且认证正常。若需增强安全性，可添加Minikube集群CA证书验证（证书路径为服务器上的/home/admin/.minikube/ca.crt，需复制到本地设备），修改后的配置如下：

apiVersion: v1
clusters:
- cluster:
    certificate-authority: /path/to/local/ca.crt # 本地存放Minikube CA证书的路径
    extensions:
    - extension:
        last-update: Thu, 22 Jun 2023 19:21:36 CEST
        provider: minikube.sigs.k8s.io
        version: v1.30.1
      name: cluster_info
    server: https://k8s.mydomain.com
  name: minikube
contexts:
- context:
    cluster: minikube
    extensions:
    - extension:
        last-update: Thu, 22 Jun 2023 19:21:36 CEST
        provider: minikube.sigs.k8s.io
        version: v1.30.1
      name: context_info
    namespace: default
    user: minikube
  name: minikube
current-context: minikube
kind: Config
preferences: {}
users:
- name: minikube
  user:
    password: ${KUBE_PWD}
    username: minikube

验证步骤 #

1. 执行nginx -t检查Nginx配置语法是否正确
2. 重启Nginx服务（如systemctl restart nginx），确保配置生效
3. 在外部设备执行k get pods -w或k logs -f <pod-name>，验证是否能实时接收资源更新

内容的提问来源于stack exchange，提问作者FabioKaelin