如何在Nginx反向代理后配置Kubernetes Ingress

算力阿峰

2026-6-29

问题：外部Nginx反向代理无法转发请求到Kubernetes Ingress Controller

我的Linux机器上运行Kubernetes主节点，同时部署了独立Nginx服务，目标是通过Nginx反向代理统一管理监控、数据库及K8s集群内服务（开发环境非最佳实践）。目前部分服务代理正常，但请求无法转发到K8s Ingress Controller，进而无法访问集群内的Dashboard服务，访问dashboard.kubernetes.k8s.domain.me返回404错误。

外部Nginx反向代理配置

server {
        listen 8080 default_server;
        root /var/www/html;
        server_name _;

        location / {
                try_files $uri $uri/ =404;
        }
}


server {
    listen 80;
    server_name nginx.k8s.domain.me;

    location / {
        proxy_pass http://127.0.0.1:8080;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

server {
    listen 80;
    server_name dashboard.kubernetes.k8s.domain.me;
    location / {
        proxy_pass http://192.168.77.139:80;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_buffer_size   128k;
        proxy_buffers   4 256k;
        proxy_busy_buffers_size   256k;
    }
}

访问nginx.k8s.domain.me可正常显示Nginx默认页面，但dashboard.kubernetes.k8s.domain.me返回404。

Kubernetes Dashboard Ingress配置

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: dashboard-ingress
  namespace: kubernetes-dashboard
spec:
  rules:
  - host: dashboard.kubernetes.k8s.domain.me
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: kubernetes-dashboard
            port:
              number: 80

集群相关信息

节点状态

kubectl get nodes
NAME          STATUS   ROLES           AGE    VERSION
master-node   Ready    control-plane   141m   v1.28.2

Ingress资源状态

kubectl get ingresses --all-namespaces -o wide
NAMESPACE              NAME                  CLASS    HOSTS                                 ADDRESS   PORTS   AGE
kubernetes-dashboard   dashboard-ingress     <none>   dashboard.kubernetes.k8s.domain.me               80      131m

Pod状态

kubectl get pods --all-namespaces -o wide
NAMESPACE              NAME                                         READY   STATUS      RESTARTS   AGE    IP               NODE          NOMINATED NODE   READINESS GATES
calico-apiserver       calico-apiserver-5bd8dc87cf-4p5rc            1/1     Running     0          141m   192.168.77.133   master-node   <none>           <none>
calico-apiserver       calico-apiserver-5bd8dc87cf-9szzg            1/1     Running     0          141m   192.168.77.134   master-node   <none>           <none>
calico-system          calico-kube-controllers-685f7c9b88-6mls5     1/1     Running     0          141m   192.168.77.131   master-node   <none>           <none>
calico-system          calico-node-4zqpw                            1/1     Running     0          141m   <hidden>    master-node   <none>           <none>
calico-system          calico-typha-5d74745fdd-2cmnt                1/1     Running     0          141m   <hidden>    master-node   <none>           <none>
calico-system          csi-node-driver-mfmql                        2/2     Running     0          141m   192.168.77.130   master-node   <none>           <none>
default                hello-world-deployment-5cccb4989-8jdsw       1/1     Running     0          41m    192.168.77.140   master-node   <none>           <none>
default                hello-world-deployment-5cccb4989-cnxzz       1/1     Running     0          41m    192.168.77.142   master-node   <none>           <none>
default                hello-world-deployment-5cccb4989-l4ltg       1/1     Running     0          41m    192.168.77.141   master-node   <none>           <none>
ingress-nginx          ingress-nginx-admission-create-kswjk         0/1     Completed   0          135m   192.168.77.138   master-node   <none>           <none>
ingress-nginx          ingress-nginx-admission-patch-gsmjs          0/1     Completed   1          135m   192.168.77.137   master-node   <none>           <none>
ingress-nginx          ingress-nginx-controller-68fb8cf9cc-9bkft    1/1     Running     0          135m   192.168.77.139   master-node   <none>           <none>
kube-system            coredns-5dd5756b68-lvqsj                     1/1     Running     0          142m   192.168.77.132   master-node   <none>           <none>
kube-system            coredns-5dd5756b68-t4ssf                     1/1     Running     0          142m   192.168.77.129   master-node   <none>           <none>
kube-system            etcd-master-node                             1/1     Running     2          143m   <hidden>    master-node   <none>           <none>
kube-system            kube-apiserver-master-node                   1/1     Running     2          143m   <hidden>    master-node   <none>           <none>
kube-system            kube-controller-manager-master-node          1/1     Running     1          143m   <hidden>    master-node   <none>           <none>
kube-system            kube-proxy-dlm74                             1/1     Running     0          142m   <hidden>    master-node   <none>           <none>
kube-system            kube-scheduler-master-node                   1/1     Running     2          143m   <hidden>    master-node   <none>           <none>
kubernetes-dashboard   dashboard-metrics-scraper-5657497c4c-qx5nr   1/1     Running     0          137m   192.168.77.135   master-node   <none>           <none>
kubernetes-dashboard   kubernetes-dashboard-78f87ddfc-5vljg         1/1     Running     0          137m   192.168.77.136   master-node   <none>           <none>
tigera-operator        tigera-operator-8547bd6cc6-5k6s7             1/1     Running     0          142m   <hidden>    master-node   <none>           <none>

Service状态

kubectl get services --all-namespaces -o wide
NAMESPACE              NAME                                 TYPE           CLUSTER-IP       EXTERNAL-IP   PORT(S)                      AGE    SELECTOR
calico-apiserver       calico-api                           ClusterIP      10.96.71.22      <none>        443/TCP                      142m   apiserver=true
calico-system          calico-kube-controllers-metrics      ClusterIP      None             <none>        9094/TCP                     142m   k8s-app=calico-kube-controllers
calico-system          calico-typha                         ClusterIP      10.101.144.111   <none>        5473/TCP                     142m   k8s-app=calico-typha
default                hello-world-service                  ClusterIP      10.106.93.244    <none>        80/TCP                       42m    app=hello-world
default                kubernetes                           ClusterIP      10.96.0.1        <none>        443/TCP                      144m   <none>
ingress-nginx          ingress-nginx-controller             LoadBalancer   10.102.254.176   <pending>     80:31488/TCP,443:32443/TCP   136m   app.kubernetes.io/component=controller,app.kubernetes.io/instance=ingress-nginx,app.kubernetes.io/name=ingress-nginx
ingress-nginx          ingress-nginx-controller-admission   ClusterIP      10.97.17.56      <none>        443/TCP                      136m   app.kubernetes.io/component=controller,app.kubernetes.io/instance=ingress-nginx,app.kubernetes.io/name=ingress-nginx
kube-system            kube-dns                             ClusterIP      10.96.0.10       <none>        53/UDP,53/TCP,9153/TCP       144m   k8s-app=kube-dns
kubernetes-dashboard   dashboard-metrics-scraper            ClusterIP      10.107.180.47    <none>        8000/TCP                     138m   k8s-app=dashboard-metrics-scraper
kubernetes-dashboard   kubernetes-dashboard                 ClusterIP      10.108.179.123   <none>        443/TCP                      138m   k8s-app=kubernetes-dashboard

问题分析与解决方案

核心问题1：Ingress资源未绑定Ingress Controller类

从Ingress状态可见CLASS字段为<none>，当前集群使用的是ingress-nginx控制器，需为Ingress指定对应类，否则控制器不会处理该Ingress规则。

修复步骤：
修改Dashboard Ingress配置，添加ingressClassName字段：

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: dashboard-ingress
  namespace: kubernetes-dashboard
spec:
  ingressClassName: nginx  # 匹配ingress-nginx控制器的类名
  rules:
  - host: dashboard.kubernetes.k8s.domain.me
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: kubernetes-dashboard
            port:
              number: 443  # Dashboard Service实际监听443端口，而非80

核心问题2：Dashboard Service端口错误

从Service列表可见kubernetes-dashboard服务的端口是443，而非Ingress中配置的80，这会导致Ingress转发请求到错误端口，无法正常访问。

核心问题3：外部Nginx代理的端口选择

当前外部Nginx代理到Ingress Controller Pod的IP（192.168.77.139:80），更可靠的方式是使用NodePort端口（31488），避免Pod重启后IP变化：

优化外部Nginx配置：

server {
    listen 80;
    server_name dashboard.kubernetes.k8s.domain.me;
    location / {
        proxy_pass http://127.0.0.1:31488;  # 使用Ingress Controller的NodePort
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_buffer_size   128k;
        proxy_buffers   4 256k;
        proxy_busy_buffers_size   256k;
    }
}

验证步骤

应用修改后的Ingress配置：

kubectl apply -f dashboard-ingress.yaml

查看Ingress状态，确认ADDRESS字段已填充（表示Ingress Controller已绑定）：

kubectl get ingress dashboard-ingress -n kubernetes-dashboard

重启外部Nginx服务：

sudo systemctl restart nginx

再次访问dashboard.kubernetes.k8s.domain.me测试。

内容的提问来源于stack exchange，提问作者Oskar Migowski

如何在Nginx反向代理后配置Kubernetes Ingress

外部Nginx反向代理配置 #

Kubernetes Dashboard Ingress配置 #

集群相关信息 #

节点状态 #

Ingress资源状态 #

Pod状态 #

Service状态 #

问题分析与解决方案 #

核心问题1：Ingress资源未绑定Ingress Controller类 #

核心问题2：Dashboard Service端口错误 #

核心问题3：外部Nginx代理的端口选择 #

验证步骤 #