EKS部署带ALB Ingress的Atlantis网页无法正常加载求助

我按照官方文档在EKS上部署Atlantis，配置Ingress通过AWS Load Balancer Controller创建带ACM证书的ALB，并用ExternalDNS在Route53生成DNS记录。目前Atlantis已运行，ALB和Route53记录均已创建，但Atlantis网页无法正常加载。将Service设为LoadBalancer类型、不使用Ingress时，页面可正常加载。

相关部署配置如下：

apiVersion: apps/v1
kind: Deployment
metadata:
  name: atlantis
  namespace: atlantis
  labels:
    app.kubernetes.io/name: atlantis
spec:
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/name: atlantis
  template:
    metadata:
      labels:
        app.kubernetes.io/name: atlantis
    spec:
      containers:
      - name: atlantis
        image: ghcr.io/runatlantis/atlantis:v0.27.1 # 替换为最新版本
        env:
        - name: ATLANTIS_REPO_ALLOWLIST
          value: github.com/**********/test/* # 替换为自己的仓库白名单

        ### GitHub 配置 ###
        - name: ATLANTIS_GH_USER
          value: test-user # GitHub用户名，不要加@
        - name: ATLANTIS_GH_TOKEN
          valueFrom:
            secretKeyRef:
              name: atlantis-vcs
              key: token
        - name: ATLANTIS_GH_WEBHOOK_SECRET
          valueFrom:
            secretKeyRef:
              name: atlantis-vcs
              key: webhook-secret
        ### GitHub 配置结束 ###

        - name: ATLANTIS_PORT
          value: "4141" # Kubernetes会自动设置ATLANTIS_PORT，需要手动覆盖
        ports:
        - name: atlantis
          containerPort: 4141
        resources:
          requests:
            memory: 512Mi
            cpu: 100m
          limits:
            memory: 512Mi
            cpu: 100m
        livenessProbe:
          periodSeconds: 60
          httpGet:
            path: /healthz
            port: 4141
            scheme: HTTP
        readinessProbe:
          periodSeconds: 60
          httpGet:
            path: /healthz
            port: 4141
            scheme: HTTP
---
apiVersion: v1
kind: Service
metadata:
  name: atlantis
  namespace: atlantis
spec:
  type: ClusterIP
  ports:
  - name: atlantis
    port: 80
    targetPort: 4141
  selector:
    app.kubernetes.io/name: atlantis
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: atlantis
  namespace: atlantis
  annotations:
    alb.ingress.kubernetes.io/scheme: internet-facing
    alb.ingress.kubernetes.io/group.name: atlantis
    alb.ingress.kubernetes.io/target-type: ip
    alb.ingress.kubernetes.io/certificate-arn: arn:aws:acm:****************
    alb.ingress.kubernetes.io/listen-ports: '[{"HTTPS":443}]'
    alb.ingress.kubernetes.io/ssl-redirect: '443'
spec:
  ingressClassName: alb
  rules:
    - host: atlantis.example.com
      http:
        paths:
          - path: /
            pathType: Exact
            backend:
              service:
                name: atlantis
                port:
                  number: 80

1. 修复Ingress路径匹配规则
   当前Ingress使用pathType: Exact仅精准匹配/路径，但Atlantis页面加载需要加载子路径资源（如静态文件、API接口），将pathType改为Prefix，确保所有子路径请求都能转发到Atlantis服务：

# 修改后的Ingress paths部分
paths:
  - path: /
    pathType: Prefix
    backend:
      service:
        name: atlantis
        port:
          number: 80

2. 修正SSL重定向配置
   原注解alb.ingress.kubernetes.io/ssl-redirect: '443'写法错误，应该设置为true来启用HTTP到HTTPS的重定向：

alb.ingress.kubernetes.io/ssl-redirect: 'true'

3. 配置ALB健康检查（可选但推荐）
   添加健康检查注解，确保ALB能正确识别Atlantis服务的健康状态：

# 在Ingress的annotations中添加以下内容
alb.ingress.kubernetes.io/healthcheck-path: /healthz
alb.ingress.kubernetes.io/healthcheck-port: '80'
alb.ingress.kubernetes.io/healthcheck-protocol: HTTP
alb.ingress.kubernetes.io/healthcheck-interval-seconds: '60'
alb.ingress.kubernetes.io/healthcheck-timeout-seconds: '5'

4. 验证网络与安全配置

• 确认ALB安全组允许443端口的入站流量
• 确认EKS节点安全组允许ALB安全组访问Pod的4141端口
• 检查是否存在NetworkPolicy阻止Ingress到Atlantis Service的流量

修改后重新应用Ingress配置：

kubectl apply -f your-ingress-file.yaml

内容的提问来源于stack exchange，提问作者behnood rahbarfar