AKS集群NGINX路由HTTP 404错误排查求助

我在AKS集群部署了icap-accountservice服务，通过Postman验证可用性时失败。访问https://aks.odb-tech.com/accounts/users返回404，直接用集群IP访问也失败。已尝试重启集群、清理旧部署、修改Deployment名称，均无效；NGINX服务检查无异常。以下是相关配置清单：

deployment.yaml #

apiVersion: apps/v1
kind: Deployment
metadata:
  name: icap-accountservice
  labels:
    app: icap-accountservice
  namespace: default
spec:
  selector:
    matchLabels:
      app: icap-accountservice
  template:
    metadata:
      labels:
        app: icap-accountservice
    spec:
      containers:
        - name: icap-accountservice
          image: icapacr.azurecr.io/icap-accountservice:latest
          ports:
            - containerPort: 5000
          volumeMounts:
            - name: secrets-store-accountservice
              mountPath: "/mnt/secrets-store"
              readOnly: true
      volumes:
        - name: secrets-store-accountservice
          csi:
            driver: secrets-store.csi.k8s.io
            readOnly: true
            volumeAttributes:
              secretProviderClass: "icap-accountservice-kv"

ingress.yaml #

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    kubernetes.azure.com/tls-cert-keyvault-uri: https://icap-vault.vault.azure.net/certificates/ICAP-AKS-CERT/687ed42192e443cdaa9635d5ab67a960    
  name: icap-accountservice-ingress
  namespace: default
spec:
  ingressClassName: webapprouting.kubernetes.azure.com
  rules:
  - host: aks.odb-tech.com
    http:
      paths:
      - path: /accounts
        pathType: Prefix
        backend:
          service:
            name: icap-accountservice
            port: 
              number: 5000
  tls:
  - hosts:
    - aks.odb-tech.com
    secretName: icap-accountservice

podautoscaler.yaml #

apiVersion: autoscaling/v1
kind: HorizontalPodAutoscaler
metadata:
  name: icap-accountservice-hpa
spec:
  maxReplicas: 15
  minReplicas: 2
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: icap-accountservice
  targetCPUUtilizationPercentage: 50

service.yaml #

apiVersion: v1
kind: Service
metadata:
  name: icap-accountservice
  namespace: default
spec:
  type: ClusterIP
  selector:
    app: icap-accountservice
  ports:
    - port: 5000
      targetPort: 5000

排查步骤建议 #

• 检查Pod状态：执行kubectl get pods -n default确认icap-accountservice的Pod是否处于Running状态，无CrashLoopBackOff或其他异常。
• 查看Pod日志：kubectl logs <pod-name> -n default，检查服务是否正常启动、是否存在初始化错误（比如密钥挂载失败导致服务无法启动）。
• 验证服务端点：kubectl get endpoints icap-accountservice -n default，确认Endpoints已关联到正常的Pod IP。
• 集群内测试访问：在集群内另一个Pod中执行curl http://icap-accountservice:5000/users，跳过Ingress直接验证服务本身是否能正常返回结果。
• 检查Ingress配置：确认aks.odb-tech.com的DNS已解析到AKS集群Ingress Controller的外部IP；查看Ingress Controller日志，排查是否有路由转发错误。
• 路径匹配问题：Ingress路径为/accounts（Prefix类型），访问/accounts/users时，服务是否期望接收/users还是/accounts/users？如果服务监听根路径下的/users，需在Ingress中添加重写注解（比如nginx.ingress.kubernetes.io/rewrite-target: /$2，同时路径改为/accounts(/|$)(.*)）。
• 密钥挂载验证：进入Pod内部检查/mnt/secrets-store目录是否存在预期的密钥文件，确认CSI驱动是否正常挂载密钥，避免服务因缺少配置无法启动。

内容的提问来源于stack exchange，提问作者OwendB