配置Host与SSL后Nginx-Ingress故障排查请求

环境信息 #

通过Helm安装的ingress-nginx版本：

sources:
- https://github.com/kubernetes/ingress-nginx
version: 4.8.0

后续重建AKS集群并升级至4.8.3版本，问题依旧。

故障现象 #

• 无Host的Ingress配置可正常访问网站；
• 添加Host（www.angusitlab.com）和SSL证书后，无法建立连接，执行curl -k -v https://www.angusitlab.com始终卡在连接阶段：

curl -k -v https://www.angusitlab.com
*   Trying 20.239.2.101:443...

• 在default命名空间部署无Host的Ingress时，该域名可正常访问，怀疑是Nginx配置问题但无法定位。

相关配置 #

无Host的Ingress配置（可正常访问） #

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: nginx-ingress-lb
  namespace: dev-frontend
  annotations:
    nginx.ingress.kubernetes.io/configuration-snippet: |
      more_set_headers "server: angusitlab";
      more_set_headers "X-Content-Type-Options: nosniff";
      more_set_headers "X-Frame-Options: DENY";
      more_set_headers "X-Xss-Protection: 1";
    nginx.ingress.kubernetes.io/enable-modsecurity: "true"
    nginx.ingress.kubernetes.io/enable-owasp-core-rules: "true"
    nginx.ingress.kubernetes.io/use-regex: "true"
    nginx.ingress.kubernetes.io/modsecurity-snippet: |
      SecRuleEngine On
      SecDebugLog /tmp/modsec_debug.log
      SecRuleRemoveById 949110
    nginx.ingress.kubernetes.io/whitelist-source-range: "0.0.0.0/0"
    # # {{auth_type}}
    # # {{auth_secret}}
spec:
  ingressClassName: nginx-angusitlab
  tls:
    - hosts:
        - www.angusitlab.com
      secretName: http-secret-dev
  rules:
  - http: 
      paths:
        - path: /
          pathType: ImplementationSpecific
          backend:
            service:
              name: dev-nginx
              port:
                number: 80

添加Host后的Ingress配置（无法连接） #

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: dev-nginx-ingress-lb
  namespace: dev-frontend
  annotations:
    nginx.ingress.kubernetes.io/configuration-snippet: |
      more_set_headers "server: angusitlab";
      more_set_headers "X-Content-Type-Options: nosniff";
      more_set_headers "X-Frame-Options: DENY";
      more_set_headers "X-Xss-Protection: 1";
    nginx.ingress.kubernetes.io/enable-modsecurity: "true"
    nginx.ingress.kubernetes.io/enable-owasp-core-rules: "true"
    nginx.ingress.kubernetes.io/use-regex: "true"
    nginx.ingress.kubernetes.io/modsecurity-snippet: |
      SecRuleEngine On
      SecDebugLog /tmp/modsec_debug.log
      SecRuleRemoveById 949110
    nginx.ingress.kubernetes.io/whitelist-source-range: "0.0.0.0/0"
    # # {{auth_type}}
    # # {{auth_secret}}
spec:
  ingressClassName: nginx-angusitlab
  tls:
    - hosts:
        - www.angusitlab.com
      secretName: http-secret-dev
  rules:
    - host: www.angusitlab.com
      http:
        paths:
          - path: /
            pathType: ImplementationSpecific
            backend:
              service:
                name: dev-nginx
                port:
                  number: 80
          - path: /zh-hk/blog.*
            pathType: ImplementationSpecific
            backend:
              service:
                name: blog-wordpress
                port:
                  number: 8081
          - path: /en-us/blog.*
            pathType: ImplementationSpecific
            backend:
              service:
                name: blog-wordpress
                port:
                  number: 8081
          - path: /zh-hk/wp-.*
            pathType: ImplementationSpecific
            backend:
              service:
                name: blog-wordpress
                port:
                  number: 8081
          - path: /en-us/wp-.*
            pathType: ImplementationSpecific
            backend:
              service:
                name: blog-wordpress
                port:
                  number: 8081
          - path: /wp-.*
            pathType: ImplementationSpecific
            backend:
              service:
                name: blog-wordpress
                port:
                  number: 8081

测试用Ingress、Service及Deployment #

测试Ingress配置

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: hello-world-ingress
  annotations:
    nginx.ingress.kubernetes.io/ssl-redirect: "false"
    nginx.ingress.kubernetes.io/use-regex: "true"
    nginx.ingress.kubernetes.io/rewrite-target: /$2
spec:
  ingressClassName: nginx-471
  rules:
  - http:
      paths:
      - path: /hello-world-one(/|$)(.*)
        pathType: Prefix
        backend:
          service:
            name: aks-helloworld-one
            port:
              number: 80
      - path: /hello-world-two(/|$)(.*)
        pathType: Prefix
        backend:
          service:
            name: aks-helloworld-two
            port:
              number: 80
      - path: /(.*)
        pathType: Prefix
        backend:
          service:
            name: aks-helloworld-one
            port:
              number: 80
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: hello-world-ingress-static
  annotations:
    nginx.ingress.kubernetes.io/ssl-redirect: "false"
    nginx.ingress.kubernetes.io/rewrite-target: /static/$2
spec:
  ingressClassName: nginx
  rules:
  - http:
      paths:
      - path: /static(/|$)(.*)
        pathType: Prefix
        backend:
          service:
            name: aks-helloworld-one
            port: 
              number: 80

测试Deployment与Service配置

apiVersion: apps/v1
kind: Deployment
metadata:
  name: aks-helloworld-one  
spec:
  replicas: 1
  selector:
    matchLabels:
      app: aks-helloworld-one
  template:
    metadata:
      labels:
        app: aks-helloworld-one
    spec:
      containers:
      - name: aks-helloworld-one
        image: mcr.microsoft.com/azuredocs/aks-helloworld:v1
        ports:
        - containerPort: 80
        env:
        - name: TITLE
          value: "Welcome to Azure Kubernetes Service (AKS)"
---
apiVersion: v1
kind: Service
metadata:
  name: aks-helloworld-one  
spec:
  type: ClusterIP
  ports:
  - port: 80
  selector:
    app: aks-helloworld-one

排查步骤 #

1. 检查TLS证书有效性：执行kubectl get secret http-secret-dev -n dev-frontend -o yaml，确认证书和密钥为PEM格式，未过期且包含www.angusitlab.com域名。
2. 查看Ingress Controller日志：执行kubectl logs -n ingress-nginx <ingress-controller-pod-name>，排查证书加载失败、配置错误或连接超时日志。
3. 验证端口与域名解析：用telnet 20.239.2.101 443或nc -zv 20.239.2.101 443测试443端口连通性，确认域名解析指向正确的Ingress公网IP，同时检查防火墙/安全组是否开放443端口。
4. 简化配置定位问题：临时移除ModSecurity注释、复杂路径规则，保留基础Host和TLS配置，测试连接是否正常，逐步添加配置项排查触发点。
5. 确认IngressClass关联：执行kubectl get ingressclass，检查nginx-angusitlab是否正确关联到ingress-nginx控制器。

内容的提问来源于stack exchange，提问作者AngusChu