GCP Kubernetes Ingress：gRPC请求报404但HTTP请求正常

我在GCP Kubernetes上部署了一个同时支持gRPC和HTTP 1.1的Golang服务，当前HTTP请求配置正常，但使用gRPC应用调用时，Ingress访问日志显示404响应。调用服务的代码无拼写错误，相同代码在VM上运行正常，仅Kubernetes搭配Google内部负载均衡时出现该问题。以下是我的配置文件，请帮忙排查是否存在遗漏配置：

ServiceAccount配置 #

apiVersion: v1
kind: ServiceAccount
metadata:
  name: "service-qa"
  namespace: service-qa
  labels:
    helm.sh/chart: service-0.0.1
    app.kubernetes.io/name: service
    app.kubernetes.io/instance: release-name
    app.kubernetes.io/version: "1.0.0"
    app.kubernetes.io/managed-by: Helm

Service配置 #

apiVersion: v1
kind: Service
metadata:
  name: "service-qa"
  namespace: service-qa
  annotations:
    cloud.google.com/app-protocols: '{"http2":"HTTP2", "http": "HTTP"}'
    cloud.google.com/neg: '{"ingress": true}'
    service.alpha.kubernetes.io/app-protocols: '{"http2":"HTTP2", "http": "HTTP"}'
    cloud.google.com/backend-config: '{"default": "service-qa"}'
  labels:
    helm.sh/chart: service-0.0.1
    app.kubernetes.io/name: service
    app.kubernetes.io/instance: release-name
    app.kubernetes.io/version: "1.0.0"
    app.kubernetes.io/managed-by: Helm
spec:
  type: ClusterIP
  ports:
    - port: 443
      targetPort: 8080
      protocol: TCP
      name: http
  selector:
    app.kubernetes.io/name: service
    app.kubernetes.io/instance: release-name

Deployment配置 #

apiVersion: apps/v1
kind: Deployment
metadata:
  name: "service-qa"
  labels:
    helm.sh/chart: service-0.0.1
    app.kubernetes.io/name: service
    app.kubernetes.io/instance: release-name
    app.kubernetes.io/version: "1.0.0"
    app.kubernetes.io/managed-by: Helm
  namespace: service-qa
spec:
  replicas: 5
  selector:
    matchLabels:
      app.kubernetes.io/name: service
      app.kubernetes.io/instance: release-name
  template:
    metadata:
      labels:
        app.kubernetes.io/name: service
        app.kubernetes.io/instance: release-name
    spec:
      securityContext:
        {}
      containers:
        - name: service
          securityContext:
            {}
          image: "REDACTED/service:1.0.0_202310170507"
          env:
            - name: IS_LIVE
              value: "false"
            - name: PROFILE
              value: "qa"
            - name: TOKEN
              valueFrom:
                    secretKeyRef:
                      key: token
                      name: service-access-token
          imagePullPolicy: IfNotPresent
          ports:
            - name: http
              containerPort: 8080
              protocol: TCP
          resources:
            limits:
              cpu: 100m
              memory: 200Mi
            requests:
              cpu: 50m
              memory: 100Mi
      nodeSelector:
        iam.gke.io/gke-metadata-server-enabled: "true"

Ingress配置 #

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: "service-qa"
  namespace: service-qa
  labels:
    helm.sh/chart: service-0.0.1
    app.kubernetes.io/name: service
    app.kubernetes.io/instance: release-name
    app.kubernetes.io/version: "1.0.0"
    app.kubernetes.io/managed-by: Helm
  annotations:
    ingress.gcp.kubernetes.io/pre-shared-cert: cert
    kubernetes.io/ingress.allow-http: "false"
    kubernetes.io/ingress.class: gce-internal
    kubernetes.io/ingress.regional-static-ip-name: ilb
spec:
  tls:
    - hosts:
      - REDACTED
      secretName: cert-qa
  rules:
    - host: "REDACTED"
      http:
        paths:
          - path: /*
            pathType: ImplementationSpecific
            backend:
              service:
                name: service-qa
                port:
                  number: 443

BackendConfig配置 #

apiVersion: cloud.google.com/v1
kind: BackendConfig
metadata:
  name: "service-qa"
  namespace: service-qa
spec:
  timeoutSec: 400
  healthCheck:
    checkIntervalSec: 30
    port: 8080
    type: HTTP
    requestPath: /healthcheck

问题排查与修复建议 #

• Service端口协议映射缺失：你在app-protocols注解中声明了http2: HTTP2，但Service的ports列表里没有对应名称为http2的端口。GCE Ingress需要明确的端口映射来识别HTTP/2流量，需添加对应端口：

  ports:
    - port: 443
      targetPort: 8080
      protocol: TCP
      name: http
    - port: 4443
      targetPort: 8080
      protocol: TCP
      name: http2
  

• Ingress路径匹配调整：gRPC请求路径格式为/package.Service/Method，当前path: /*的ImplementationSpecific匹配可能无法正确路由。建议改为pathType: Prefix并设置path: /，同时添加HTTP/2端口的路由规则：

  rules:
    - host: "REDACTED"
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: service-qa
                port:
                  number: 443
          - path: /
            pathType: Prefix
            backend:
              service:
                name: service-qa
                port:
                  number: 4443
  

• 确认服务端HTTP/2支持：Golang服务需确保已开启HTTP/2支持，使用http.ListenAndServeTLS会自动启用HTTP/2，无需额外配置，但需保证服务端证书有效且与Ingress配置一致。

• BackendConfig健康检查验证：虽然HTTP请求正常，但需确认/healthcheck端点同时支持HTTP/1.1请求，避免后端被误标记为不健康影响gRPC流量转发。

内容的提问来源于stack exchange，提问作者tush4r