ALB Ingress Controller路径路由异常：仅/可用，/test报403

问题现象 #

在EKS集群中使用ALB Ingress Controller配置路径路由时，根路径/可正常访问，但/test路径返回403错误。将test服务切换至/路径后可正常运行，说明非根路径的路由规则未生效。

相关Ingress配置 #

test-ui Ingress #

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: test-ui
  namespace: dev
  annotations:
    # Ingress core settings
    alb.ingress.kubernetes.io/scheme: internet-facing
    alb.ingress.kubernetes.io/load-balancer-name: test-dev
    alb.ingress.kubernetes.io/tags: project=test, env=dev
    alb.ingress.kubernetes.io/ssl-redirect: '443'
    alb.ingress.kubernetes.io/group.name: dev
    kubernetes.io/ingress.class: alb
    alb.ingress.kubernetes.io/group.order: 1000
    alb.ingress.kubernetes.io/listen-ports: '[{"HTTP":80,"HTTPS": 443}]'
    alb.ingress.kubernetes.io/certificate-arn: xxx
    alb.ingress.kubernetes.io/actions.response-403: >
      {"type":"fixed-response","fixedResponseConfig":{"contentType":"text/plain","statusCode":"403","messageBody":"403 External access to endpoint not allowed"}}
spec:
  rules:
  - host: "xxx.test.com"
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: test-ui
            port:
              number: 80

test Ingress #

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: test
  namespace: dev
  annotations:
    # Ingress core settings
    alb.ingress.kubernetes.io/scheme: internet-facing
    alb.ingress.kubernetes.io/load-balancer-name: test-dev
    alb.ingress.kubernetes.io/tags: project=test, env=dev
    alb.ingress.kubernetes.io/ssl-redirect: '443'
    alb.ingress.kubernetes.io/group.name: dev
    kubernetes.io/ingress.class: alb
    alb.ingress.kubernetes.io/listen-ports: '[{"HTTP":80,"HTTPS": 443}]'
    alb.ingress.kubernetes.io/certificate-arn: xxx
    alb.ingress.kubernetes.io/actions.response-403: >
      {"type":"fixed-response","fixedResponseConfig":{"contentType":"text/plain","statusCode":"403","messageBody":"403 External access to endpoint not allowed"}}
spec:
  rules:
  - host: "xxx.test.com"
    http:
      paths:
      - path: /test
        pathType: Prefix
        backend:
          service:
            name: test
            port:
              number: 8080

环境信息 #

• AWS Load Balancer Controller版本：v2.6.1（Helm安装）
• Kubernetes版本：1.27
• EKS版本：1.27

排查与解决步骤 #

1. 适配后端服务路径规则 #

ALB默认会将完整请求路径（如/test/xxx）转发给后端服务，如果test服务仅监听根路径/的请求，就会返回403。需添加路径重写配置：
在test Ingress的metadata.annotations中加入：

alb.ingress.kubernetes.io/rewrite-target: /$1

同时修改spec.rules.http.paths中的路径：

paths:
- path: /test/*
  pathType: Prefix
  backend:
    service:
      name: test
      port:
        number: 8080

配置后ALB会将/test/xxx重写为/xxx转发给后端服务。

2. 验证ALB路由规则优先级 #

两个Ingress同属dev组，ALB会按路径长度匹配优先级处理请求（更长的Prefix路径优先级更高）。可通过AWS控制台查看ALB监听器规则，确认/test路径对应的规则是否正确指向test服务，而非被/的规则匹配拦截。

3. 检查服务端点可用性 #

确认test服务对应的Pod正常运行且端点就绪：

kubectl get svc test -n dev
kubectl get endpoints test -n dev

若Pod未就绪或端点为空，ALB会返回403/503错误，需先修复服务的运行状态。

4. 确认Ingress配置同步状态 #

查看Ingress资源的事件日志，确认Controller已成功将配置同步至ALB：

kubectl describe ingress test -n dev
kubectl describe ingress test-ui -n dev

若存在同步失败事件，根据提示调整配置（如注解格式错误、IAM权限不足等）。

内容的提问来源于stack exchange，提问作者rabioz