API Gateway到EKS Network LoadBalancer路由问题求助

我是Terraform和Kubernetes新手，配置了AWS EKS内部Network LoadBalancer（NLB）服务，通过VPC Link连接API Gateway，但请求未路由至应用根URL，反而被发送到pod的/dev/echo路径，返回404错误（该路径不存在）。

相关配置 #

Kubernetes负载均衡服务 #

apiVersion: v1
kind: Service
metadata:
  name: echoserver
  namespace: default
  annotations:
    service.beta.kubernetes.io/aws-load-balancer-type: nlb-ip
    service.beta.kubernetes.io/aws-load-balancer-scheme: internal
spec:
  ports:
  - port: 80
    protocol: TCP
  type: LoadBalancer
  selector:
    run: php-apache

API Gateway VPC Link集成（Terraform代码） #

resource "aws_apigatewayv2_integration" "eks" {
  api_id = aws_apigatewayv2_api.main.id

  integration_uri    = "arn:aws:elasticloadbalancing:ap-south-1:256807339053:listener/net/k8s-default-echoserv-63ab2d9787/45a287074471516b/401efbd2b547f71b"
  integration_type   = "HTTP_PROXY"
  integration_method = "ANY"
  connection_type    = "VPC_LINK"
  connection_id      = aws_apigatewayv2_vpc_link.eks.id
}

resource "aws_apigatewayv2_route" "get_echo" {
  api_id = aws_apigatewayv2_api.main.id

  route_key = "GET /echo"
  target    = "integrations/${aws_apigatewayv2_integration.eks.id}"
}

解决方案 #

问题核心是API Gateway的HTTP_PROXY集成默认会将API的完整请求路径追加到后端NLB的地址后。当前路由GET /echo会让请求被转发到http://NLB地址/echo，而你的应用根路径是/，因此返回404。

修复方案二选一： #

1. 重写集成路径，转发到后端根目录
   在Terraform的aws_apigatewayv2_integration资源中添加路径重写配置，强制将请求路径替换为后端的根路径：

   resource "aws_apigatewayv2_integration" "eks" {
     api_id = aws_apigatewayv2_api.main.id
   
     integration_uri    = "arn:aws:elasticloadbalancing:ap-south-1:256807339053:listener/net/k8s-default-echoserv-63ab2d9787/45a287074471516b/401efbd2b547f71b"
     integration_type   = "HTTP_PROXY"
     integration_method = "ANY"
     connection_type    = "VPC_LINK"
     connection_id      = aws_apigatewayv2_vpc_link.eks.id
     payload_format_version = "2.0"
     # 覆盖请求路径，转发到后端根目录
     request_parameters = {
       "overwrite:path" = "/"
     }
   }
   

2. 调整路由规则匹配后端根路径
   如果不需要保留/echo的API路径，直接修改路由的route_key为根路径，让请求直接转发到后端/：

   resource "aws_apigatewayv2_route" "get_echo" {
     api_id = aws_apigatewayv2_api.main.id
   
     route_key = "GET /"
     target    = "integrations/${aws_apigatewayv2_integration.eks.id}"
   }
   

前置验证步骤 #

先通过VPC内的资源直接访问NLB的DNS地址，确认http://NLB地址/能正常返回应用内容，排除后端服务本身的路径问题。

内容的提问来源于stack exchange，提问作者Vinasirajan Vilakshan