GKE Autopilot部署Django后端遇501错误，请求排查方案

使用GKE Autopilot部署Nuxt前端与Django后端，已搭建GitHub到GKE的CI/CD流水线。前端可在xpresstracker.app正常访问，但后端域名backend.xpresstracker.app返回501服务器错误。

错误信息 #

相关配置文件 #

prodservice.yaml #

apiVersion: v1
kind: Service
metadata:
  name: prod-xpressbackend-service
spec:
  selector:
    app: prod-xpressbackend
  ports:
    - protocol: TCP
      port: 8000
      targetPort: 8000
  type: NodePort

prodmanagedcert.yaml #

apiVersion: networking.gke.io/v1
kind: ManagedCertificate
metadata:
  name: prod-managed-cert
spec:
  domains:
    - xpresstracker.app
    - backend.xpresstracker.app

prodingress.yaml #

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: prod-ingress
  annotations:
    kubernetes.io/ingress.global-static-ip-name: xpresstrackerip
    networking.gke.io/managed-certificates: prod-managed-cert
    kubernetes.io/ingress.class: "gce"
  labels:
    app: prod-xpressbackend
spec:
  rules:
    - host: xpresstracker.app
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: prod-xpressfrontend-service
                port:
                  number: 3000
    - host: backend.xpresstracker.app
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: prod-xpressbackend-service
                port:
                  number: 8000

Deployment.yaml #

apiVersion: apps/v1
kind: Deployment
metadata:
  name: prod-xpressbackend-deployment
  labels:
    app: prod-xpressbackend
spec:
  replicas: 1
  selector:
    matchLabels:
      app: prod-xpressbackend
  template:
    metadata:
      labels:
        app: prod-xpressbackend
    spec:
      containers:
        - name: prod-xpressbackend-container
          image: someimage:production
          imagePullPolicy: Always
          resources:
            requests:
              memory: "200Mi"
              cpu:    "0.2"
            limits:
              memory: "512Mi"
              cpu:    "0.5"
          ports:
            - containerPort: 8000
          env:
            - name: SECRET_KEY
              valueFrom:
                secretKeyRef:
                  name: proddatabasecredentials
                  key: SECRET_KEY
            - name: DB_ENGINE
              valueFrom:
                secretKeyRef:
                  name: proddatabasecredentials
                  key: DB_ENGINE
            - name: DB_NAME
              valueFrom:
                secretKeyRef:
                  name: proddatabasecredentials
                  key: DB_NAME
            - name: DB_USER
              valueFrom:
                secretKeyRef:
                  name: proddatabasecredentials
                  key: DB_USER
            - name: DB_PASS     
              valueFrom:
                  secretKeyRef:
                    name: proddatabasecredentials
                    key: DB_PASS
            - name: DB_HOST
              valueFrom:
                secretKeyRef:
                  name: proddatabasecredentials
                  key: DB_HOST
            - name: DB_PORT
              valueFrom:
                secretKeyRef:
                  name: proddatabasecredentials
                  key: DB_PORT
            - name: DEBUG
              valueFrom:
                secretKeyRef:
                  name: proddatabasecredentials
                  key: DEBUG
        - name: cloud-sql-proxy
          image: gcr.io/cloud-sql-connectors/cloud-sql-proxy:latest
          args:
            - "--port=5432"
            - "some database"
            - "--credentials-file=/secrets/service_account.json"
          securityContext:
            runAsNonRoot: true
          volumeMounts:
          - name: sqlconnect
            mountPath: /secrets/
            readOnly: true
          resources:
            requests:
              memory: "200Mi"
              cpu:    "0.2"
            limits:
              memory: "200Mi"
              cpu:    "0.2"
      volumes:
      - name: sqlconnect
        secret:
          secretName: sqlcredentials

已尝试的排查措施 #

• 添加防火墙规则：创建名为fw-allow-health-checks的规则，优先级100，IP范围包含35.191.0.0/16、130.211.0.0/22及0.0.0.0/0，允许所有协议和端口，问题未解决。
• 确保后端返回200响应：在Django的view.py和urls.py中配置根路径返回200状态码：
  view.py片段：

  from django.http import HttpResponse
  
  def root_view(request):
      return HttpResponse(status=200)
  

  urls.py片段：

  from .views import root_view
  
  urlpatterns = [
     path('', root_view, name='root'),
  

• 重新部署资源：删除并重新部署所有资源，问题仍存在。

内容的提问来源于stack exchange，提问作者Abel Moremi