Amazon EKS部署服务无法通过NGINX Ingress访问，出现404错误

集群状态详情 #

执行kubectl get all输出：

NAME                                            READY   STATUS    RESTARTS   AGE
pod/feed-4fqdrrf-fwcc3                          1/1     Running   0          64m
pod/gst-7adn3njl-fg43                           1/1     Running   0          71m
pod/ingress-nginx-controller-f567efvef-f653dc   1/1     Running   0          9d
pod/app-24dfs2d-m2fdqw                          1/1     Running   0          66m

NAME                                         TYPE           CLUSTER-IP       EXTERNAL-IP                                        PORT(S)                      AGE
service/feed                                 NodePort       10.100.24.643    <none>                                             8082:30002/TCP               64m
service/gst                                  NodePort       10.100.54.543    <none>                                             8081:30004/TCP               71m
service/ingress-nginx-controller             LoadBalancer   10.100.643.256   ******************.<region>.elb.amazonaws.com      80:30622/TCP,443:30721/TCP   9d
service/ingress-nginx-controller-admission   ClusterIP      10.100.654.542   <none>                                             443/TCP                      9d
service/kubernetes                           ClusterIP      10.100.0.7       <none>                                             443/TCP                      14d
service/app                                  NodePort       10.100.456.34    <none>                                             3001:30003/TCP               66m

NAME                                       READY   UP-TO-DATE   AVAILABLE   AGE
deployment.apps/feed                       1/1     1            1           64m
deployment.apps/gst                        1/1     1            1           71m
deployment.apps/ingress-nginx-controller   1/1     1            1           9d
deployment.apps/app                        1/1     1            1           66m

NAME                                                  DESIRED   CURRENT   READY   AGE
replicaset.apps/feed-4fqdrrf                         1         1         1       64m
replicaset.apps/gst-7adn3njl                         1         1         1       71m
replicaset.apps/ingress-nginx-controller-f567efvef   1         1         1       9d
replicaset.apps/app-m2fdqw                           1         1         1       66m

Pod日志信息：

kubectl logs feed-4fqdrrf-fwcc3 
helloworld: listening on port 8082
~ % kubectl logs gst-7adn3njl-fg43
helloworld: listening on port 8081
~ % kubectl logs app-24dfs2d-m2fdqw 
helloworld: listening on port 3001

Deployment与Service配置（以feed为例） #

apiVersion: apps/v1
kind: Deployment
metadata:
  name: feed
  labels:
    app: feed
spec:
  selector:
    matchLabels:
      app: feed
  template:
    metadata:
      labels:
        app: feed
    spec:
      containers:
      - name: feed-container
        image: **************.dkr.ecr.******.amazonaws.com/feed:latest
        ports:
        - containerPort: 8082

---
apiVersion: v1
kind: Service
metadata:
  name: feed
spec:
  ports:
  - port: 8082 
    protocol: TCP
    targetPort: 8082
  selector:
    app: feed
  type: NodePort

注：gst、app服务配置模式与feed一致

Ingress配置 #

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: my-ingress
  annotations:
    kubernetes.io/ingress.class: nginx
    nginx.ingress.kubernetes.io/rewrite-target: /
    nginx.ingress.kubernetes.io/enable-websocket: "true"
    nginx.org/websocket-services: app
    nginx.ingress.kubernetes.io/use-regex: "true"
spec:
  ingressClassName: nginx
  rules:
    - http:
        paths:
          - path: /feed
            pathType: Prefix
            backend:
              service:
                name: expertfeed
                port:
                  number: 8082
          - path: /app
            pathType: Prefix
            backend:
              service:
                name: wehealapp
                port:
                  number: 3001
          - path: /socket.io/app
            pathType: Prefix
            backend:
              service:
                name: app
                port:
                  number: 3001
          - path: /gst
            pathType: Prefix
            backend:
              service:
                name: gst
                port:
                  number: 8001

Node服务代码示例 #

app.get('/getrequest1', jsonParser, async (request, response) => {
    // 业务代码
})
app.get('/getrequest2', jsonParser, async (request, response) => {
    // 业务代码
})
// ...其他接口
const port = process.env.PORT || 8082;
app.listen(port, () => {
    console.log(`helloworld: listening on port ${port}`);
});

注：三个服务均采用此配置模式

问题现象 #

• 直接访问ELB地址******************.elb.amazonaws.com，返回NGINX 404 Not Found
• 访问******************.elb.amazonaws.com/feed，提示Cannot GET /
• 访问******************.elb.amazonaws.com/feed/getrequest1，同样返回上述错误

排查与修复步骤 #

1. 修正Ingress服务名称匹配错误 #

从集群状态可见，feed服务实际名称为feed，但Ingress规则中写的是expertfeed；app服务实际名称为app，Ingress中写的是wehealapp。名称不匹配会导致Ingress无法找到后端服务，直接返回404。

修改Ingress对应路径的服务名称：

# 修正feed路径
- path: /feed
  pathType: Prefix
  backend:
    service:
      name: feed  # 原expertfeed改为feed
      port:
        number: 8082
# 修正app路径
- path: /app
  pathType: Prefix
  backend:
    service:
      name: app  # 原wehealapp改为app
      port:
        number: 3001

2. 修正GST服务端口错误 #

集群中GST Service的端口为8081，但Ingress规则中写的是8001，端口不匹配会导致流量无法正确转发。修改为：

- path: /gst
  pathType: Prefix
  backend:
    service:
      name: gst
      port:
        number: 8081  # 原8001改为8081

3. 调整路径重写规则 #

当前配置nginx.ingress.kubernetes.io/rewrite-target: /和use-regex: "true"，但使用Prefix类型路径时，会丢弃/feed后的所有路径后缀。比如访问/feed/getrequest1会被重写为/，而你的服务未配置根路径GET接口，因此返回Cannot GET /。

调整为正则路径并重写保留后缀：

• 将路径改为/feed(/|$)(.*)，路径类型设为ImplementationSpecific
• 保持nginx.ingress.kubernetes.io/rewrite-target: /$2注解

示例修改：

- path: /feed(/|$)(.*)
  pathType: ImplementationSpecific
  backend:
    service:
      name: feed
      port:
        number: 8082

4. 补充根路径配置（可选） #

若需要访问ELB根路径/返回内容，需在Ingress中添加对应路径规则，指向某个服务的根接口，或配置默认后端。

5. 验证配置生效 #

修改Ingress后执行更新：

kubectl apply -f ingress.yaml

查看Ingress状态确认规则应用：

kubectl describe ingress my-ingress

内容的提问来源于stack exchange，提问作者Ashu Upadhyay