Kubernetes环境中Prefect Server UI无法连接API问题求助

问题背景 #

在Kubernetes环境中使用F5作为Ingress（初始计划用Nginx）部署Prefect Server，遇到以下问题：

• 初始状态：UI可正常访问，但页面提示无法连接API
• 调整后状态：API连接错误消失，但访问https://myhost.com/prefect/flow-runs等路径出现404

现有配置信息 #

初始Ingress映射 #

https://myhost.com/prefect/ -> http://localhost:3000/api

Prefect Server Deployment片段 #

...
      - image: <my registry>
        imagePullPolicy: Always
        name: prefect-server
        command: ["prefect", "server", "start", "--host", "0.0.0.0", "--log-level", "WARNING", "--port", "3000"]
        workingDir: /opt/prefect
        env:
          - name: PREFECT_UI_API_URL 
            value:  "http://localhost:3000/api"

Prefect Agent Deployment片段（可正常连接服务） #

...
      - image: <my registry>
        imagePullPolicy: Always
        name: prefect-agent
        command: ["prefect", "agent", "start", "--work-queue", "dev"]
        workingDir: /opt/prefect
        env:
          - name: PREFECT_API_URL 
            value:  "http://prefect-server.prefect.svc.cluster.local:3000/api" #WORKS

Service详情（kubectl describe service -n prefect输出） #

Name:              prefect-server
Namespace:         prefect
Labels:            app.kubernetes.io/managed-by=Helm
                   run=prefect-server
Annotations:       meta.helm.sh/release-name: prefect
                   meta.helm.sh/release-namespace: prefect
Selector:          run=prefect-server
Type:              ClusterIP
IP Family Policy:  SingleStack
IP Families:       IPv4
IP:                11.11.11.11 <redacted>
IPs:               11.11.11.11 <redacted>
Port:              <unset>  80/TCP
TargetPort:        3000/TCP
Endpoints:         11.22.22.22:3000 <redacted>
Session Affinity:  None
Events:            <none>

已尝试的PREFECT_UI_API_URL值 #

• "http://prefect-server.prefect.svc.cluster.local:3000/api"
• "https://myhost.com/prefect/api"
• "http://127.0.0.1:3000/api"

更新后的状态与新问题 #

调整配置后：

1. 修改PREFECT_UI_API_URL和Ingress规则，将Agent的API URL改为http://prefect-server.prefect.svc.cluster.local:3000/prefect/api，API连接错误消失
2. 新问题：访问https://myhost.com/prefect/flow-runs时返回404

更新后的Ingress详情（kubectl describe ingress -n prefect输出） #

Name:             prefect
Namespace:        prefect
Address:          X.X.X.50
Default backend:  default-http-backend:80 (<error: endpoints "default-http-backend" not found>)
TLS:
  /mysecret terminates 
Rules:
  Host                            Path  Backends
  ----                            ----  --------
  myhost.com  
                                  /prefect       prefect-server:80 (X.X.X.131:3000)
                                  /prefect/api   prefect-server:3000 (X.X.X.131:3000)
Annotations:                      field.cattle.io/publicEndpoints:
                                    [{"addresses":["X.X.X.50"],"port":80,"protocol":"HTTP","serviceName":"prefect:prefect-server","ingressName":"prefect:prefect","hostname"...
                                  ingress.kubernetes.io/secure-backends: true
                                  ingress.kubernetes.io/ssl-redirect: true
                                  kubernetes.io/ingress.class: f5
                                  meta.helm.sh/release-name: prefect
                                  meta.helm.sh/release-namespace: prefect
                                  virtual-server.f5.com/balance: round-robin
                                  
                                  virtual-server.f5.com/http-port: 443
                                  virtual-server.f5.com/ip: X.X.X.50
                                  virtual-server.f5.com/partition: kubernetes

当前Ingress.yml配置（Helm模板） #

{{- if .Values.ingress.enabled }}
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: prefect
  annotations:
{{- if eq .Values.ingress.class "f5" }}
    {{- if .Values.ingress.tls }}
    ingress.kubernetes.io/secure-backends: "true"
    {{- end }}
    {{- $f5healthpath := printf "%s%s" .Values.ingress.hostname .Values.ingress.path }}
    {{- $f5path := trimPrefix "/" .Values.ingress.path }}
    {{- $f5partition := .Values.ingress.f5partition }}
    {{- $f5httpport := .Values.ingress.f5httpport}}
    {{- $f5ip := .Values.ingress.f5ip }}
    {{- $f5ssl := .Values.ingress.f5ssl }}
    {{- $f5class:= .Values.ingress.class}}
    {{- range $key, $value := .Values.ingress.annotations }}
    {{ $key }}: {{ $value | replace "F5HEALTHPATH" $f5healthpath | replace "F5PATITION" $f5partition | replace "F5HTTPPORT" $f5httpport | replace "F5IP" $f5ip | replace "F5SSL" $f5ssl | replace "F5CLASS" $f5class | replace "F5PATH" $f5path | quote }}
    {{- end }}
{{- else }}
    kubernetes.io/ingress.class: nginx
    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
    nginx.ingress.kubernetes.io/rewrite-target: /$2
{{- end }}
spec:
  tls:
  - secretName: /mysecret
  rules:
  - host: "myhost.com"
    http:
      paths:
      - path: "/prefect"
        pathType: Prefix
        backend:
          serviceName: prefect-server
          servicePort: 80
      - path: "/prefect/api"
        pathType: Prefix
        backend:
          serviceName: prefect-server
          servicePort: 3000       
{{- end }}

问题推测 #

问题根源在于Ingress配置，需要确保所有Prefect Server的路径都带上/prefect/前缀，保证UI路由和API请求能正确映射到后端服务。

内容的提问来源于stack exchange，提问作者cozzymotto