GKE中Ingress-Nginx暴露SIP-UDP(5060)端口失败求助

环境：

• GKE集群版本：1.25.8-gke.500
• Ingress-Nginx通过Helm Chart 4.7.0安装
• 现状：80/443 HTTP端口暴露正常，SIP-TCP 5060端口可正常工作，但SIP-UDP 5060端口无法对外提供服务

相关配置 #

ArgoCD应用配置 #

sources:
  - repoURL: "https://kubernetes.github.io/ingress-nginx"
    chart: ingress-nginx
    targetRevision: 4.7.0

Helm配置值 #

# -- UDP service key-value pairs
udp:
  5060: "kamailio/lb-service:5060"

Ingress-Nginx Service状态 #

NAME                       TYPE           CLUSTER-IP     EXTERNAL-IP    PORT(S)                                     AGE
ingress-nginx-controller   LoadBalancer   10.40.12.112   XX.XX.XX.XX   80:32278/TCP,443:30585/TCP,5060:31380/UDP   15d

自动生成的GKE防火墙规则问题 #

自动创建的防火墙规则中，5060端口被错误配置为TCP：

k8s-fw-af50e8ac76ae44f13b3cf279afccfa67
Description{"kubernetes.io/service-name":"ingress-nginx/ingress-nginx-controller", "kubernetes.io/service-ip":"XX.XX.XX.XX"}
...
Protocols and ports
tcp:80
tcp:443
tcp:5060

手动添加UDP 5060端口后问题仍未解决。

后端SIP服务的Kubernetes Service #

apiVersion: v1
kind: Service
metadata:
  name: lb-service
spec:
  type: ClusterIP
  ports:
    - port: 5060
      protocol: UDP
      targetPort: 5060
    - port: 5060
      protocol: TCP
      targetPort: 5060
    - port: 5061
      protocol: TCP
      targetPort: 5061
  selector:
    # 对应后端Pod标签

UDP配置ConfigMap #

apiVersion: v1
kind: ConfigMap
metadata:
  name: ingress-nginx-udp
  namespace: ingress-nginx
data:
  '5060': 'kamailio/lb-service:5060'

Ingress-Nginx Service完整配置 #

apiVersion: v1
kind: Service
metadata:
  name: ingress-nginx-controller
  namespace: ingress-nginx
  labels:
    app.kubernetes.io/component: controller
    app.kubernetes.io/instance: ingress-nginx
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/part-of: ingress-nginx
    app.kubernetes.io/version: 1.8.0
    helm.sh/chart: ingress-nginx-4.7.0
spec:
  selector:
    app.kubernetes.io/component: controller
    app.kubernetes.io/instance: ingress-nginx
    app.kubernetes.io/name: ingress-nginx
  type: LoadBalancer
  ipFamilies:
    - IPv4
  ipFamilyPolicy: SingleStack
  loadBalancerIP: XX.XX.XXX.XXX
  ports:
    - appProtocol: http
      name: http
      port: 80
      protocol: TCP
      targetPort: http
    - appProtocol: https
      name: https
      port: 443
      protocol: TCP
      targetPort: https
    - name: 5060-udp
      port: 5060
      protocol: UDP
      targetPort: 5060-udp

Ingress-Nginx Deployment完整配置 #

apiVersion: apps/v1
kind: Deployment
metadata:
  name: ingress-nginx-controller
  namespace: ingress-nginx
  labels:
    app.kubernetes.io/component: controller
    app.kubernetes.io/instance: ingress-nginx
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/part-of: ingress-nginx
    app.kubernetes.io/version: 1.8.0
    helm.sh/chart: ingress-nginx-4.7.0
spec:
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/component: controller
      app.kubernetes.io/instance: ingress-nginx
      app.kubernetes.io/name: ingress-nginx
  template:
    metadata:
      labels:
        app.kubernetes.io/component: controller
        app.kubernetes.io/instance: ingress-nginx
        app.kubernetes.io/managed-by: Helm
        app.kubernetes.io/name: ingress-nginx
        app.kubernetes.io/part-of: ingress-nginx
        app.kubernetes.io/version: 1.8.0
        helm.sh/chart: ingress-nginx-4.7.0
    spec:
      containers:
        - name: controller
          image: registry.k8s.io/ingress-nginx/controller:v1.8.0@sha256:744ae2afd433a395eeb13dc03d3313facba92e96ad71d9feaafc85925493fee3
          args:
            - /nginx-ingress-controller
            - '--publish-service=$(POD_NAMESPACE)/ingress-nginx-controller'
            - '--election-id=ingress-nginx-leader'
            - '--controller-class=k8s.io/ingress-nginx'
            - '--ingress-class=nginx'
            - '--configmap=$(POD_NAMESPACE)/ingress-nginx-controller'
            - '--udp-services-configmap=$(POD_NAMESPACE)/ingress-nginx-udp'
            - '--validating-webhook=:8443'
            - '--validating-webhook-certificate=/usr/local/certificates/cert'
            - '--validating-webhook-key=/usr/local/certificates/key'
          env:
            - name: POD_NAME
              valueFrom:
                fieldRef:
                  fieldPath: metadata.name
            - name: POD_NAMESPACE
              valueFrom:
                fieldRef:
                  fieldPath: metadata.namespace
            - name: LD_PRELOAD
              value: /usr/local/lib/libmimalloc.so
          ports:
            - containerPort: 80
              name: http
              protocol: TCP
            - containerPort: 443
              name: https
              protocol: TCP
            - containerPort: 8443
              name: webhook
              protocol: TCP
            - containerPort: 5060
              name: 5060-udp
              protocol: UDP
          livenessProbe:
            failureThreshold: 5
            httpGet:
              path: /healthz
              port: 10254
              scheme: HTTP
            initialDelaySeconds: 10
            periodSeconds: 10
            successThreshold: 1
            timeoutSeconds: 1
          lifecycle:
            preStop:
              exec:
                command:
                  - /wait-shutdown

排查方向 #

• 检查Nginx配置生成情况：进入Ingress-Nginx Pod，查看/etc/nginx/nginx.conf文件，确认是否存在UDP监听块：

  server {
      listen 5060 udp;
      proxy_pass kamailio/lb-service:5060;
  }
  

  如果没有该块，说明ConfigMap配置未被正确加载。

• 验证Pod内UDP端口监听：在Ingress-Nginx Pod中执行ss -ulnp，确认5060 UDP端口是否被nginx-ingress-controller进程监听。

• 测试Pod到后端服务的UDP连通性：在Ingress-Nginx Pod内使用nc -u <lb-service-cluster-ip> 5060发送测试UDP包，检查后端是否响应；或用tshark在Pod内抓包，确认UDP流量是否到达后端服务。

• 检查GKE LoadBalancer的UDP转发状态：登录GCP控制台，查看对应LoadBalancer的转发规则，确认UDP 5060端口的转发是否正常；同时检查健康检查配置（Ingress-Nginx UDP端口默认无健康检查，若GKE LB要求健康检查，需手动添加UDP类型的健康检查）。

• 查看Ingress-Nginx控制器日志：执行kubectl logs -n ingress-nginx <ingress-nginx-controller-pod-name>，搜索UDP相关日志，排查是否存在端口绑定失败、后端服务解析错误等问题。

• 确认端口命名一致性：检查Service和Deployment中UDP端口的name字段（均为5060-udp）是否一致，确保流量能正确转发到容器端口。

内容的提问来源于stack exchange，提问作者Stefan Walther