在EKS上用ALB Controller部署Traefik后，仪表盘404且健康检查失败

我正尝试在AWS EKS集群中借助LoadBalancer Controller部署Traefik，以下是我的配置和遇到的问题：

Helm Values配置（helm-values.yml） #

ingressClass:
  enabled: true
  isDefaultClass: true
ingressRoute:
  dashboard:
    enabled: false
service:
  enabled: true
  type: NodePort
globalArguments:
  - "--api.insecure=true"

部署命令 #

helm install traefik traefik/traefik --create-namespace --namespace=traefik --values=helm-values.yaml

仪表盘部署配置（dashboard.yml） #

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  namespace: traefik
  name: traefik-ingress
  annotations:
    kubernetes.io/ingress.class: alb
    alb.ingress.kubernetes.io/scheme: internet-facing
    alb.ingress.kubernetes.io/target-type: instance
spec:
  rules:
    - http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: traefik
                port:
                  number: 80
---
apiVersion: v1
kind: Secret
metadata:
  name: basic-auth-creds
  namespace: traefik
type: kubernetes.io/basic-auth
stringData:
  username: test
  password: password
---
apiVersion: traefik.containo.us/v1alpha1
kind: Middleware
metadata:
  name: basic-auth
  namespace: traefik
spec:
  basicAuth:
    secret: basic-auth-creds
---
apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
  name: dashboard
  namespace: traefik
spec:
  entryPoints:
    - web
  routes:
    - match: PathPrefix(`/dashboard`, `/dashboard/`) || PathPrefix(`/api`, `/api/`)
      kind: Rule
      services:
        - name: api@internal
          kind: TraefikService
      middlewares:
        - name: basic-auth
          namespace: traefik

遇到的问题 #

部署完成后，Application Load Balancer（ALB）已创建，但健康检查失败，访问http://myalbdnsname/dashboard时出现404 page not found错误。

1. ALB健康检查路径未配置，导致检测失败 #

ALB默认会检查Traefik Service 80端口的根路径/，但Traefik的web入口点（对应80端口）在没有匹配路由的情况下，访问/会返回404，直接导致健康检查不通过。

解决方法：
给Ingress添加健康检查注解，指定Traefik内置的健康检查端点/ping（该路径默认开启，无需额外配置）：

# 在traefik-ingress的metadata.annotations中添加以下内容
alb.ingress.kubernetes.io/healthcheck-path: /ping
alb.ingress.kubernetes.io/healthcheck-port: "80"
# 可选：调整健康检查的间隔和超时参数
alb.ingress.kubernetes.io/healthcheck-interval-seconds: "10"
alb.ingress.kubernetes.io/healthcheck-timeout-seconds: "5"

2. 验证Traefik路由规则是否生效 #

当前IngressRoute已经配置了/dashboard和/api的路由，但需要确保Traefik Pod正确加载了该规则：

• 查看Traefik Pod日志确认路由是否被解析：kubectl logs -n traefik <traefik-pod-name>
• 确认Traefik的--api.insecure=true参数已生效，该参数会直接暴露仪表盘接口，配合IngressRoute的规则即可访问

3. 修复后的Ingress配置示例 #

修改后的traefik-ingress部分完整代码：

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  namespace: traefik
  name: traefik-ingress
  annotations:
    kubernetes.io/ingress.class: alb
    alb.ingress.kubernetes.io/scheme: internet-facing
    alb.ingress.kubernetes.io/target-type: instance
    alb.ingress.kubernetes.io/healthcheck-path: /ping
    alb.ingress.kubernetes.io/healthcheck-port: "80"
spec:
  rules:
    - http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: traefik
                port:
                  number: 80

4. 验证步骤 #

1. 应用修改后的配置：kubectl apply -f dashboard.yml
2. 等待ALB更新健康检查配置，在AWS控制台查看ALB的健康检查状态是否变为正常
3. 访问http://myalbdnsname/dashboard，此时会弹出基本认证窗口，输入test/password即可访问仪表盘

内容的提问来源于stack exchange，提问作者Asdfg