单ALB Ingress控制器下多服务配置不同健康检查路径的方法

我部署了单个ALB作为Ingress控制器，运行约10个服务，希望为每个服务的目标组设置不同的健康检查路径，该怎么操作？

我尝试过如下配置：

"alb.ingress.kubernetes.io/target-group-attributes" = "frontend-auth_healthcheck_path=/auth/abcd|frontend-leads_healthcheck_path=/leads/abcd|email-marketing_list_healthcheck_path=/list/abcd"

出现如下错误：

Warning  FailedDeployModel  11m  ingress  Failed deploy model due to ValidationError: 1 validation error detected: Value 'frontend-auth_healthcheck-path' at 'attributes.1.member.key' failed to satisfy constraint: Member must satisfy regular expression pattern: ^[a-zA-Z0-9._]+$
           status code: 400, request id: e4d21447-6028-4298-ab4c-30e6e91fbe53

之后我又尝试了如下配置：

"alb.ingress.kubernetes.io/target-group-attributes" = "frontend_auth_healthcheck_path=/auth/abcd|frontend_leads_healthcheck_path=/leads/abcd|email_marketing_list_healthcheck_path=/list/abcd"

出现如下错误：

Warning  FailedDeployModel  2m28s  ingress  Failed deploy model due to ValidationError: Target group attribute key 'frontend_auth_healthcheck_path' is not recognized
           status code: 400, request id: aa6b55cb-e931-4ddc-8933-7dbdceb45063

问题原因 #

你之前的配置思路错误：alb.ingress.kubernetes.io/target-group-attributes仅用于配置AWS TargetGroup的通用系统属性（比如连接超时、粘性会话开关等），这些属性的key必须符合AWS官方定义的规范，不能自定义带服务名前缀的key，因此会触发属性不识别或格式验证失败的错误。

正确配置方案 #

要为每个服务的目标组单独设置健康检查路径，推荐以下两种方法：

方法1：通过Ingress注解为每个服务绑定健康检查配置

使用alb.ingress.kubernetes.io/target-group-annotations注解，针对每个服务的目标组单独指定健康检查路径。示例配置如下：

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: multi-service-ingress
  annotations:
    alb.ingress.kubernetes.io/scheme: internet-facing
    alb.ingress.kubernetes.io/ingress-class: alb
    # 为每个服务的目标组配置健康检查路径
    alb.ingress.kubernetes.io/target-group-annotations: |
      service.frontend-auth: |
        alb.ingress.kubernetes.io/healthcheck-path: /auth/abcd
      service.frontend-leads: |
        alb.ingress.kubernetes.io/healthcheck-path: /leads/abcd
      service.email-marketing-list: |
        alb.ingress.kubernetes.io/healthcheck-path: /list/abcd
spec:
  rules:
    - http:
        paths:
          - path: /auth/*
            pathType: Prefix
            backend:
              service:
                name: frontend-auth
                port:
                  number: 80
          - path: /leads/*
            pathType: Prefix
            backend:
              service:
                name: frontend-leads
                port:
                  number: 80
          - path: /list/*
            pathType: Prefix
            backend:
              service:
                name: email-marketing-list
                port:
                  number: 80

这个注解会为每个服务对应的TargetGroup自动注入健康检查路径配置，无需手动创建TargetGroup。

方法2：手动创建TargetGroup并绑定到服务

如果需要更精细的健康检查控制（比如调整超时时间、HTTP方法等），可以先在AWS控制台或CLI中为每个服务创建TargetGroup，配置好对应的健康检查路径，然后通过Ingress注解绑定到服务：

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: multi-service-ingress
  annotations:
    alb.ingress.kubernetes.io/scheme: internet-facing
    alb.ingress.kubernetes.io/ingress-class: alb
    # 绑定预先创建的TargetGroup ARN
    alb.ingress.kubernetes.io/target-group-name: |
      service.frontend-auth: arn:aws:elasticloadbalancing:us-west-2:123456789012:targetgroup/frontend-auth-tg/abc123
      service.frontend-leads: arn:aws:elasticloadbalancing:us-west-2:123456789012:targetgroup/frontend-leads-tg/def456
      service.email-marketing-list: arn:aws:elasticloadbalancing:us-west-2:123456789012:targetgroup/email-marketing-list-tg/ghi789
spec:
  rules:
    - http:
        paths:
          - path: /auth/*
            pathType: Prefix
            backend:
              service:
                name: frontend-auth
                port:
                  number: 80
          # 其他服务路径配置...

内容的提问来源于stack exchange，提问作者Rishabh Singhal