EKS ALB暴露Kubernetes Dashboard遇HTTP请求转HTTPS服务器错误排查

问题场景 #

按照AWS配置指南将Kubernetes Dashboard通过ALB暴露，域名xyz.com已映射到ALB，但浏览器访问时收到错误：Client sent an HTTP request to an HTTPS server，使用的YAML配置如下：

---
kind: Service
apiVersion: v1
metadata:
  labels:
    k8s-app: kubernetes-dashboard
  name: kubernetes-dashboard
  namespace: kubernetes-dashboard
spec:
  ports:
    - port: 443
      targetPort: 8443
  selector:
    k8s-app: kubernetes-dashboard
  type: NodePort
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: "kubernetes-dashboard"
  namespace: "kubernetes-dashboard"
  annotations:
    alb.ingress.kubernetes.io/scheme: internet-facing
    alb.ingress.kubernetes.io/certificate-arn: arn:aws:acm:us-east-1:xxxx:certificate/xxx-xxx-xxx-xxx-xxxx
    alb.ingress.kubernetes.io/healthcheck-path: /dashboard/
    alb.ingress.kubernetes.io/listen-ports: '[{"HTTP": 80}, {"HTTPS":443}]'
    alb.ingress.kubernetes.io/actions.ssl-redirect: '{"Type": "redirect", "RedirectConfig": { "Protocol": "HTTPS", "Port": "443", "StatusCode": "HTTP_301"}}'
  labels:
    app: dashboard
spec:
  ingressClassName: alb
  rules:
  - http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: ssl-redirect
            port:
              name: use-annotation
      - path: /
        pathType: Prefix
        backend:
          service:
            name: "kubernetes-dashboard"
            port:
              number: 443
---

问题根源 #

AWS ALB默认会以HTTP协议向后端Kubernetes Service发送请求，但你的配置中：

• Dashboard的Pod监听的是HTTPS端口8443
• Service将端口443转发到Pod的8443端口（HTTPS）

当ALB用HTTP协议请求后端Service的443端口时，Pod的HTTPS服务器收到HTTP请求，就会抛出Client sent an HTTP request to an HTTPS server错误。

另外，你的Ingress路径配置存在冗余：两个相同的path: /前缀规则，可能导致请求匹配逻辑混乱，但这不是当前报错的直接原因。

修复方案 #

方案一：配置ALB使用HTTPS与后端通信（推荐） #

在Ingress的metadata.annotations中添加alb.ingress.kubernetes.io/backend-protocol: HTTPS，让ALB以HTTPS协议向后端Service发送请求，与Pod的HTTPS端口匹配。

修改后的Ingress配置片段：

metadata:
  name: "kubernetes-dashboard"
  namespace: "kubernetes-dashboard"
  annotations:
    alb.ingress.kubernetes.io/scheme: internet-facing
    alb.ingress.kubernetes.io/certificate-arn: arn:aws:acm:us-east-1:xxxx:certificate/xxx-xxx-xxx-xxx-xxxx
    alb.ingress.kubernetes.io/healthcheck-path: /dashboard/
    alb.ingress.kubernetes.io/listen-ports: '[{"HTTP": 80}, {"HTTPS":443}]'
    alb.ingress.kubernetes.io/actions.ssl-redirect: '{"Type": "redirect", "RedirectConfig": { "Protocol": "HTTPS", "Port": "443", "StatusCode": "HTTP_301"}}'
    # 添加以下注解，指定后端协议为HTTPS
    alb.ingress.kubernetes.io/backend-protocol: HTTPS

方案二：优化Ingress路径规则（可选） #

将Dashboard的路径改为更具体的前缀（比如/dashboard/*），避免与ssl-redirect的路径冲突，同时保持功能正常：

spec:
  ingressClassName: alb
  rules:
  - http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: ssl-redirect
            port:
              name: use-annotation
      - path: /dashboard/*
        pathType: Prefix
        backend:
          service:
            name: "kubernetes-dashboard"
            port:
              number: 443

验证步骤 #

1. 应用修改后的配置：

kubectl apply -f your-dashboard-config.yaml

2. 等待ALB配置更新（通常需要1-2分钟）
3. 重新访问xyz.com，验证错误是否消失

内容的提问来源于stack exchange，提问作者Jacob Phan