Digital Ocean Kubernetes环境中Nginx返回400 Bad Request求助

已配置域名 ticket.devaibhav.live，执行 ping ticket.devaibhav.live 可确认域名指向Digital Ocean负载均衡器的正确IP。集群尚未配置SSL，但访问 http://ticket.devaibhav.live 时始终返回400 Bad Request。

当前理解的流量路径：浏览器请求域名 → Digital Ocean负载均衡器 → Ingress-Nginx服务 → 按定义规则路由至对应后端服务。

相关配置 #

Ingress-Nginx服务配置 #

apiVersion: v1
kind: Service
metadata:
  annotations:
    service.beta.kubernetes.io/do-loadbalancer-enable-proxy-protocol: 'true'
    service.beta.kubernetes.io/do-loadbalancer-hostname: 'ticket.devaibhav.live'
  labels:
    helm.sh/chart: ingress-nginx-2.0.3
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/instance: ingress-nginx
    app.kubernetes.io/version: 0.32.0
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/component: controller
  name: ingress-nginx-controller
  namespace: ingress-nginx
spec:
  type: LoadBalancer
  externalTrafficPolicy: Local
  ports:
    - name: http
      port: 80
      protocol: TCP
      targetPort: http
    - name: https
      port: 443
      protocol: TCP
      targetPort: https
  selector:
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/instance: ingress-nginx
    app.kubernetes.io/component: controller

Ingress资源规则配置 #

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: ingress-service
  annotations:
    kubernetes.io/ingress.class: nginx
    nginx.ingress.kubernetes.io/use-regex: 'true'
spec:
  rules:
    - host: ticket.devaibhav.live
      http:
        paths:
          - path: /api/users/?(.*)
            pathType: Prefix
            backend:
              service:
                name: auth-srv
                port:
                  number: 3000
          - path: /api/tickets/?(.*)
            pathType: Prefix
            backend:
              service:
                name: tickets-srv
                port:
                  number: 3000
          - path: /api/orders/?(.*)
            pathType: Prefix
            backend:
              service:
                name: orders-srv
                port:
                  number: 3000
          - path: /api/payments/?(.*)
            pathType: Prefix
            backend:
              service:
                name: payments-srv
                port:
                  number: 3000
          - path: /?(.*)
            pathType: Prefix
            backend:
              service:
                name: client-srv
                port:
                  number: 3000

访问http://ticket.devaibhav.live时，请求应匹配最后一条规则路由至client-srv服务。

Client部署及服务配置 #

apiVersion: apps/v1
kind: Deployment
metadata:
  name: client-depl
spec:
  replicas: 1
  selector:
    matchLabels:
      app: client
  template:
    metadata:
      labels:
        app: client
    spec:
      containers:
        - name: client
          image: vaibhav908/client

---
apiVersion: v1
kind: Service
metadata:
  name: client-srv
spec:
  selector:
    app: client
  ports:
    - name: client
      protocol: TCP
      port: 3000
      targetPort: 3000

上述配置在Minikube开发环境中运行正常，但在Digital Ocean集群中出现问题，无法定位错误点。

集群命令输出 #

kubectl get services输出 #

NAME                   TYPE        CLUSTER-IP       EXTERNAL-IP   PORT(S)             AGE
client-srv             ClusterIP   10.245.100.25    <none>        3000/TCP            2d17h
and some other services

kubectl describe ingress输出 #

Name:             ingress-service
Labels:           <none>
Namespace:        default
Address:          ticket.devaibhav.live
Default backend:  default-http-backend:80 (<error: endpoints "default-http-backend" not found>)
Rules:
  Host                   Path  Backends
  ----                   ----  --------
  ticket.devaibhav.live  
                         /api/users/?(.*)      auth-srv:3000 (10.244.1.76:3000)
                         /api/tickets/?(.*)    tickets-srv:3000 (10.244.0.145:3000)
                         /api/orders/?(.*)     orders-srv:3000 (10.244.1.121:3000)
                         /api/payments/?(.*)   payments-srv:3000 (10.244.1.48:3000)
                         /?(.*)                client-srv:3000 (10.244.1.32:3000)
Annotations:             kubernetes.io/ingress.class: nginx
                         nginx.ingress.kubernetes.io/use-regex: true
Events:                  <none>

排查建议 #

1. 补全Proxy Protocol配置
   你已经在Ingress-Nginx Service中开启了Digital Ocean负载均衡器的Proxy Protocol，但Ingress-Nginx Controller本身未启用该协议的解析功能，导致请求格式不匹配，返回400错误。
   解决方法：

   • 若通过Helm安装Ingress-Nginx，执行以下命令更新配置：

     helm upgrade ingress-nginx ingress-nginx/ingress-nginx --namespace ingress-nginx --set controller.config.use-proxy-protocol=true
     

   • 或直接修改ingress-nginx命名空间下的ingress-nginx-controller ConfigMap，添加use-proxy-protocol: "true"字段。

2. 查看Ingress-Nginx Controller日志
   通过日志确认请求被拒绝的具体原因：

   kubectl logs -n ingress-nginx deployment/ingress-nginx-controller
   

   如果日志中出现client sent invalid request while reading client request line这类信息，即可确认是Proxy Protocol配置不匹配导致的问题。

3. 验证后端服务可用性
   在集群内部直接测试client-srv服务是否正常响应：

   kubectl run -it --rm test-pod --image=busybox -- wget -qO- http://client-srv.default.svc.cluster.local:3000
   

   若返回正常内容，说明服务本身无问题，问题出在Ingress或负载均衡器层面。

4. 简化Ingress路径规则
   尝试简化最后一条路径规则，避免正则表达式可能带来的匹配异常：

   - path: /
     pathType: Prefix
     backend:
       service:
         name: client-srv
         port:
           number: 3000
   

内容的提问来源于stack exchange，提问作者Vaibhav07