GKE配置Nginx Ingress gRPC应用遇Missing :te header错误

问题重现 #

在GKE中配置Nginx Ingress gRPC应用时，添加nginx.ingress.kubernetes.io/backend-protocol: "GRPC"注解后，客户端收到如下错误：

grpc._channel._InactiveRpcError: <_InactiveRpcError of RPC that terminated with:
    status = StatusCode.UNKNOWN
    details = "Missing :te header"
    debug_error_string = "UNKNOWN:Error received from peer ipv4:34.149.11.89:443 {created_time:"2023-01-28T12:32:39.285586-08:00", grpc_status:2, grpc_message:"Missing :te header"}"

解决方案 #

1. 补充Ingress关键注解 #

gRPC依赖HTTP/2协议且必须通过HTTPS传输，需在Ingress资源中添加以下注解：

• nginx.ingress.kubernetes.io/enable-http2: "true"：启用HTTP/2支持，确保gRPC协议正常传输
• nginx.ingress.kubernetes.io/ssl-redirect: "true"：强制所有请求跳转到HTTPS，避免HTTP请求导致的协议不兼容

完整Ingress配置示例：

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: grpc-ingress
  annotations:
    nginx.ingress.kubernetes.io/backend-protocol: "GRPC"
    nginx.ingress.kubernetes.io/enable-http2: "true"
    nginx.ingress.kubernetes.io/ssl-redirect: "true"
spec:
  tls:
  - hosts:
    - your-grpc-domain.com
    secretName: your-tls-secret
  rules:
  - host: your-grpc-domain.com
    http:
      paths:
      - path: /your.grpc.ServiceName/*
        pathType: Prefix
        backend:
          service:
            name: grpc-service
            port:
              number: 50051

2. 替换为官方Ingress Controller #

GKE原生Ingress对gRPC支持有限，需使用kubernetes/ingress-nginx官方控制器部署。确保集群中运行的是官方适配GKE环境的控制器版本，而非GKE默认Ingress组件。

3. 验证客户端请求配置 #

确认gRPC客户端使用HTTPS协议发起请求，避免使用HTTP。以Python客户端为例：

import grpc
from your_proto import service_pb2, service_pb2_grpc

def run():
    # 必须使用HTTPS通道
    with grpc.secure_channel('your-grpc-domain.com:443', grpc.ssl_channel_credentials()) as channel:
        stub = service_pb2_grpc.YourServiceStub(channel)
        response = stub.YourMethod(service_pb2.YourRequest())
        print("Response received: " + response.message)

if __name__ == '__main__':
    run()

4. 检查Ingress Controller日志 #

通过控制器日志验证gRPC配置是否生效：

kubectl logs -n ingress-nginx -l app.kubernetes.io/name=ingress-nginx

查找包含grpc_pass的日志条目，确认后端协议已正确配置为gRPC。

内容的提问来源于stack exchange，提问作者s_curry_s