ASP.NET Core 6 Web API+AKS+应用网关联动故障求助

问题背景 #

• 所有容器本地测试正常
• CI/CD流程配置正确
• 核心服务：Angular 13前端（已通过应用网关Ingress+TLS正常访问）、ASP.NET Core 6 Web API
• API Pod运行正常，改为LoadBalancer类型+静态IP可外部访问，但通过应用网关Ingress无法访问
• kubectl logs未发现Pod报错，怀疑Ingress配置存在问题

相关配置 #

1. Ingress配置 #

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: api-ingress
  namespace: test
  annotations:
    kubernetes.io/ingress.class: azure/application-gateway
spec:
  rules:
  - host: "testapi.url.ca"
    http:
      paths:
      - pathType: Prefix
        path: /
        backend:
          service:
            name: api-svc
            port:
              number: 80
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: test-ingress
  namespace: test
  annotations:
    kubernetes.io/ingress.class: azure/application-gateway
    appgw.ingress.kubernetes.io/ssl-redirect: "true"
spec:
  tls:
    - secretName: url-tls
      hosts:
        - test.url.ca
        - test.url.com
  rules:
  - host: "test.url.ca"
    http:
      paths:
      - pathType: Prefix
        path: /
        backend:
          service:
            name: web-svc
            port:
              number: 80

2. API服务配置 #

apiVersion: v1
kind: Service
metadata:
  name: api-svc
  namespace: test
spec:
  selector:
    app: api
  ports:
  - name: regular
    port: 80
    targetPort: 80
    protocol: TCP

3. Docker镜像构建文件 #

FROM mcr.microsoft.com/dotnet/aspnet:6.0 AS base
WORKDIR /app
EXPOSE 80/tcp
EXPOSE 443/tcp

FROM mcr.microsoft.com/dotnet/sdk:6.0 AS build
WORKDIR /src

COPY ./Lib/Contract ./Lib/Contract
COPY ./Lib/Framework ./Lib/Framework
COPY ./Output/Api ./Output/Api

WORKDIR /src/Output/Api
RUN dotnet restore Api.csproj --disable-parallel
RUN dotnet build Api.csproj --no-restore -c Release

FROM build AS publish
RUN dotnet publish Api.csproj --no-restore --no-build -c Release -o /app

FROM base AS final
WORKDIR /app
COPY --from=publish /app/SensitiveData/localhost1.pfx /https/localhost1.pfx
COPY --from=publish /app .

RUN ls -l /app

ENTRYPOINT ["dotnet", "Api.dll"]

排查与解决方案 #

1. 验证Ingress与应用网关同步状态 #

执行kubectl get ingress api-ingress -n test查看Ingress状态，确认ADDRESS字段是否填充应用网关的IP/域名。若未填充，检查：

• 应用网关Ingress Controller是否正确部署到AKS集群
• 集群与应用网关的Managed Identity权限配置是否正常

2. 测试集群内部API服务连通性 #

在集群内启动临时容器测试API服务可达性：

kubectl run -it --rm --image=curlimages/curl test-curl -n test
# 进入容器后执行
curl http://api-svc/[你的API测试路径]

若能正常返回数据，说明服务本身无问题，问题出在Ingress转发环节。

3. 调整Ingress配置的潜在问题 #

（1）补充API的TLS配置

前端Ingress已配置TLS，API的Ingress缺失可能导致应用网关路由规则冲突。若testapi.url.ca的证书已在url-tls Secret中，为API的Ingress添加TLS配置：

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: api-ingress
  namespace: test
  annotations:
    kubernetes.io/ingress.class: azure/application-gateway
    appgw.ingress.kubernetes.io/ssl-redirect: "true"
spec:
  tls:
    - secretName: url-tls
      hosts:
        - testapi.url.ca
  rules:
  - host: "testapi.url.ca"
    http:
      paths:
      - pathType: Prefix
        path: /
        backend:
          service:
            name: api-svc
            port:
              number: 80

（2）匹配API路由前缀

若ASP.NET Core API的路由前缀为/api，调整Ingress的路径配置：

paths:
- pathType: ImplementationSpecific
  path: /api/*
  backend:
    service:
      name: api-svc
      port:
        number: 80

（3）配置健康探针

应用网关依赖健康探针判断后端服务状态，若API根路径/未返回200状态码，添加健康检查配置：

metadata:
  annotations:
    appgw.ingress.kubernetes.io/probe-path: "/health"
    appgw.ingress.kubernetes.io/probe-protocol: "Http"
    appgw.ingress.kubernetes.io/probe-port: "80"

同时确保API项目中已实现/health健康检查接口。

4. 查看应用网关日志 #

检查应用网关的访问日志和诊断日志，确认请求是否到达网关、是否存在转发错误（如404、502状态码），定位具体转发问题。

内容的提问来源于stack exchange，提问作者Mehdi Benadada