在GKE中使用ingress-nginx暴露UDP服务失败的排查求助

我需要关于在Google Kubernetes Engine（GKE）中使用ingress-nginx控制器暴露UDP服务的指导。按照官方文档通过ConfigMap方法在本地minikube上部署时可正常访问，但部署到GKE后，通过ingress控制器服务的IP无法访问该UDP服务。

已确认的配置信息 #

控制器端口映射 #

我确认控制器的端口（1053和15353）已正确映射：

NAMESPACE       NAME                                 TYPE           CLUSTER-IP      EXTERNAL-IP     PORT(S)                                                     AGE
ingress-nginx   ingress-nginx-controller             LoadBalancer   10.51.252.115   <redacted>      80:32307/TCP,443:30514/TCP,1053:32764/UDP,15353:31385/UDP   54d

集群与防火墙配置 #

集群是通过google_container_cluster Terraform模块默认配置创建的，控制器处理HTTPS流量正常。我注意到自动生成的防火墙规则仅允许指定端口的TCP流量，而非UDP，手动添加UDP防火墙规则后问题仍未解决：

NAME                                          NETWORK                        DIRECTION  PRIORITY  ALLOW                              DENY  DISABLED
k8s-fw-a62a982b26a034e0e97258af6717b8b0       cluster-network-labs-us-west1  INGRESS    1000      tcp:80,tcp:443,tcp:1053,tcp:15353        False

测试用服务端与客户端代码 #

我部署了一个简单的UDP ping-pong服务器，在本地裸机和minikube上通过ingress-nginx控制器均可正常工作，但在GKE的相同配置下客户端请求超时。

服务端代码 #

package server

import (
    "fmt"
    "net"
    "os"
    "time"

    "github.com/spf13/cobra"
)

func response(udpServer net.PacketConn, addr net.Addr, buf []byte) {

    fmt.Println("msg", string(buf))

    time := time.Now().Format(time.ANSIC)
    responseStr := fmt.Sprintf("%v. msg: %v", time, string(buf))

    udpServer.WriteTo([]byte(responseStr), addr)
}

var Command = &cobra.Command{
    Use:   "server",
    Short: "Debug UDP server.",
    Long:  `Provides a UDP server endpoint which responds to pings.`,
    RunE: func(cmd *cobra.Command, args []string) error {

        udpServer, err := net.ListenPacket("udp", fmt.Sprintf(":%d", serverPort))
        if err != nil {
            return err
        }
        defer udpServer.Close()

        fmt.Fprintf(os.Stdout, "listening :%d\n", serverPort)

        for {
            buf := make([]byte, 1024)
            _, addr, err := udpServer.ReadFrom(buf)
            if err != nil {
                continue
            }
            go response(udpServer, addr, buf)
        }

    },
}

var serverPort int

func init() {
    Command.PersistentFlags().IntVar(&serverPort, "port", 1053, "Port to open an listen for UDP packets")
}

客户端代码 #

package client

import (
    "fmt"
    "net"
    "os"

    "github.com/spf13/cobra"
)

var Command = &cobra.Command{
    Use:   "client",
    Short: "Debug UDP client.",
    Long:  `Provides a UDP client endpoint which responds to pings.`,
    RunE: func(cmd *cobra.Command, args []string) error {

        udpServer, err := net.ResolveUDPAddr("udp", fmt.Sprintf("%s:%d", queryHost, queryPort))

        if err != nil {
            return err
        }

        conn, err := net.DialUDP("udp", nil, udpServer)
        if err != nil {
            return err
        }
        defer conn.Close()

        _, err = conn.Write([]byte(msg))
        if err != nil {
            return err
        }

        received := make([]byte, 1024)
        _, err = conn.Read(received)
        if err != nil {
            println("Read data failed:", err.Error())
            os.Exit(1)
        }

        println(string(received))

        return nil
    },
}

var msg string
var queryHost string
var queryPort int

func init() {

    Command.PersistentFlags().StringVar(&msg, "msg", "echo", "Message used to send ping/pong requests over UDP")
    Command.PersistentFlags().StringVar(&queryHost, "host", "127.0.0.1", "Host used to send ping/pong requests over UDP")
    Command.PersistentFlags().IntVar(&queryPort, "port", 1053, "Port used to send ping/pong requests over UDP")
}

版本信息 #

• ingress-nginx helm chart - 4.4.0
• ingress-nginx - 1.5.1
• Kubernetes - v1.24.5-gke.600
• registry.terraform.io/hashicorp/google - v4.43.0

是否有人遇到过类似问题，或能提供进一步排查的方向？谢谢！

内容的提问来源于stack exchange，提问作者Marcin