EKS中Backend服务无法注册到ALB目标组求助

我是Kubernetes与AWS新手，部署了三个服务：frontend、backend和auth，均为NodePort类型Service，通过AWS ALB Ingress Controller配置Ingress映射不同域名。目前frontend和auth服务正常注册到目标组，但backend始终不健康。可以通过kubectl port-forward <backend-pod> 80:80正常访问backend服务。

执行kubectl describe ingresses输出如下：

Name:             ingress
Labels:           app.kubernetes.io/managed-by=Helm
Namespace:        default
Address:          xxxxxxxxxxxxxxxxxxxxxxxxxxx.xxxxx.elb.amazonaws.com
Ingress Class:    <none>
Default backend:  <default>
Rules:
Host                                  Path  Backends

----------------

domain.com
/   front-service:default-port (10.0.1.183:80,10.0.2.98:80)
back.domain.com
/   backend-service:default-port (<none>)
auth.domain.com
/   auth-service:default-port (10.0.1.30:80,10.0.1.33:80)
alb.ingress.kubernetes.io/listen-ports: [{"HTTPS":443}, {"HTTP":80}]
alb.ingress.kubernetes.io/scheme: internet-facing
alb.ingress.kubernetes.io/ssl-redirect: 443
kubernetes.io/ingress.class: alb

Events:
Type    Reason                  Age                   From     Message

-------------------------

Normal  SuccessfullyReconciled  8m20s (x15 over 41h)  ingress  Successfully reconciled

Frontend配置 #

apiVersion: apps/v1
kind: Deployment
metadata:
  name: front
  labels:
    name: front
spec:
  replicas: 2
  selector:
    matchLabels:
      name: front
  template:
    metadata:
      labels:
        name: front
    spec:
      containers:
      - name: frontend
        image:  {{ .Values.image }}
        imagePullPolicy: Always
        ports:
          - containerPort: 80
---
apiVersion: v1
kind: Service
metadata:
  name: wrfront-{{ .Values.namespace }}-service
spec:
  type: NodePort
  ports:
  - port: 80
    targetPort: 80
    name: default-port
    protocol: TCP
  selector:
    name: front
---

Auth配置 #

kind: PersistentVolumeClaim
apiVersion: v1
metadata:
  name: pvc-wrauth-keys
spec:
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 200Gi
---
apiVersion: "v1"
kind: "ConfigMap"
metadata:
  name: "auth-config-ocpm"
  labels:
    app: "auth"
data:
  ASPNETCORE_URL: "http://+:80"
  ASPNETCORE_ENVIRONMENT: "Development"
  ASPNETCORE_LOGGINGCONSOLEDISABLECOLORS: "true"
---
apiVersion: "apps/v1"
kind: "Deployment"
metadata:
  name: "auth"
  labels:
    app: "auth"
spec:
  replicas: 2
  strategy:
    type: Recreate
  selector:
    matchLabels:
      app: "auth"
  template:
    metadata:
      labels:
        app: "auth"
    spec:
      volumes:
        - name: auth-keys-storage
          persistentVolumeClaim:
            claimName: pvc-wrauth-keys
      containers:
        - name: "api-auth"
          image: {{ .Values.image }}
          imagePullPolicy: Always
          ports:
            - containerPort: 80
          volumeMounts:
            - name: auth-keys-storage
              mountPath: "/app/auth-keys"
          env:
            - name: "ASPNETCORE_URL"
              valueFrom:
                configMapKeyRef:
                  key: "ASPNETCORE_URL"
                  name: "auth-config-ocpm"
            - name: "ASPNETCORE_ENVIRONMENT"
              valueFrom:
                configMapKeyRef:
                  key: "ASPNETCORE_ENVIRONMENT"
                  name: "auth-config-ocpm"
            - name: "ASPNETCORE_LOGGINGCONSOLEDISABLECOLORS"
              valueFrom:
                configMapKeyRef:
                  key: "ASPNETCORE_LOGGINGCONSOLEDISABLECOLORS"
                  name: "auth-config-ocpm"
---
apiVersion: v1
kind: Service
metadata:
  name: auth-service
spec:
  type: NodePort
  selector:
    app: auth
  ports:
  - name: default-port
    protocol: TCP
    port: 80
    targetPort: 80

Backend配置（存在问题的服务） #

apiVersion: apps/v1
kind: Deployment
metadata:
  name: backend
  labels:
    app: backend
spec:
  replicas: 2
  selector:
    matchLabels:
      app: backend
  template:
    metadata:
      labels:
        app: backend
    spec:
      containers:
        - name: backend
          image: {{ .Values.image }}
          imagePullPolicy: Always
          ports:
            - containerPort: 80        
---
apiVersion: v1
kind: Service
metadata:
  name: backend-service
spec:
  type: NodePort
  selector:
    name: backend
  ports:
  - name: default-port
    protocol: TCP
    port: 80
    targetPort: 80

Ingress配置 #

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: ingress
  annotations:
    alb.ingress.kubernetes.io/scheme: internet-facing
    kubernetes.io/ingress.class: alb
    # SSL Settings
    alb.ingress.kubernetes.io/listen-ports: '[{"HTTPS":443}, {"HTTP":80}]'
    alb.ingress.kubernetes.io/ssl-redirect: '443'
    alb.ingress.kubernetes.io/certificate-arn: {{ .Values.certificate }}
spec:
  rules:
    - host: {{ .Values.host }}
      http:
        paths:
          - path: /
            backend:
              service:
                name: front-service
                port:
                  name: default-port
            pathType: Prefix
    - host: back.{{ .Values.host }}
      http:
        paths:
          - path: /
            backend:
              service:
                name: backend-service
                port:
                  name: default-port
            pathType: Prefix
    - host: auth.{{ .Values.host }}
      http:
        paths:
          - path: /
            backend:
              service:
                name: auth-service
                port:
                  name: default-port
            pathType: Prefix

问题根源及修复方法 #

问题原因 #

Backend Service的标签选择器错误：Service中selector字段为name: backend，但Backend Deployment的Pod标签是app: backend，标签不匹配导致Service无法关联到Pod，因此Ingress显示后端为<none>，ALB目标组没有可注册的实例。

修复步骤 #

修改Backend Service的selector字段，使其与Deployment的Pod标签一致：

apiVersion: v1
kind: Service
metadata:
  name: backend-service
spec:
  type: NodePort
  selector:
    app: backend  # 将name改为app，匹配Pod标签
  ports:
  - name: default-port
    protocol: TCP
    port: 80
    targetPort: 80

修改后重新部署Backend Service，等待ALB目标组完成实例注册，服务即可正常通过Ingress访问。

内容的提问来源于stack exchange，提问作者Sandor Martin Leyva