AWS EKS中通过ALB Ingress暴露K8s Dashboard遇400错误求助

问题背景 #

在AWS EKS集群中通过ALB Ingress暴露kubernetes-dashboard至公网，所有资源部署正常，可通过kubectl proxy访问Dashboard，但无法通过自定义域名k8s-dashboard.uat.custom-domain.com访问。DNS记录正常（external-dns自动生成A记录，nslookup可解析），通过Ingress前置的Cognito IAM验证后浏览器返回HTTP 400错误。

相关资源描述 #

Service描述 #

HOME % kubectl describe service/kubernetes-dashboard -n kube-system
Name:                     kubernetes-dashboard
Namespace:                kube-system
Labels:                   app.kubernetes.io/component=kubernetes-dashboard
                          app.kubernetes.io/instance=kube-system
                          app.kubernetes.io/managed-by=Helm
                          app.kubernetes.io/name=kubernetes-dashboard
                          app.kubernetes.io/version=2.5.1
                          helm.sh/chart=kubernetes-dashboard-5.4.1
                          kubernetes.io/cluster-service=true
Annotations:              meta.helm.sh/release-name: kube-system
                          meta.helm.sh/release-namespace: kube-system
Selector:                 app.kubernetes.io/component=kubernetes-dashboard,app.kubernetes.io/instance=kube-system,app.kubernetes.io/name=kubernetes-dashboard
Type:                     NodePort
IP Family Policy:         SingleStack
IP Families:              IPv4
IP:                       999.999.999.999
IPs:                      999.999.999.999
Port:                     https  443/TCP
TargetPort:               https/TCP
NodePort:                 https  30838/TCP
Endpoints:                888.888.888.888:8443
Session Affinity:         None
External Traffic Policy:  Cluster
Events:                   <none>

Ingress描述 #

HOME % kubectl describe ingress k8s-dashboard-ingress -n kube-system                   
Name:             k8s-dashboard-ingress
Labels:           app.kubernetes.io/managed-by=Helm
Namespace:        kube-system
Address:          k8s-kubesyst-k8sdashb-<code>-<code>.<region-code>.elb.amazonaws.com
Ingress Class:    alb
Default backend:  <default>
Rules:
  Host                                   Path  Backends
  ----                                   ----  --------
  k8s-dashboard.uat.custom-domain.com  
                                         /   kubernetes-dashboard:443 (888.888.888.888:8443)
Annotations:                             alb.ingress.kubernetes.io/auth-idp-cognito:
                                           {"userPoolARN":"arn:aws:cognito-idp:<region-code>:<account_id>:userpool/<region-code>_<code>","userPoolClientID":"<code>","...
                                         alb.ingress.kubernetes.io/auth-scope: phone email openid
                                         alb.ingress.kubernetes.io/auth-type: cognito
                                         alb.ingress.kubernetes.io/certificate-arn: arn:aws:acm:<region-code>:<account_id>:certificate/<uuid>
                                         alb.ingress.kubernetes.io/healthcheck-path: /api/health
                                         alb.ingress.kubernetes.io/listen-ports: [{"HTTP":80},{"HTTPS":443}]
                                         alb.ingress.kubernetes.io/scheme: internet-facing
                                         alb.ingress.kubernetes.io/ssl-redirect: 443
                                         alb.ingress.kubernetes.io/target-type: ip
                                         meta.helm.sh/release-name: kube-system
                                         meta.helm.sh/release-namespace: kube-system
Events:                                  <none>

可能的错误点及排查方向 #

• ALB与后端服务的通信协议不匹配：Dashboard后端容器监听的是8443端口（HTTPS），但当前Ingress未指定后端通信协议，ALB默认会用HTTP转发请求到Service的443端口，导致协议不匹配触发400错误。需添加Ingress注解：alb.ingress.kubernetes.io/backend-protocol: HTTPS，让ALB用HTTPS和后端服务通信。
• Cognito回调URL配置错误：检查Cognito用户池客户端的Allowed Callback URLs是否包含https://k8s-dashboard.uat.custom-domain.com/oauth2/idpresponse，如果回调URL和实际访问域名不匹配，验证完成后会返回400错误。
• Dashboard的Host头验证限制：Kubernetes Dashboard默认会验证请求的Host头，若ALB转发时未正确传递Host，或Dashboard未将自定义域名加入允许列表，会触发400。需修改Dashboard Deployment的command参数，添加--allowed-hosts=k8s-dashboard.uat.custom-domain.com，允许该域名作为合法Host。
• ALB证书覆盖范围问题：确认ACM证书是否覆盖了k8s-dashboard.uat.custom-domain.com，若证书域名不匹配，会导致SSL握手异常，间接引发400错误。

内容的提问来源于stack exchange，提问作者arinray