Kubernetes Nginx Ingress无法访问其他命名空间Pod问题解决

问题场景 #

在example-ns命名空间部署Kuard演示应用并通过Nginx Ingress对外暴露服务时，出现503 Service Temporarily Unavailable错误，但相同配置在default命名空间部署时可正常访问。

使用的配置文件 #

Deployment、Service和Ingress的YAML配置如下：

apiVersion: apps/v1
kind: Deployment
metadata:
  name: kuard
  namespace: example-ns
spec:
  selector:
    matchLabels:
      app: kuard
  replicas: 1
  template:
    metadata:
      labels:
        app: kuard
    spec:
      containers:
      - image: gcr.io/kuar-demo/kuard-amd64:1
        imagePullPolicy: Always
        name: kuard
        ports:
        - containerPort: 8080

---

apiVersion: v1
kind: Service
metadata:
  name: kuard
  namespace: example-ns
spec:
  ports:
  - port: 80
    targetPort: 8080
    protocol: TCP
  selector:
    app: kuard

---

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: kuard
  namespace: example-ns
  annotations:
    kubernetes.io/ingress.class: "nginx"
    cert-manager.io/cluster-issuer: "letsencrypt-prod"
    nginx.ingress.kubernetes.io/auth-type: basic
    nginx.ingress.kubernetes.io/auth-secret: htpasswd
    nginx.ingress.kubernetes.io/auth-realm: "Enter your credentials"

spec:
  tls:
  - hosts:
    - example.mydomain.dev
    secretName: quickstart-example-tls
  rules:
  - host: example.mydomain.dev
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: kuard
            port:
              number: 80

初步排查信息 #

执行kubectl describe ingress kuard -n example-ns结果显示Ingress已正常同步，后端服务指向正确的Pod地址：

❯ kubectl describe ingress kuard -n example-ns
Name:             kuard
Labels:           <none>
Namespace:        example-ns
Address:          192.168.69.1
Ingress Class:    <none>
Default backend:  <default>
TLS:
  quickstart-example-tls terminates example.mydomain.dev
Rules:
  Host                    Path  Backends
  ----                    ----  --------
  example.mydomain.dev
                          /   kuard:80 (10.69.58.226:8080)
Annotations:              cert-manager.io/cluster-issuer: letsencrypt-prod
                          kubernetes.io/ingress.class: nginx
                          nginx.ingress.kubernetes.io/auth-realm: Enter your credentials
                          nginx.ingress.kubernetes.io/auth-secret: htpasswd
                          nginx.ingress.kubernetes.io/auth-type: basic
Events:
  Type    Reason             Age                From                       Message
  ----    ------             ----               ----                       -------
  Normal  CreateCertificate  28m                cert-manager-ingress-shim  Successfully created Certificate "quickstart-example-tls"
  Normal  Sync               27m (x2 over 28m)  nginx-ingress-controller   Scheduled for sync
  Normal  Sync               27m (x2 over 28m)  nginx-ingress-controller   Scheduled for sync

根因与解决方法 #

查阅常规解决方案无效后，查看Nginx Ingress控制器日志发现：Ingress配置中指定的Basic认证密钥htpasswd存在于default命名空间，Ingress控制器在example-ns下无法跨命名空间访问该密钥，导致认证流程失败并返回503错误。

解决方法：将htpasswd密钥从default命名空间迁移至example-ns命名空间，即可恢复正常访问。

内容的提问来源于stack exchange，提问作者Robert Fent