Minikube环境下Ingress与Service端口正确却无法访问K8S Pod

环境配置详情 #

Ingress 配置 #

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  labels:
    app.kubernetes.io/instance: oc-backend
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: oc-backend
    app.kubernetes.io/version: 1.16.0
    helm.sh/chart: oc-backend-0.1.0
  name: oc-backend
  namespace: oc
spec:
  rules:
    - host: oc-backend.com
      http:
        paths:
          - backend:
              service:
                name: oc-backend
                port:
                  number: 80
            path: /
            pathType: ImplementationSpecific

Service 配置 #

apiVersion: v1
kind: Service
metadata:
  labels:
    app.kubernetes.io/instance: oc-backend
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: oc-backend
    app.kubernetes.io/version: 1.16.0
    helm.sh/chart: oc-backend-0.1.0
  name: oc-backend
  namespace: oc
spec:
  ports:
    - port: 80
      targetPort: 3000
  selector:
    app.kubernetes.io/instance: oc-backend
    app.kubernetes.io/name: oc-backend
  type: LoadBalancer

Deployment 配置 #

apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app.kubernetes.io/instance: oc-backend
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: oc-backend
    app.kubernetes.io/version: 1.16.0
    helm.sh/chart: oc-backend-0.1.0
  name: oc-backend
  namespace: oc
spec:
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/instance: oc-backend
      app.kubernetes.io/name: oc-backend
  template:
    metadata:
      labels:
        app.kubernetes.io/instance: oc-backend
        app.kubernetes.io/name: oc-backend
    spec:
      containers:
        - envFrom:
            - secretRef:
                name: secrets
          image: 'registry.gitlab.com/open-concepts/open-concepts-backend:master'
          imagePullPolicy: Always
          name: oc-backend
          ports:
            - containerPort: 3000
          resources: {}
          securityContext: {}
      imagePullSecrets:
        - name: credentials
      securityContext: {}
      serviceAccountName: oc-backend-sa

错误现象 #

1. 访问oc-backend.local时抛出getaddrinfo ENOTFOUND oc-backend.local错误
2. 已启用Ingress插件并运行minikube tunnel，执行以下命令均返回连接重置：

➜ kubectl get svc -n oc
NAME         TYPE           CLUSTER-IP     EXTERNAL-IP   PORT(S)        AGE
oc-backend   LoadBalancer   10.109.58.97   127.0.0.1     80:32026/TCP   26h

➜ curl 10.109.58.97 
curl: (56) Recv failure: Connection reset by peer

➜ curl -H 'Host: oc-backend.com' 192.168.49.2
curl: (56) Recv failure: Connection reset by peer

排查与解决方向 #

1. 修正DNS映射与域名匹配 #

• Ingress配置的主机名是oc-backend.com，但你实际访问的是oc-backend.local，域名不匹配。需在本地hosts文件添加映射：
  • Linux/macOS：编辑/etc/hosts
  • Windows：编辑C:\Windows\System32\drivers\etc\hosts
    添加内容：192.168.49.2 oc-backend.com（192.168.49.2为你的Minikube IP）

2. 验证Pod与Service连通性 #

• 检查Pod状态：

  kubectl get pods -n oc
  

  若Pod状态异常，查看日志排查：

  kubectl logs <pod-name> -n oc
  

• 确认Service关联的Pod端点：

  kubectl describe svc oc-backend -n oc
  

  查看Endpoints字段是否存在Pod IP，若为空则说明标签选择器与Pod标签不匹配（当前配置标签一致，需再次确认）

3. 检查Ingress Controller状态 #

• 确认Ingress Controller运行正常：

  kubectl get pods -n kube-system | grep ingress
  

• 查看Ingress资源事件：

  kubectl describe ingress oc-backend -n oc
  

  检查Events字段是否存在无法关联Service等错误信息

4. 验证容器端口监听 #

• 进入Pod内部，确认3000端口是否被应用监听：

  kubectl exec -it <pod-name> -n oc -- netstat -tulpn
  

  若容器无netstat，可使用ss命令：

  kubectl exec -it <pod-name> -n oc -- ss -tulpn
  

  确保应用确实在3000端口提供服务

5. 排查网络策略与防火墙 #

• 检查命名空间下是否有网络策略阻止流量：

  kubectl get networkpolicies -n oc
  

• 确认Minikube主机防火墙未阻止80端口的访问

内容的提问来源于stack exchange，提问作者Fares