Kubernetes中NodePort正常但Ingress无法访问问题求助

我是Kubernetes新手，正在搭建生产环境Web应用。测试官方Nginx应用时，NodePort和Ingress都能正常访问；但部署自己的Web应用后，只有NodePort能访问，Ingress完全失效。我已经删除过所有Nginx相关的Deployment、Service和Ingress资源，问题依然存在，求帮忙排查。

apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx
  namespace: default
spec:
  replicas: 2
  selector:
    matchLabels:
      app: nginx
  template:
    metadata:
      labels:
        app: nginx
    spec:
      containers:
        - name: nginx
          image: nginx:stable
          imagePullPolicy: Always
          ports:
          - containerPort: 80
            name: web
            protocol: TCP
          readinessProbe:
            httpGet:
              port: web
              path: /

---
apiVersion: v1
kind: Service
metadata:
  name: nginx-nodeport
  namespace: default
spec:
  type: NodePort
  selector:
    # app: nginx
    app: mruser-dev
  ports:
    - name: web
      port: 80
      targetPort: web
      nodePort: 31122
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: nginx-ingress
  annotations:
    kubernetes.io/ingress.class: "nginx"
spec:
  rules:
  - http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: nginx-nodeport 
            port:
              number: 80

apiVersion: apps/v1
kind: Deployment
metadata:
  name: mywebapp-dev
spec:
  replicas: 2
  selector:
    matchLabels:
      app: mywebapp-dev
  template: 
    metadata:
      labels:
        app: mywebapp-dev
      annotations:
        prometheus.io/scrape: "true"
        prometheus.io/path: /metrics
        prometheus.io/port: "80"
        scheduler.alpha.kubernetes.io/affinity: >
          {
            "nodeAffinity": {
              "requiredDuringSchedulingIgnoredDuringExecution": {
                "nodeSelectorTerms": [
                  {
                    "matchExpressions": [
                      {
                        "key": "kubernetes.io/hostname",
                        "operator": "In",
                        "values": ["server-node-1"]
                      }
                    ]
                  }
                ]
              }
            }
          }
    spec:
      volumes:
        - name: logs
          emptyDir: {}
        - name: cache
          emptyDir: {}
        - name: testing
          emptyDir: {}
        - name: sessions
          emptyDir: {}
        - name: views
          emptyDir: {}
        - name: mywebapp-dev-nfsvolume
          nfs:
            server: 10.0.0.20
            path: /var/www/html/misteruser-dev
        - name: mywebapp-nginx-nfsvolume
          nfs:
            server: 10.0.0.20
            path: /var/www/nginx
      securityContext:
        fsGroup: 82
      initContainers:
        - name: database-migrations
          image: mywebapp-dev-laravel-fpm:8.1-fpm-alpine
          imagePullPolicy: Never
          envFrom:
            - configMapRef:
                name: mywebapp-dev-laravel
            - secretRef:
                name: mywebapp-dev-laravel
          volumeMounts: 
            - name: mywebapp-dev-nfsvolume
              mountPath: /var/www/html/
          command:
            - "php"
          args:
            - "artisan"
            - "migrate"
            - "--force"
      containers:
        - name: nginx
          imagePullPolicy: Never
          image: mywebapp-dev-laravel-nginx:stable-alpine          
          volumeMounts:
            - name: mywebapp-nginx-nfsvolume
              mountPath: /etc/nginx/conf.d/
          resources:
            limits:
              cpu: 200m
              memory: 50M
          ports:
          - containerPort: 80
            name: web            
            protocol: TCP
          readinessProbe:
            httpGet:
              port: web
              path: /
        - name: fpm
          imagePullPolicy: Never
          envFrom:
            - configMapRef:
                name: mywebapp-dev-laravel
            - secretRef:
                name: mywebapp-dev-laravel
          securityContext:
            runAsUser: 82
            readOnlyRootFilesystem: true
          volumeMounts:
            - name: logs
              mountPath: /var/www/html/storage/logs
            - name: cache
              mountPath: /var/www/html/storage/framework/cache
            - name: sessions
              mountPath: /var/www/html/storage/framework/sessions
            - name: views
              mountPath: /var/www/html/storage/framework/views
            - name: testing
              mountPath: /var/www/html/storage/framework/testing
            - name: mywebapp-dev-nfsvolume
              mountPath: /var/www/html/
          resources: 
            limits:
              cpu: 500m
              memory: 200Mi
          image: mywebapp-dev-laravel-fpm:8.1-fpm-alpine
          ports:
            - containerPort: 9000

---
apiVersion: v1
kind: Service
metadata:
  name: mywebapp-dev-svc
  namespace: default
spec:
  type: NodePort
  selector:
    app: mywebapp-dev
  ports:
    - name: web
      port: 80
      targetPort: 80
      nodePort: 31112
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: mywebapp-nginx-ingress
  annotations:
    kubernetes.io/ingress.class: "nginx"
spec:
  rules:
  - http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: mywebapp-dev-svc
            port:
              number: 80

排查建议 #

• 查看Ingress Controller日志：执行kubectl logs -n kube-system <nginx-ingress-controller-pod-name>，检查转发请求到mywebapp-dev-svc时的错误信息，比如连接超时、4xx/5xx响应。
• 验证Service后端端点：执行kubectl describe service mywebapp-dev-svc，确认Endpoints字段存在Pod的IP和80端口条目，若为空则说明Service与Pod标签不匹配或Pod未就绪。
• 检查Pod就绪状态：执行kubectl get pods -l app=mywebapp-dev，确认READY列为2/2。若不是，通过kubectl describe pod <pod-name>和kubectl logs <pod-name> -c nginx查看readinessProbe是否失败、容器启动是否报错。
• 测试Ingress Controller到Service的连通性：进入Ingress Controller Pod执行curl mywebapp-dev-svc.default.svc.cluster.local:80，若无法返回内容，说明Service到Pod链路异常；若能返回，则排查Ingress路径、域名配置或Ingress Controller设置。
• 查看Ingress资源状态：执行kubectl describe ingress mywebapp-nginx-ingress，检查Events字段是否有配置同步失败等错误提示。
• 调整Service的targetPort：将自有应用Service的targetPort: 80改为targetPort: web，与Pod中端口名称对应，避免潜在的端口匹配问题。
• 检查自有应用Nginx配置：确认NFS挂载的/etc/nginx/conf.d/下的配置文件是否正确，比如监听端口、转发到fpm的规则是否正常，错误的Nginx配置可能导致后端返回异常，进而使Ingress无法正常转发。

内容的提问来源于stack exchange，提问作者Yassine Chilali