Kubernetes Ingress HTTP访问异常：www域名及HTTP协议返回404

访问example.com或https://example.com时服务运行正常，但访问www.example.com或http://example.com时，Nginx默认后端返回404错误。

当前Ingress配置 #

# Ingress
apiVersion: networking.k8s.io/v1
# make a new cert
kind: Ingress
metadata:
  name: ${APP_NAME}
  annotations:
    nginx.ingress.kubernetes.io/ssl-redirect: 'true'
    nginx.ingress.kubernetes.io/rewrite-target:  /
spec:
  tls:
  - secretName: ${APP_NAME}
    hosts:
    - ${URL}
    - www.${URL}
  rules:
  - host: ${URL}
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: ${APP_NAME}
            port:
              number: 80

Certificate配置 #

# Certificate
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: ${APP_NAME}
spec:
  secretName: ${APP_NAME}
  dnsNames:
  - example.com
  - www.example.com
  issuerRef:
    name: letsencrypt-production
    # We can reference ClusterIssuers by changing the kind here.
    # The default value is Issuer (i.e. a locally namespaced Issuer)
    kind: ClusterIssuer
    group: cert-manager.io

问题原因 #

1. www.example.com无对应Ingress路由规则：当前Ingress仅配置了${URL}（即example.com）的路由规则，www.example.com没有匹配的host规则，请求被Nginx默认后端接管，返回404。
2. http://example.com跳转失效：虽然配置了ssl-redirect: 'true'，但该注解仅对已有Ingress规则的host生效。未匹配到规则的HTTP请求，Ingress Controller不会自动处理HTTPS跳转，直接返回404。

修复方案 #

方案1：为www.example.com添加独立路由规则 #

修改Ingress配置，新增www.${URL}的路由规则，确保两个域名都能匹配到后端服务：

# Ingress
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: ${APP_NAME}
  annotations:
    nginx.ingress.kubernetes.io/ssl-redirect: 'true'
    nginx.ingress.kubernetes.io/rewrite-target: /
spec:
  tls:
  - secretName: ${APP_NAME}
    hosts:
    - ${URL}
    - www.${URL}
  rules:
  # 处理 example.com 的请求
  - host: ${URL}
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: ${APP_NAME}
            port:
              number: 80
  # 新增 www.example.com 的请求规则
  - host: www.${URL}
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: ${APP_NAME}
            port:
              number: 80

方案2：将www.example.com重定向到主域名 #

如果希望统一域名访问，可以添加重定向配置，将www前缀的请求跳转到主域名：

# Ingress
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: ${APP_NAME}
  annotations:
    nginx.ingress.kubernetes.io/ssl-redirect: 'true'
    nginx.ingress.kubernetes.io/rewrite-target: /
    # 添加 www 到主域名的301重定向
    nginx.ingress.kubernetes.io/configuration-snippet: |
      if ($host = 'www.${URL}') {
        return 301 https://${URL}$request_uri;
      }
spec:
  tls:
  - secretName: ${APP_NAME}
    hosts:
    - ${URL}
    - www.${URL}
  rules:
  - host: ${URL}
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: ${APP_NAME}
            port:
              number: 80
  # 必须添加 www.${URL} 的规则，否则重定向逻辑不会触发
  - host: www.${URL}
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: ${APP_NAME}
            port:
              number: 80

内容的提问来源于stack exchange，提问作者user9468014