基于Terraform配置GKE Ingress部署n8n时会话丢失问题求助

优先方案：基于现有GCP原生Ingress配置会话亲和性 #

GCP原生Ingress的会话保持配置需要通过BackendConfig资源实现，按以下步骤修改Terraform配置即可：

1. 新增BackendConfig资源定义，开启Cookie会话亲和性

resource "kubernetes_manifest" "n8n_backend_config" {
  manifest = {
    apiVersion = "cloud.google.com/v1"
    kind       = "BackendConfig"
    metadata = {
      name      = "${var.release_name}-backend-config"
      namespace = var.namespace
    }
    spec = {
      sessionAffinity = {
        affinityType = "GENERATED_COOKIE"
        affinityCookieTtlSec = 86400 # 单位为秒，可按需求调整会话保持时长
      }
    }
  }
}

2. 修改helm_release资源的依赖，确保BackendConfig先于n8n Service创建
   将helm_release.n8n的depends_on参数新增kubernetes_manifest.n8n_backend_config
3. 修改n8n_values.yaml的Service配置，关联BackendConfig

service:
  type: ClusterIP
  port: 80
  annotations:
    cloud.google.com/backend-config: '{"default": "n8n-backend-config"}' # 替换为你实际的BackendConfig名称

配置更新后重新apply Terraform即可生效。

备选方案：部署Nginx Ingress实现会话保持 #

如果需要更灵活的Ingress配置能力，可按以下步骤部署Nginx Ingress：

1. 新增Nginx Ingress控制器的Helm部署配置

resource "helm_release" "nginx_ingress" {
  name       = "nginx-ingress"
  repository = "https://kubernetes.github.io/ingress-nginx"
  chart      = "ingress-nginx"
  version    = "4.7.1" # 可替换为对应版本的稳定版本号
  namespace  = "kube-system"
  set {
    name  = "controller.service.type"
    value = "LoadBalancer"
  }
  set {
    name  = "controller.config.use-forwarded-headers"
    value = "true"
  }
}

2. 修改原有的n8n Ingress资源，适配Nginx Ingress并开启会话保持

resource "kubernetes_ingress" "n8n_ingress" {
  wait_for_load_balancer = true
  metadata {
    name = "${var.release_name}-ingress"
    namespace = helm_release.n8n[0].namespace
    annotations = {
      "kubernetes.io/ingress.class" = "nginx"
      "nginx.ingress.kubernetes.io/affinity" = "cookie"
      "nginx.ingress.kubernetes.io/session-cookie-name" = "n8n_session"
      "nginx.ingress.kubernetes.io/session-cookie-expires" = "86400"
      "nginx.ingress.kubernetes.io/session-cookie-max-age" = "86400"
      "nginx.ingress.kubernetes.io/ssl-redirect" = "true"
      # 若继续使用GCP托管SSL证书可保留以下注解，否则可替换为cert-manager相关配置
      "ingress.gcp.kubernetes.io/pre-shared-cert" = google_compute_managed_ssl_certificate.n8n_ssl.name
    }
  }
  spec {
    backend {
      service_name = helm_release.n8n[0].name
      service_port = 80
    }
  }
}

额外配置校验 #

修改完成后请确认n8n_values.yaml中extraEnv下的VUE_APP_URL_BASE_API和WEBHOOK_TUNNEL_URL参数已替换为实际的n8n访问域名，避免前端请求地址异常导致会话失效。

内容的提问来源于stack exchange，提问作者Ben