Kubernetes Ingress控制器部署异常求助：Pod启动即CrashLoopBackOff

Hey there, let's work through this CrashLoopBackOff issue with your Ingress controller pod—this is a common snag, but we can nail down the root cause step by step.

Step 1: Pull the Pod's Logs (Critical First Move) #

The first thing to do is check why the pod is crashing. Grab the logs from the failing pod with these commands:

# Get latest logs
kubectl logs <your-ingress-controller-pod-name> -n <your-namespace>

# If the pod restarted, check the previous crash logs
kubectl logs <your-ingress-controller-pod-name> -n <your-namespace> --previous

Look for telltale errors like:

• Image pull failures (e.g., "ErrImagePull" or "ImagePullBackOff")
• Permission denied (a sign of missing RBAC permissions)
• Port binding failures (the controller can't claim ports 80/443)
• Missing configuration files (if you're using custom config mounts)

Step 2: Inspect Pod Details with kubectl describe #

Run this to get a full breakdown of the pod's state and events:

kubectl describe pod <your-ingress-controller-pod-name> -n <your-namespace>

Pay extra attention to the Events section at the bottom. This will reveal if:

• The pod was killed due to out-of-memory (OOM) (look for "OOMKilled")
• There's a problem with volume mounts (e.g., a missing config map)
• The node has insufficient resources to run the pod

Step 3: Verify RBAC Permissions #

Ingress controllers need specific permissions to interact with the Kubernetes API (like reading Ingress, Service, and Endpoint resources). Double-check that:

• The deployment is using a valid ServiceAccount
• The ServiceAccount is bound to a ClusterRole/ClusterRoleBinding that grants the necessary permissions
  For example, if you're using the NGINX Ingress Controller, make sure you applied the official RBAC manifests alongside the deployment.

Step 4: Validate Image & Pull Secrets #

If the logs mention image issues:

• Confirm the image tag in your deployment is correct (e.g., nginx-ingress-controller:v1.9.4 instead of a non-existent tag)
• If you're using a private registry, ensure the pod has an ImagePullSecret attached to pull the image

Step 5: Check Port Conflicts #

Ingress controllers typically listen on ports 80 and 443. Verify:

• No other processes on the node are using these ports (you can check with ss -tulpn | grep :80 on the node)
• The pod's container ports match the Service's target ports (your ingress-svc might look fine, but a mismatch could still crash the pod)

Once Your Ingress Controller is Running: Next Steps #

Once the pod shows a stable Running status, you can proceed to route traffic to your backend services:

1. Create an Ingress Resource #

Create a YAML file (e.g., app-ingress.yaml) with your routing rules:

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: app-ingress
  namespace: <your-namespace>
  annotations:
    # Add controller-specific annotations (example for NGINX)
    nginx.ingress.kubernetes.io/rewrite-target: /
spec:
  rules:
  - host: your-app.example.com
    http:
      paths:
      - path: /api
        pathType: Prefix
        backend:
          service:
            name: api-service
            port:
              number: 8080
      - path: /web
        pathType: Prefix
        backend:
          service:
            name: web-service
            port:
              number: 80

Apply it with:

kubectl apply -f app-ingress.yaml

2. Validate the Ingress Resource #

Check if the ingress is configured correctly:

kubectl get ingress -n <your-namespace>
kubectl describe ingress app-ingress -n <your-namespace>

Look for the Address field—this should show the IP of your ingress-svc (or external IP if using a LoadBalancer).

3. Test Traffic Routing #

Use curl or a browser to test the routes:

# If using a NodePort service
curl http://<node-ip>:<node-port>/api

# If using a LoadBalancer with a custom host
curl -H "Host: your-app.example.com" http://<loadbalancer-ip>/web

内容的提问来源于stack exchange，提问作者Leonard Capacete