为Google Kubernetes Ingress配置不同端口的隐藏式Health-Check

Great question! Let’s break down how to address each part of your request for Google Kubernetes Engine (GKE) Ingress setups.

Can I use an alternate port for health checks without exposing it on the Ingress? #

Absolutely! GKE lets you decouple health check configuration from your Ingress-exposed ports using BackendConfig resources. The alternate health check port only needs to exist on your Service and Pods—you don’t have to map it in your Ingress rules at all.

Here’s a step-by-step example:

1. Create a BackendConfig that specifies your alternate health check port and endpoint:

   apiVersion: cloud.google.com/v1
   kind: BackendConfig
   metadata:
     name: hidden-health-check
   spec:
     healthCheck:
       type: HTTP
       requestPath: /internal-healthz
       port: 8081  # Your alternate, unexposed port
       checkIntervalSec: 10
       timeoutSec: 5
       healthyThreshold: 2
       unhealthyThreshold: 3
   

2. Link this BackendConfig to your Service via an annotation, and include the alternate port in the Service (but don’t expose it in Ingress):

   apiVersion: v1
   kind: Service
   metadata:
     name: my-app-service
     annotations:
       cloud.google.com/backend-config: '{"default": "hidden-health-check"}'
   spec:
     ports:
       - name: main-traffic
         port: 80
         targetPort: 8080  # Your main application port (exposed via Ingress)
       - name: health-check-port
         port: 8081
         targetPort: 8081  # Alternate port for health checks
     selector:
       app: my-app
   

3. Your Ingress only needs to reference the main traffic port—no mention of the health check port:

   apiVersion: networking.k8s.io/v1
   kind: Ingress
   metadata:
     name: my-app-ingress
   spec:
     rules:
       - http:
           paths:
             - path: /*
               pathType: ImplementationSpecific
               backend:
                 service:
                   name: my-app-service
                   port:
                     number: 80
   

GCP’s Load Balancer will directly target the 8081 port on your Pods (via the Service) for health checks, while external traffic only reaches port 80 through the Ingress.

Can I configure a different health check for the Ingress? #

Yes—BackendConfig is exactly for this purpose. You can customize almost every aspect of the health check:

• Different HTTP/HTTPS request paths (e.g., /internal-healthz instead of your app’s root)
• TCP or SSL health checks instead of HTTP
• Adjusted intervals, timeouts, and threshold values
• Even separate health checks for different backend services in the same Ingress (just create multiple BackendConfigs and link them to individual Services)

For example, if you need a TCP health check instead of HTTP, modify the BackendConfig:

spec:
  healthCheck:
    type: TCP
    port: 8081
    checkIntervalSec: 15

Better ways to hide health checks without authorization #

If you want to ensure external users can’t access your health check endpoint at all, here are two robust approaches:

1. Restrict access to GCP health check IP ranges #

GCP’s health check systems use specific IP ranges: 35.191.0.0/16 and 130.211.0.0/22. You can block all other IPs from accessing your health check endpoint directly in your app or a sidecar proxy (like Nginx):

Example Nginx config snippet:

location /internal-healthz {
  allow 35.191.0.0/16;
  allow 130.211.0.0/22;
  deny all;
  proxy_pass http://localhost:8081;
}

2. Use a ClusterIP Service exclusively for health checks #

Create a separate ClusterIP Service that only targets your health check port, and link your BackendConfig to this Service. Since ClusterIP Services are only accessible within the cluster, external users can’t reach them at all. This keeps your main Service clean and ensures health check traffic is isolated.

# ClusterIP Service for health checks only
apiVersion: v1
kind: Service
metadata:
  name: health-check-service
  annotations:
    cloud.google.com/backend-config: '{"default": "hidden-health-check"}'
spec:
  type: ClusterIP
  ports:
    - name: health-port
      port: 8081
      targetPort: 8081
  selector:
    app: my-app

Then update your Ingress to use your main Service for traffic, while the health check uses this dedicated ClusterIP Service (you’ll need to adjust your BackendConfig and Ingress backend references accordingly).

内容的提问来源于stack exchange，提问作者Laures