会话亲和性 cookie 不再起作用带有 Nginx 入口的 Kubernetes

问题描述

我们的 Azure AKS - Kubernetes 环境升级到 Kubernetes 版本 1.19.3 迫使我也将我的 Nginx helm.sh/chart 升级到 nginx-ingress-0.7.1。结果我被迫将 API 版本定义更改为networking.k8s.io/v1，因为我的 DevOps 管道因此失败（旧 API 的警告导致错误）。但是，现在我的问题是我的会话亲缘关系注释被忽略，并且响应中没有设置会话 cookie。

我拼命更改名字，尝试不同的无关博客帖子以某种方式解决问题。

任何帮助将不胜感激。

我当前的 Nginx yaml（我已删除状态/托管字段标签以增强可读性）：

kind: Deployment
apiVersion: apps/v1
Metadata:
  name: nginx-ingress-infra-nginx-ingress
  namespace: ingress-infra 
  labels:
    app.kubernetes.io/instance: nginx-ingress-infra
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: nginx-ingress-infra-nginx-ingress
    helm.sh/chart: nginx-ingress-0.7.1
  annotations:
    deployment.kubernetes.io/revision: '1'
    Meta.helm.sh/release-name: nginx-ingress-infra
    Meta.helm.sh/release-namespace: ingress-infra
spec:
  replicas: 2
  selector:
    matchLabels:
      app: nginx-ingress-infra-nginx-ingress
  template:
    Metadata:
      creationTimestamp: null
      labels:
        app: nginx-ingress-infra-nginx-ingress
      annotations:
        prometheus.io/port: '9113'
        prometheus.io/scrape: 'true'
    spec:
      containers:
        - name: nginx-ingress-infra-nginx-ingress
          image: 'Nginx/nginx-ingress:1.9.1'
          args:
            - '-Nginx-plus=false'
            - '-Nginx-reload-timeout=0'
            - '-enable-app-protect=false'
            - >-
              -Nginx-configmaps=$(POD_NAMESPACE)/nginx-ingress-infra-nginx-ingress
            - >-
              -default-server-tls-secret=$(POD_NAMESPACE)/nginx-ingress-infra-nginx-ingress-default-server-secret
            - '-ingress-class=infra'
            - '-health-status=false'
            - '-health-status-uri=/Nginx-health'
            - '-Nginx-debug=false'
            - '-v=1'
            - '-Nginx-status=true'
            - '-Nginx-status-port=8080'
            - '-Nginx-status-allow-cidrs=127.0.0.1'
            - '-report-ingress-status'
            - '-external-service=nginx-ingress-infra-nginx-ingress'
            - '-enable-leader-election=true'
            - >-
              -leader-election-lock-name=nginx-ingress-infra-nginx-ingress-leader-election
            - '-enable-prometheus-metrics=true'
            - '-prometheus-metrics-listen-port=9113'
            - '-enable-custom-resources=true'
            - '-enable-tls-passthrough=false'
            - '-enable-snippets=false'
            - '-ready-status=true'
            - '-ready-status-port=8081'
            - '-enable-latency-metrics=false'

我对服务名称“帐户”的入口配置：

kind: Ingress
apiVersion: networking.k8s.io/v1beta1
Metadata:
  name: account
  namespace: infra
  resourceVersion: '194790'
  labels:
    app.kubernetes.io/managed-by: Helm
  annotations:
    kubernetes.io/ingress.class: infra
    Meta.helm.sh/release-name: infra
    Meta.helm.sh/release-namespace: infra
    Nginx.ingress.kubernetes.io/affinity: cookie
    Nginx.ingress.kubernetes.io/proxy-buffer-size: 128k
    Nginx.ingress.kubernetes.io/proxy-buffering: 'on'
    Nginx.ingress.kubernetes.io/proxy-buffers-number: '4'
spec:
  tls:
    - hosts:
        - account.infra.mydomain.com
      secretName: my-default-cert **this is a self-signed certificate with cn=account.infra.mydomain.com
  rules:
    - host: account.infra.mydomain.com
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              serviceName: account
              servicePort: 80
status:
  loadBalancer:
    ingress:
      - ip: 123.123.123.123 **redacted**

我的账户服务yaml

kind: Service
apiVersion: v1
Metadata:
  name: account
  namespace: infra
  labels:
    app.kubernetes.io/instance: infra
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: account
    app.kubernetes.io/version: latest
    helm.sh/chart: account-0.1.0
  annotations:
    Meta.helm.sh/release-name: infra
    Meta.helm.sh/release-namespace: infra
spec:
  ports:
    - name: http
      protocol: TCP
      port: 80
      targetPort: 80
  selector:
    app.kubernetes.io/instance: infra
    app.kubernetes.io/name: account
  clusterIP: 10.0.242.212
  type: ClusterIP
  sessionAffinity: ClientIP **just tried to add this setting to the service,but does not work either**
  sessionAffinityConfig:
    clientIP:
      timeoutSeconds: 10800
status:
  loadBalancer: {}

解决方法

好的，问题与上面显示的任何配置无关。 nginx pod 的调试日志充满了关于 kube-control 命名空间的错误消息。我完全删除了 Nginx helm chart 并使用了 Microsoft 建议的存储库：

https://docs.microsoft.com/en-us/azure/aks/ingress-own-tls

# Create a namespace for your ingress resources
kubectl create namespace ingress-basic

# Add the ingress-nginx repository
helm repo add ingress-nginx https://kubernetes.github.io/ingress-nginx

# Use Helm to deploy an NGINX ingress controller
helm install nginx-ingress ingress-nginx/ingress-nginx \
    --namespace ingress-basic \
    --set controller.replicaCount=2 \
    --set controller.nodeSelector."beta\.kubernetes\.io/os"=linux \
    --set defaultBackend.nodeSelector."beta\.kubernetes\.io/os"=linux