部署了Ingress服务，发现Ingress服务在Master节点无法访问，在很多的Node节点上也无法访问，但是在其中一个Node上却可以访问。ChatGPT提醒我，检查是否externalTrafficPolicy: Local。

通过如下的命令，可以发现Ingress中externalTrafficPolicy: Local，其他服务externalTrafficPolicy: Cluster。

wanna@dell-server-k8s-master01:~$ kubectl get svc ingress-nginx-controller -n ingress-nginx -o yaml | grep externalTrafficPolicy
      {"apiVersion":"v1","kind":"Service","metadata":{"annotations":{},"labels":{"app.kubernetes.io/component":"controller","app.kubernetes.io/instance":"ingress-nginx","app.kubernetes.io/name":"ingress-nginx","app.kubernetes.io/part-of":"ingress-nginx","app.kubernetes.io/version":"1.12.0-beta.0"},"name":"ingress-nginx-controller","namespace":"ingress-nginx"},"spec":{"externalTrafficPolicy":"Local","ipFamilies":["IPv4"],"ipFamilyPolicy":"SingleStack","ports":[{"appProtocol":"http","name":"http","nodePort":31888,"port":80,"protocol":"TCP","targetPort":"http"},{"appProtocol":"https","name":"https","nodePort":31889,"port":443,"protocol":"TCP","targetPort":"https"}],"selector":{"app.kubernetes.io/component":"controller","app.kubernetes.io/instance":"ingress-nginx","app.kubernetes.io/name":"ingress-nginx"},"type":"NodePort"}}
  externalTrafficPolicy: Local

wanna@dell-server-k8s-master01:~$ kubectl get svc halo-prod-service -n halo-prod -o yaml | grep externalTrafficPolicy
  externalTrafficPolicy: Cluster

两种类型的对比：

Cluster (默认)：

  • 任何 Node 的 NodePort 都可以接受流量，并通过 kube-proxy 负载均衡到 Ingress Pod ， 所有 Node 都能访问，流量会自动分发
  • 可能会影响客户端真实 IP

Local：

  • 只有运行 Ingress Controller 的 Node 才能处理流量，直接转发到本地 Pod ✅，能保留客户端真实 IP，减少 kube-proxy 额外转发
  • ❌可能导致部分 NodePort 不可用