我最近将我的gke集群升级到1.14.x，并将nginxingress升级到最新版本0.26.1。在某个时候，我的生殖器停止了工作。
例如，当尝试使用curl INGRESS_IP -H "host:nexus.myorg.com"访问Nexus时，以下是入口控制器日志：
2019/11/07 08:35:49 [error] 350#350: *2664 upstream timed out (110: Connection timed out) while connecting to upstream, client: 82.81.2.76, server: nexus.myorg.com, request: "GET / HTTP/1.1", upstream: "http://10.8.25.3:8081/", host: "nexus.myorg.com"
2019/11/07 08:35:54 [error] 350#350: *2664 upstream timed out (110: Connection timed out) while connecting to upstream, client: 82.81.2.76, server: nexus.myorg.com, request: "GET / HTTP/1.1", upstream: "http://10.8.25.3:8081/", host: "nexus.myorg.com"
2019/11/07 08:35:59 [error] 350#350: *2664 upstream timed out (110: Connection timed out) while connecting to upstream, client: 82.81.2.76, server: nexus.myorg.com, request: "GET / HTTP/1.1", upstream: "http://10.8.25.3:8081/", host: "nexus.myorg.com"
82.81.2.76 - - [07/Nov/2019:08:35:59 +0000] "GET / HTTP/1.1" 504 173 "-" "curl/7.64.1" 79 15.003 [some-namespace-nexus-service-8081] [] 10.8.25.3:8081, 10.8.25.3:8081, 10.8.25.3:8081 0, 0, 0 5.001, 5.001, 5.001 504, 504, 504 a03f13a3bfc943e44f2df3d82a6ecaa4
正如你所看到的，它尝试连接三次到10.8.25.3:8801，这是pod IP，所有这些都超时了。
我已经进入一个pod，并使用相同的IP访问该pod，没有任何问题：curl 10.8.25.3:8081。因此服务设置正确。
这是我的Ingress配置：
apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
name: my-ingress
namespace: some-namespace
annotations:
kubernetes.io/ingress.class: nginx
nginx.ingress.kubernetes.io/ssl-redirect: "true"
nginx.ingress.kubernetes.io/add-base-url: "true"
nginx.ingress.kubernetes.io/proxy-body-size: 30M
spec:
rules:
- host: nexus.myorg.com
http:
paths:
- backend:
serviceName: nexus-service
servicePort: 8081
知道如何解决这个问题吗？
问题与网络策略有关。我们有一些策略禁止从其他命名空间访问pod，只允许从入口命名空间访问
apiVersion: extensions/v1beta1
kind: NetworkPolicy
metadata:
name: allow-from-ingress-namespace
namespace: some-namespace
spec:
ingress:
- from:
- namespaceSelector:
matchLabels:
type: ingress
podSelector: {}
policyTypes:
- Ingress
apiVersion: extensions/v1beta1
kind: NetworkPolicy
metadata:
name: deny-from-other-namespaces
namespace: some-namespace
spec:
ingress:
- from:
- podSelector: {}
podSelector: {}
policyTypes:
- Ingress
升级后，我们丢失了策略中匹配的标签(类型=入口(。简单地添加它就解决了问题：kubectl label namespaces ingress-nginx type=ingress