K8s集群K8s集群Kong路由配置调优实操技术栈Kong Gateway v3.5.x Kubernetes v1.32.13 Rocky Linux 8.6 PostgreSQL 15 Kong Ingress Controller 2.12操作环境 / 对接原理 / 详细步骤 / 完整命令 / 配置文件 / 验证流程 / 排错方案K8s集群K8s集群Kong路由配置调优实操操作环境Kong Gateway v3.5.x已部署在 kong 命名空间K8s 集群 v1.32.13Rocky Linux 8.6PostgreSQL 15 作为配置存储或DBless模式Kong Ingress Controller (KIC) v2.12.x 已安装Konga Dashboard 已部署用于Web管理后端微服务部署在 default 命名空间kubectl v1.32.13Kong Admin API 已配置对接原理Kong Gateway 是开源 API 网关基于 OpenRestyNginx LuaJIT支持插件扩展、负载均衡、限流、认证。两种部署模式DB模式PostgreSQL/Cassandra存储配置支持多节点和 DBless 模式配置通过声明式YAML加载适合K8s。核心概念Service后端服务抽象、Route路由规则关联Service、Consumer消费者、Plugin插件全局/服务/路由/消费者级别、Upstream上游负载均衡、Target上游节点。Kong Ingress Controller 监听 K8s Ingress/HTTPRoute/KongPlugin/KongConsumer 等 CRD自动配置 Kong 路由和插件。流量处理客户端 - Kong - 路由匹配 - 插件链 - Service - Upstream负载均衡 - 后端Pod。Kong 企业版提供更多高级插件Vitals、Dev Portal、RBAC开源版已覆盖常用网关功能。高可用Kong 多副本无状态PostgreSQL 主从或外部托管K8s Service 前置负载均衡。详细步骤1. 配置Service与Route# Admin API创建Service curl -i -X POST http://localhost:8001/services/ \ --data namemyapp-service \ --data urlhttp://myapp.default.svc.cluster.local:8080 # 创建Route curl -i -X POST http://localhost:8001/services/myapp-service/routes \ --data paths[]/api \ --data methods[]GET \ --data methods[]POST \ --data hosts[]api.example.com # 查看 curl http://localhost:8001/services curl http://localhost:8001/routes # 通过IngressKIC cat kong-ingress.yaml EOF apiVersion: networking.k8s.io/v1 kind: Ingress metadata: name: myapp-ingress namespace: default annotations: konghq.com/strip-path: true spec: ingressClassName: kong rules: - host: api.example.com http: paths: - path: /api pathType: Prefix backend: service: name: myapp port: number: 8080 EOF kubectl apply -f kong-ingress.yaml # HTTPRouteGateway API cat kong-httproute.yaml EOF apiVersion: gateway.networking.k8s.io/v1 kind: HTTPRoute metadata: name: myapp-route spec: parentRefs: - name: kong hostnames: - api.example.com rules: - matches: - path: type: PathPrefix value: /api backendRefs: - name: myapp port: 8080 EOF # 测试 curl -v -H Host: api.example.com http://kong-proxy/api/test验证流程# 1. 验证Kong运行 kubectl get pods -n kong # 2. 验证路由 curl -v -H Host: api.example.com http://kong-proxy/api/test # 3. 验证插件 # 限流超过限制返回429 # 认证无key返回401有key返回200 # 4. 验证负载均衡 for i in {1..20}; do curl -s http://kong-proxy/api/version; done | sort | uniq -c # 5. 验证健康检查 curl http://localhost:8001/upstreams/name/health # 6. 验证灰度 curl -H x-canary: true http://kong-proxy/api/version # 7. 查看监控 curl http://localhost:8001/metrics | grep kong排错方案路由404检查Route的paths/methods/hosts是否匹配请求Service是否关联Routestrip-path配置KIC是否同步配置Kong日志查看路由匹配上游502检查Service host是否正确Upstream target是否健康后端Pod是否Running端口是否正确网络策略DNS解析插件不生效检查插件是否绑定到正确的Service/Route/Consumer插件配置参数插件是否启用插件优先级Kong错误日志认证失败检查Consumer是否创建凭证是否正确请求header名称JWT算法/密钥/过期时间插件配置key_namesDBless配置不更新检查ConfigMap是否更新Kong是否reloaddeclarative_config路径KIC是否推送配置Kong启动日志KIC不同步检查Ingress Class是否为kongCRD是否安装KIC日志RBAC权限Kong Admin API连通性annotations格式性能问题增加Kong副本调整nginx worker_processes/worker_connections启用缓存上游keepalive分析access_log耗时升级实例规格HTTPS错误检查证书SecretKong TLS配置SNI匹配证书链完整私钥匹配强制HTTPS跳转配置