Kubernetes NGINX反向代理入口控制器中的按路径重写 [英] Per-path rewrite in an Kubernetes NGINX reverse proxy ingress controller

问题描述

我正在建立一个Kubernetes集群，其中包含三个应用程序，每个应用程序都在各自的pod和服务中运行.这些应用程序的Web前端应该可以在端口80、9000和15672上访问.在它们自己的pod和服务中还运行着许多Backend-API，它们应该在各自的端口上可以访问.通过具有以下入口定义的NGINX反向代理访问集群:

I'm setting up a Kubernetes cluster which contains three applications, each running within their own respective pod and service. The web frontends of these applications should be accesible at ports 80, 9000 and 15672. There are also a number of Backend-APIs running in their own pods and services, which should be accesible at their respective ports. The cluster is accessed through a NGINX reverse proxy with the following ingress-definition:

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: my-ingress
  namespace: my-namespace
  annotations:
    kubernetes.io/ingress.class: "nginx"
    nginx.ingress.kubernetes.io/use-regex: "true"
spec:
  tls:
  - hosts:
    - myapp.com
    secretName: my-certificat
  rules:
  - host: myapp.com
    http:
      paths:
      - backend:
          serviceName: my-service-1
          servicePort: 8092
        path: /api/someroute/(.*)
      - backend:
          serviceName: my-service-2
          servicePort: 30003
        path: /api/someotherroute/(.*)
      - backend:
          serviceName: my-other-frontend
          servicePort: 9000
        path: /other/(.*)
      - backend:
          serviceName: my-yetanother-frontend
          servicePort: 15672
        path: /yetanother/(.*)
      - backend:
          serviceName: my-main-frontend
          servicePort: 80
        path: /(.*)

这适用于api服务，但不适用于前端.如果在浏览器中输入像myapp.com/other/这样的URI，它将调用my-other-frontend:9000/other/，而不是my-other-frontend:9000/.当然，这可以使用nginx.ingress.kubernetes.io/rewrite-target: /$1这样的重写注释来解决，问题是，这也将适用于api服务，并且那些服务实际上在其调用中需要完整的路由，因此一般的重写规则会破坏它们.

This works for the api-services, but not for the frontends. Was I to enter a URI like myapp.com/other/ in my browser it would make a call to my-other-frontend:9000/other/, instead of my-other-frontend:9000/. This can of course be solved with a rewrite annotation like nginx.ingress.kubernetes.io/rewrite-target: /$1, the problem is, that this would also apply to the api-services, and those actually need the complete route in their call, so a general rewrite rule would break them.

所以我的问题是:是否可以定义仅适用于特定路径的重写规则?

推荐答案

我建议根据您的不同注释将您的入口分为2个.

I would advise to split your ingress into 2 based on your different annotations.

1)第一个api服务，称为my-api-ingress

1) First one for api-services, called my-api-ingress

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: my-api-ingress
  namespace: my-namespace
  annotations:
    kubernetes.io/ingress.class: "nginx"
    nginx.ingress.kubernetes.io/use-regex: "true"
spec:
  tls:
  - hosts:
    - myapp.com
    secretName: my-certificat
  rules:
  - host: myapp.com
    http:
      paths:
      - backend:
          serviceName: my-service-1
          servicePort: 8092
        path: /api/someroute/(.*)
      - backend:
          serviceName: my-service-2
          servicePort: 30003
        path: /api/someotherroute/(.*)

2)第二个，让my-front-ingress带有nginx.ingress.kubernetes.io/rewrite-target: /$1批注来说明其余的前端.根据您的问题，我相信您不需要使用重写批注创建入口的详细说明.

2) And second one, lets say my-front-ingress with nginx.ingress.kubernetes.io/rewrite-target: /$1 annotation for rest of your frontends. Based on your question I believe you dont need the detailed instruction for ingress creation with rewrite annotation.

是的，可以使用同一主机创建多个入口.但是请注意确切的nginx入口.请参考@LazerBass answer 进行调查.

Yes, its possible to create multiple ingresses with the same host. But please pay attention which exactly nginx ingress. Refer to @LazerBass answer with his investigations.

简而言之，基于 nginx入口比较表，

nginxinc 控制器不支持将Ingress规则与同一主机合并.您只能将它与可合并的入口一起使用

The nginxinc controller does not support merging Ingress rules with the same host. You can use it only with Mergeable Ingresses

最简单的方法是使用常规的 kubernetes/ingress-nginx

The easiest way is to use regular kubernetes/ingress-nginx

希望有帮助.

这篇关于Kubernetes NGINX反向代理入口控制器中的按路径重写的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！