Kubernetes 入口/NGINX 重写不匹配，而正则表达式似乎有效

Question

I'm trying to filter out all paths that begin with /something . While the regex seems PCRE valid by online testers, the result is 404 for all paths:

kind: Ingress
metadata:
  annotations:
    nginx.ingress.kubernetes.io/rewrite-target: /$1
spec:
  rules:
  - host: myhost.com
    http:
      paths:
      - backend:
          serviceName: myservice
          servicePort: 80          
        path: /^([^something].*)

Tried to play with the regex (eg, path: /(^[^something])(.*) ), but still get 404 for all.

What am I missing?

Using v1.12.2 client with v1.14.1 server.

Answer 1

If you want to deny all traffic to /something you should use Nginx annotations called server-snipped . It will allow you to add custom configuration.

It would look like:

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
   name: nginx-snippet
   annotations:
      nginx.ingress.kubernetes.io/configuration-snippet: |

      location /something {

           deny all;  
      }

Fimilar example can be found on Github thread.

You can also consider second option with 2 ingress objects and authentication . This was mentioned in another StackOverflow question .

In addition, you can deny access not only by location but also with specific IP. It can be obtain using annotation called whitelist-source-range .