如何在入口 controller (Kube.netes) 中正确设置重写目标

Question

I've ran into the issue of setting up ingress controller with rewrite-target within my environment.

So the setup is as below:

Within one Blazor application, we have a front-end that faces the user, and one that is responsible for handling the admin panel.

We have two domains:

• domain.com
• admin.domain.com

We have successfully set everything up when it comes to the user-facing front-end as below:

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: {{ .Values.label.name }}-service-ingress
  annotations:
    kubernetes.io/ingress.class: nginx
    cert-manager.io/cluster-issuer: letsencrypt
    nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
    nginx.ingress.kubernetes.io/client-max-body-size: "0"
    nginx.ingress.kubernetes.io/proxy-body-size: "0"
    nginx.ingress.kubernetes.io/proxy-connect-timeout: "3600"
    nginx.ingress.kubernetes.io/proxy-read-timeout: "3600"
    nginx.ingress.kubernetes.io/proxy-send-timeout: "3600"
    nginx.ingress.kubernetes.io/configuration-snippet: |
      location ~* "^/auth/admin(/|$)(.*)" {
        return 404;
      }
spec:
  tls:
  - hosts:
    - domain.com
    secretName: wildcard-domain-com-ingress
  rules:
  - host: domain.com
    http:
      paths:
        - path: /auth(/|$)(.*)
          pathType: Prefix
          backend:
            service:
              name: {{ .Values.label.name }}-service
              port:
                number: {{ .Values.service.port }}

That way, domain.com/auth will serve the UI for the users, where the requests directed towards domain.com/auth/admin will always return 404.

And now, the admin panel setup:

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: {{ .Values.label.name }}-service-admin-ingress
  annotations:
    kubernetes.io/ingress.class: nginx
    cert-manager.io/cluster-issuer: letsencrypt
    nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
    nginx.ingress.kubernetes.io/client-max-body-size: "0"
    nginx.ingress.kubernetes.io/proxy-body-size: "0"
    nginx.ingress.kubernetes.io/proxy-connect-timeout: "3600"
    nginx.ingress.kubernetes.io/proxy-read-timeout: "3600"
    nginx.ingress.kubernetes.io/proxy-send-timeout: "3600"
    nginx.ingress.kubernetes.io/use-regex: "true"
    nginx.ingress.kubernetes.io/rewrite-target: /auth/admin/$1
spec:
  tls:
    - hosts:
        - admin.domain.com
      secretName: wildcard-domain-com-ingress
  rules:
    - host: admin.domain.com
      http:
        paths:
          - path: /auth/(.*)
            pathType: Prefix
            backend:
              service:
                name: {{ .Values.label.name }}-service
                port:
                  number: {{ .Values.service.port }}

What we would like to achieve here, is that if an administrator will enter below url:

• https://admin.domain.com/auth/userlist

the application behind will actually get called at:

• /auth/admin/userlist

We've tried to set it up with the rewrite-target as specified in above specification, however it doesn't work.

Can someone direct us on what we are doing wrong in this case?

Below you can find full ingress specification, where last handles serving static files for the admin panel and Blazor server connectivity.

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: {{ .Values.label.name }}-service-ingress
  annotations:
    kubernetes.io/ingress.class: nginx
    cert-manager.io/cluster-issuer: letsencrypt
    nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
    nginx.ingress.kubernetes.io/client-max-body-size: "0"
    nginx.ingress.kubernetes.io/proxy-body-size: "0"
    nginx.ingress.kubernetes.io/proxy-connect-timeout: "3600"
    nginx.ingress.kubernetes.io/proxy-read-timeout: "3600"
    nginx.ingress.kubernetes.io/proxy-send-timeout: "3600"
    nginx.ingress.kubernetes.io/configuration-snippet: |
      location ~* "^/auth/admin(/|$)(.*)" {
        return 404;
      }
spec:
  tls:
  - hosts:
    - domain.com
    secretName: wildcard-domain-com-ingress
  rules:
  - host: domain.com
    http:
      paths:
        - path: /auth(/|$)(.*)
          pathType: Prefix
          backend:
            service:
              name: {{ .Values.label.name }}-service
              port:
                number: {{ .Values.service.port }}
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: {{ .Values.label.name }}-service-admin-ingress
  annotations:
    kubernetes.io/ingress.class: nginx
    cert-manager.io/cluster-issuer: letsencrypt
    nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
    nginx.ingress.kubernetes.io/client-max-body-size: "0"
    nginx.ingress.kubernetes.io/proxy-body-size: "0"
    nginx.ingress.kubernetes.io/proxy-connect-timeout: "3600"
    nginx.ingress.kubernetes.io/proxy-read-timeout: "3600"
    nginx.ingress.kubernetes.io/proxy-send-timeout: "3600"
    nginx.ingress.kubernetes.io/use-regex: "true"
    nginx.ingress.kubernetes.io/rewrite-target: /auth/admin/$1
spec:
  tls:
    - hosts:
        - admin.domain.com
      secretName: wildcard-domain-com-ingress
  rules:
    - host: admin.domain.com
      http:
        paths:
          - path: /auth/(.*)
            pathType: Prefix
            backend:
              service:
                name: {{ .Values.label.name }}-service
                port:
                  number: {{ .Values.service.port }}
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: {{ .Values.label.name }}-service-admin-styles-ingress
  annotations:
    kubernetes.io/ingress.class: nginx
    cert-manager.io/cluster-issuer: letsencrypt
    nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
    nginx.ingress.kubernetes.io/client-max-body-size: "0"
    nginx.ingress.kubernetes.io/proxy-body-size: "0"
    nginx.ingress.kubernetes.io/proxy-connect-timeout: "3600"
    nginx.ingress.kubernetes.io/proxy-read-timeout: "3600"
    nginx.ingress.kubernetes.io/proxy-send-timeout: "3600"
spec:
  tls:
    - hosts:
        - admin.domain.com
      secretName: wildcard-domain-com-ingress
  rules:
    - host: admin.domain.com
      http:
        paths:
          - path: /auth/icons(/|$)(.*)
            pathType: Prefix
            backend:
              service:
                name: {{ .Values.label.name }}-service
                port:
                  number: {{ .Values.service.port }}
          - path: /auth/img(/|$)(.*)
            pathType: Prefix
            backend:
              service:
                name: {{ .Values.label.name }}-service
                port:
                  number: {{ .Values.service.port }}
          - path: /auth/js(/|$)(.*)
            pathType: Prefix
            backend:
              service:
                name: {{ .Values.label.name }}-service
                port:
                  number: {{ .Values.service.port }}
          - path: /auth/styles(/|$)(.*)
            pathType: Prefix
            backend:
              service:
                name: {{ .Values.label.name }}-service
                port:
                  number: {{ .Values.service.port }}
          - path: /auth/favicon.ico
            pathType: Prefix
            backend:
              service:
                name: {{ .Values.label.name }}-service
                port:
                  number: {{ .Values.service.port }}
          - path: /auth/_framework(/|$)(.*)
            pathType: Prefix
            backend:
              service:
                name: {{ .Values.label.name }}-service
                port:
                  number: {{ .Values.service.port }}
          - path: /auth/_blazor(/|$)(.*)
            pathType: Prefix
            backend:
              service:
                name: {{ .Values.label.name }}-service
                port:
                  number: {{ .Values.service.port }}

Answer 1

Since you are trying to deploy two different views for the same application, you can use header annotations of nginx ingress controller to perform rewrite operations. A detailed description of various examples are provided here . Go through this for your reference and better understanding and in the code you are trying to access the same directory so can you try to mention a specific path to the admin console or create a separate path for the admin console and try again.