GCP经典应用负载均衡URL重写与后端映射不符合预期求助

核心问题分析 #

从你的配置和验证结果来看，存在两个关键问题：

1. 所有非/auth/*路径的请求被错误路由到my-auth-be后端存储桶
2. /auth/*路径的URL重写未按预期生效

问题根源与修复方案 #

1. 非/auth路径误匹配的原因 #

你使用了pathTemplateMatch: /auth/{path=**}这种高级模板匹配语法，在经典ALB中，该语法的变量捕获逻辑若未正确触发，可能意外匹配所有路径（比如当path变量被解析为空时，会错误匹配根路径或其他非/auth路径）。

修复：改用前缀匹配替代模板匹配
前缀匹配更适合/auth/*这类路径场景，逻辑直观且不易出错。修改routeRules中的匹配规则：

routeRules:
- matchRules:
  - pathPrefixMatch: /auth/  # 替换原pathTemplateMatch
  priority: 1
  service: https://www.googleapis.com/compute/v1/projects/my-project/global/backendBuckets/my-auth-be
  routeAction:
    urlRewrite:
      pathPrefixRewrite: /  # 替换原pathTemplateRewrite

2. URL重写未生效的原因 #

pathTemplateRewrite依赖模板匹配的变量捕获，对于后端存储桶（backendBucket）可能存在兼容性问题，导致变量无法正确解析。改用pathPrefixRewrite直接替换前缀，逻辑更可靠：

• 当请求路径为/auth/handler时，pathPrefixMatch: /auth/会匹配前缀，pathPrefixRewrite: /会将前缀替换为空，最终路径变为/handler，符合预期。

3. 测试用例格式错误 #

测试用例中的path字段应填写域名后的路径部分（如""、"/"），而非完整URL。完整URL会导致验证工具解析路径出错，影响测试结果准确性。修正后的测试用例：

tests:
- description: Empty path routes to my-main-be
  host: example.com
  path: ""
  service: projects/my-project/global/backendServices/my-main-be
  expectedOutputUrl: https://example.com

- description: / routes to my-main-be
  host: example.com
  path: "/"
  service: projects/my-project/global/backendServices/my-main-be
  expectedOutputUrl: https://example.com/

- description: /unknown routes to my-main-be
  host: example.com
  path: "/unknown"
  service: projects/my-project/global/backendServices/my-main-be
  expectedOutputUrl: https://example.com/unknown

- description: /auth/handler routes to my-auth-be
  host: example.com
  path: "/auth/handler"
  service: projects/my-project/global/backendBuckets/my-auth-be
  expectedOutputUrl: https://example.com/handler

完整修正后的配置 #

defaultService: https://www.googleapis.com/compute/v1/projects/my-project/global/backendServices/my-main-be
hostRules:
- hosts: [example.com, '*.example.com']
  pathMatcher: path-matcher-1
name: my-urlmap
pathMatchers:
- defaultService: https://www.googleapis.com/compute/v1/projects/my-project/global/backendServices/my-main-be
  name: path-matcher-1
  routeRules:
  - matchRules:
    - pathPrefixMatch: /auth/
    priority: 1
    service: https://www.googleapis.com/compute/v1/projects/my-project/global/backendBuckets/my-auth-be
    routeAction:
      urlRewrite:
        pathPrefixRewrite: /

tests:
- description: Empty path routes to my-main-be
  host: example.com
  path: ""
  service: projects/my-project/global/backendServices/my-main-be
  expectedOutputUrl: https://example.com

- description: / routes to my-main-be
  host: example.com
  path: "/"
  service: projects/my-project/global/backendServices/my-main-be
  expectedOutputUrl: https://example.com/

- description: /unknown routes to my-main-be
  host: example.com
  path: "/unknown"
  service: projects/my-project/global/backendServices/my-main-be
  expectedOutputUrl: https://example.com/unknown

- description: /auth/handler routes to my-auth-be
  host: example.com
  path: "/auth/handler"
  service: projects/my-project/global/backendBuckets/my-auth-be
  expectedOutputUrl: https://example.com/handler

验证命令 #

执行以下命令验证修正后的配置：

gcloud compute url-maps validate --source ./my-map --load-balancing-scheme=EXTERNAL --global

验证通过后，更新负载均衡的URL-Map配置即可生效。

内容的提问来源于stack exchange，提问作者David