如何在K8s中暴露/.well-known/路径下的静态资源？

修复Ingress配置消除警告 #

你遇到的警告是因为/.well-known路径与Prefix类型的路径规则不兼容，以下两种方式可以正确配置路由：

方式一：使用正则表达式路径 #

利用已启用的use-regex注解，用正则匹配所有/.well-known/下的请求，指定pathType为ImplementationSpecific：

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-production
    nginx.ingress.kubernetes.io/use-regex: "true"
    nginx.ingress.kubernetes.io/app-root: /ui/
  name: app-ingress
  namespace: app
spec:
  ingressClassName: nginx
  tls:
    - hosts:
      - app.my-domain.net
      secretName: app-tls
  rules:
  - host: app.my-domain.net
    http:
      paths:
      - path: ^/.well-known(/.*)?$
        pathType: ImplementationSpecific
        backend:
          service:
            name: well-known-static-resources
            port:
              number: 80
      # 此处可添加其他路径规则，比如/ui/的路由

方式二：使用带尾斜杠的Prefix路径 #

如果不想用正则，将路径改为/.well-known/（带尾斜杠），保持pathType为Prefix，这样只会匹配以/.well-known/开头的请求，避免警告：

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-production
    nginx.ingress.kubernetes.io/app-root: /ui/
  name: app-ingress
  namespace: app
spec:
  ingressClassName: nginx
  tls:
    - hosts:
      - app.my-domain.net
      secretName: app-tls
  rules:
  - host: app.my-domain.net
    http:
      paths:
      - path: /.well-known/
        pathType: Prefix
        backend:
          service:
            name: well-known-static-resources
            port:
              number: 80

更优方案：直接从Nginx Ingress Controller提供资源 #

无需额外的Deployment和Service，可将静态文件挂载到Nginx Ingress Controller Pod中直接提供服务，减少资源开销：

1. 创建包含静态文件的ConfigMap #

将assetlinks.json和apple-app-site-association内容存入ConfigMap：

apiVersion: v1
kind: ConfigMap
metadata:
  name: well-known-files
  namespace: app
data:
  assetlinks.json: |
    {
      "relation": ["delegate_permission/common.handle_all_urls"],
      "target": {
        "namespace": "android_app",
        "package_name": "com.your.app",
        "sha256_cert_fingerprints": ["你的证书指纹"]
      }
    }
  apple-app-site-association: |
    {
      "applinks": {
        "apps": [],
        "details": [
          {
            "appID": "你的TeamID.com.your.app",
            "paths": ["*"]
          }
        ]
      }
    }

2. 将ConfigMap挂载到Nginx Ingress Controller #

如果用Helm部署Ingress Controller，在values.yaml中添加以下配置：

extraVolumes:
  - name: well-known-files
    configMap:
      name: well-known-files
      namespace: app

extraVolumeMounts:
  - name: well-known-files
    mountPath: /usr/share/nginx/html/.well-known
    readOnly: true

然后升级Helm发布：

helm upgrade nginx-ingress ingress-nginx/ingress-nginx -f values.yaml -n ingress-nginx

若使用原生Deployment/DaemonSet，直接编辑资源添加对应的Volume和VolumeMount即可。

3. 更新Ingress配置 #

通过server-snippet注解定义/.well-known/的访问规则，无需额外后端服务：

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-production
    nginx.ingress.kubernetes.io/app-root: /ui/
    nginx.ingress.kubernetes.io/server-snippet: |
      location /.well-known/ {
          root /usr/share/nginx/html;
          default_type application/json;
          try_files $uri $uri/ =404;
      }
  name: app-ingress
  namespace: app
spec:
  ingressClassName: nginx
  tls:
    - hosts:
      - app.my-domain.net
      secretName: app-tls
  rules:
  - host: app.my-domain.net
    http:
      paths:
      # 此处添加其他路径规则，比如/ui/的路由

内容的提问来源于stack exchange，提问作者ch4mp