如何在ingress-nginx中用Lua脚本拦截路径？配置失效求助

问题根源 #

你在server-snippet里手动添加的location /app-2是普通前缀匹配规则，而ingress-nginx会根据Ingress spec中path: /app-2和pathType: Prefix自动生成正则匹配的location（格式为~* ^/app-2(/|$)）。按照nginx的location匹配优先级，正则匹配的优先级高于普通前缀匹配，所以请求会被自动生成的location接管，根本不会进入你手动定义的location块，导致Lua拦截脚本完全没执行。

可行解决方法 #

方法一：修改server-snippet为正则匹配规则

将手动定义的location改成和自动生成规则一致的正则匹配，并且因为server-snippet的内容会被插入到自动生成的location之前，所以会优先匹配执行：

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: example-ingress
  annotations:
    nginx.ingress.kubernetes.io/rewrite-target: /$1
    nginx.ingress.kubernetes.io/server-snippet: |
      location ~* ^/app-2(/|$) {
            rewrite_by_lua_block {
              ngx.status = 403;
              ngx.exit(ngx.HTTP_FORBIDDEN);
        }
      }
spec:
  rules:
    - http:
        paths:
          - path: /app-1
            pathType: Prefix
            backend:
              service:
                name: app-1
                port:
                  number: 80
          - path: /app-2
            pathType: Prefix
            backend:
              service:
                name: app-2
                port:
                  number: 80

方法二：用全局snippet加路径判断

如果需要在全局范围内对特定路径做拦截，可使用configuration-snippet插入Lua脚本，通过路径判断只对/app-2生效：

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: example-ingress
  annotations:
    nginx.ingress.kubernetes.io/rewrite-target: /$1
    nginx.ingress.kubernetes.io/configuration-snippet: |
      rewrite_by_lua_block {
        if string.sub(ngx.var.uri, 1, 6) == "/app-2" then
          ngx.status = 403
          ngx.exit(ngx.HTTP_FORBIDDEN)
        end
      }
spec:
  rules:
    - http:
        paths:
          - path: /app-1
            pathType: Prefix
            backend:
              service:
                name: app-1
                port:
                  number: 80
          - path: /app-2
            pathType: Prefix
            backend:
              service:
                name: app-2
                port:
                  number: 80

验证操作 #

修改配置后执行：

kubectl apply -f your-ingress.yaml

等待ingress-nginx控制器更新配置，再执行curl http://A.B.C.D/app-2，此时应该返回403 Forbidden状态码。

内容的提问来源于stack exchange，提问作者Xavier123