如何为K8s Nginx Ingress的location /添加代理请求头？

我要把一段Nginx配置转换成Kubernetes Ingress配置，过程中遇到了几个问题：

• 用server-snippet注解时，配置片段被加到server块而非location /块，不符合需求
• 尝试在server-snippet里直接定义location /，触发「duplicate location "/"」报错
• 换成location-snippet注解后，Ingress显示同步事件正常，但实际生成的nginx.conf没更新

原Nginx配置 #

events {}

http {
    server {
        listen 8080;
        server_name *.mydomain.com;

        location / {
            return 301 https://$host$request_uri;
        }
    }

    server {
        listen 8443 ssl;
        server_name *.mydomain.com;

        ssl_certificate /etc/ssl/certs/mycert.pem;
        ssl_certificate_key /etc/ssl/certs/mykey.pem;

        location / {
            proxy_pass http://my-webapp:8080;
            proxy_set_header X-Forwarded-Proto https;
            proxy_set_header Host $host:$server_port;
            proxy_set_header X-Real-IP $remote_addr;

        }
    }
}

我的尝试过程 #

初始Ingress配置（用server-snippet） #

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: nginx-ingress
  annotations:
    nginx.ingress.kubernetes.io/server-snippet: |
      proxy_set_header X-Forwarded-Proto https;
      proxy_set_header Host $host:$server_port;
      proxy_set_header X-Real-IP $remote_addr;
      proxy_set_header X-Forwarded-For $remote_addr;
      
spec:
  tls:
    - hosts:
        - "*.mydomin.com"
      secretName:mydomain-ssl
  rules:
    - host: "*.mydomain.com"
      http:
        paths:
          - pathType: Prefix
            path: "/"
            backend:
              service:
                name: my-webapp
                port:
                  number: 8080

问题：配置片段被放到server块，不是目标的location /块。

尝试在server-snippet里定义location / #

nginx.ingress.kubernetes.io/server-snippet: |
  location / {
    proxy_set_header X-Forwarded-Proto https;
    proxy_set_header Host $host:$server_port;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $remote_addr;
  }

问题：触发「duplicate location "/"」报错，因为Ingress控制器会自动生成location /块，手动添加导致重复。

改用location-snippet注解 #

nginx.ingress.kubernetes.io/location-snippet:
  proxy_set_header X-Forwarded-Proto https;
  proxy_set_header Host $host:$server_port;
  proxy_set_header X-Real-IP $remote_addr;
  proxy_set_header X-Forwarded-For $remote_addr;

问题：Ingress显示同步事件正常，但实际nginx.conf没更新。同步事件信息如下：

kubectl describe ingress

Annotations:        nginx.ingress.kubernetes.io/location-snippet:
                      proxy_set_header X-Forwarded-Proto https;
                      proxy_set_header Host $host:$server_port;
                      proxy_set_header X-Real-IP $remote_addr;
Events:
  Type    Reason  Age                     From                      Message
  ----    ------  ----                    ----                      -------
  Normal  Sync    5m31s (x11 over 2d21h)  nginx-ingress-controller  Scheduled for sync

解决方案 #

1. 修复location-snippet的YAML格式错误 #

你用location-snippet时犯了YAML格式错误：没有用|标记多行字符串，导致注解内容被解析成YAML列表，Ingress控制器无法识别为Nginx配置片段。正确写法如下：

nginx.ingress.kubernetes.io/location-snippet: |
  proxy_set_header X-Forwarded-Proto https;
  proxy_set_header Host $host:$server_port;
  proxy_set_header X-Real-IP $remote_addr;
  proxy_set_header X-Forwarded-For $remote_addr;

2. 实现HTTP转HTTPS重定向 #

原Nginx配置里的80端口转HTTPS规则，直接用Ingress官方注解就能实现：

nginx.ingress.kubernetes.io/ssl-redirect: "true"

这个注解默认值就是true，显式声明更清晰，控制器会自动生成HTTP到HTTPS的重定向规则。

3. 完整的正确Ingress配置 #

还要注意原配置里的拼写错误：*.mydomin.com应该是*.mydomain.com，secretName:mydomain-ssl缺少空格，这些都会导致配置失效。最终正确配置如下：

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: nginx-ingress
  annotations:
    nginx.ingress.kubernetes.io/ssl-redirect: "true"
    nginx.ingress.kubernetes.io/location-snippet: |
      proxy_set_header X-Forwarded-Proto https;
      proxy_set_header Host $host:$server_port;
      proxy_set_header X-Real-IP $remote_addr;
      proxy_set_header X-Forwarded-For $remote_addr;
spec:
  tls:
    - hosts:
        - "*.mydomain.com"
      secretName: mydomain-ssl
  rules:
    - host: "*.mydomain.com"
      http:
        paths:
          - pathType: Prefix
            path: "/"
            backend:
              service:
                name: my-webapp
                port:
                  number: 8080

4. 验证配置生效 #

• 更新Ingress：kubectl apply -f ingress.yaml
• 查看Ingress控制器日志，确认无报错：kubectl logs -n <ingress-controller-namespace> <ingress-controller-pod-name>
• 进入控制器Pod检查生成的nginx.conf：kubectl exec -n <ingress-controller-namespace> <ingress-controller-pod-name> -- cat /etc/nginx/nginx.conf | grep -A 10 "location /"

内容的提问来源于stack exchange，提问作者eastwater