如何为Kubernetes Nginx Ingress动态设置X-Forwarded-Prefix头部

nginx.ingress.kubernetes.io/x-forwarded-prefix是全局级别的注解，无法直接按路径段动态赋值。针对你的需求，提供两种可行方案：

方案1：拆分Ingress资源（推荐） #

为每个租户创建独立的Ingress资源，这样可以直接给每个Ingress配置对应的x-forwarded-prefix注解，路由逻辑清晰且易于维护。

Tenant1的Ingress配置 #

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: nginx-ingress-tenant1
  namespace: default
  annotations:
    nginx.ingress.kubernetes.io/affinity: "cookie"
    cert-manager.io/issuer: letsencrypt-prod
    cert-manager.io/acme-challenge-type: http01
    nginx.ingress.kubernetes.io/session-cookie-name: "my-cookie"
    nginx.ingress.kubernetes.io/session-cookie-expires: "172800"
    nginx.ingress.kubernetes.io/session-cookie-max-age: "172800"
    nginx.ingress.kubernetes.io/ssl-redirect: "false"
    nginx.ingress.kubernetes.io/affinity-mode: persistent
    nginx.ingress.kubernetes.io/session-cookie-hash: sha1
    nginx.ingress.kubernetes.io/rewrite-target: /$1
    nginx.ingress.kubernetes.io/upstream-hash-by: "$pod"
    nginx.ingress.kubernetes.io/x-forwarded-prefix: "tenant1"

spec:
  ingressClassName: nginx
  rules:
  - http:
      paths:
      - path: /tenant1(/|$)(.*)
        pathType: Prefix
        backend:
          service:
            name: tenant1lb
            port:
              number: 80
    host: myservice.com
  tls:
    - hosts:
      - myservice.com
      secretName: frontend-prod-tls

Tenant2的Ingress配置 #

只需将上述配置中的name改为nginx-ingress-tenant2，x-forwarded-prefix设为tenant2，后端服务指向tenant2lb即可。

方案2：全局配置片段动态赋值（单Ingress实现） #

如果希望保持单个Ingress资源，可以利用Nginx的正则匹配和configuration-snippet注解，根据请求路径动态设置头部。

修改后的Ingress配置 #

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: nginx-ingress
  namespace: default
  annotations:
    nginx.ingress.kubernetes.io/affinity: "cookie"
    cert-manager.io/issuer: letsencrypt-prod
    cert-manager.io/acme-challenge-type: http01
    nginx.ingress.kubernetes.io/session-cookie-name: "my-cookie"
    nginx.ingress.kubernetes.io/session-cookie-expires: "172800"
    nginx.ingress.kubernetes.io/session-cookie-max-age: "172800"
    nginx.ingress.kubernetes.io/ssl-redirect: "false"
    nginx.ingress.kubernetes.io/affinity-mode: persistent
    nginx.ingress.kubernetes.io/session-cookie-hash: sha1
    nginx.ingress.kubernetes.io/rewrite-target: /$2
    nginx.ingress.kubernetes.io/upstream-hash-by: "$pod"
    # 通过正则匹配路径首段，动态设置X-Forwarded-Prefix
    nginx.ingress.kubernetes.io/configuration-snippet: |
      if ($request_uri ~* "^/([^/]+)/") {
          proxy_set_header X-Forwarded-Prefix $1;
      }
      if ($request_uri ~* "^/([^/]+)$") {
          proxy_set_header X-Forwarded-Prefix $1;
      }

spec:
  ingressClassName: nginx
  rules:
  - http:
      paths:
      - path: /tenant1(/|$)(.*)
        pathType: Prefix
        backend:
          service:
            name: tenant1lb
            port:
              number: 80
      - path: /tenant2(/|$)(.*)
        pathType: Prefix
        backend:
          service:
            name: tenant2lb
            port:
              number: 80
    host: myservice.com
  tls:
    - hosts:
      - myservice.com
      secretName: frontend-prod-tls

方案对比 #

• 方案1：配置独立直观，新增租户只需添加新Ingress，便于后续扩展和故障排查。
• 方案2：保持单Ingress资源，适合租户数量较少的场景，但需要维护正则规则，新增租户时需确保覆盖。

内容的提问来源于stack exchange，提问作者mattb