为Kubernetes不同Service配置差异化Ingress重写规则

针对你的需求，这里提供两种可行的解决方案，既满足Keycloak的路径重写需求，又不影响其他服务的正常转发：

方案1：单个Ingress中通过配置片段实现局部重写 #

保留原有Ingress结构，添加全局配置片段仅对Keycloak路径执行重写，其他服务不受影响。修改后的配置如下：

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: testhost-ingress
  annotations:
    nginx.ingress.kubernetes.io/use-regex: "true"
    nginx.ingress.kubernetes.io/configuration-snippet: |
      # 仅匹配Keycloak路径，移除/api/keycloak前缀
      rewrite ^/api/keycloak(/|$)(.*)$ /$2 break;
spec:
  rules:
    - host: testhost-ingress.info
      http:
        paths:
          - path: /api/keycloak(/|$)(.*)
            pathType: Prefix
            backend:
              service:
                name: keycloak
                port:
                  number: 8080
          - path: /api/departments(/|$)(.*)
            pathType: Prefix
            backend:
              service:
                name: department
                port:
                  number: 8080
          - path: /api/employees(/|$)(.*)
            pathType: Prefix
            backend:
              service:
                name: employee
                port:
                  number: 8080
          - path: /v2(/|$)(.*)
            pathType: Prefix
            backend:
              service:
                name: web2
                port:
                  number: 8080

说明 #

• configuration-snippet会向Nginx的server块注入自定义规则，这里的rewrite指令仅匹配/api/keycloak开头的请求，将路径重写为去掉前缀后的形式（/$2对应原正则中的(.*)部分）
• 其他服务的路径不会被该规则匹配，因此保持原路径转发，符合预期

方案2：拆分Ingress资源实现独立配置 #

将Keycloak的路由规则单独放在一个Ingress中配置重写，其他服务的路由放在另一个Ingress中，两个Ingress共享同一个host：

Keycloak专用Ingress #

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: keycloak-ingress
  annotations:
    nginx.ingress.kubernetes.io/use-regex: "true"
    nginx.ingress.kubernetes.io/rewrite-target: /$2
spec:
  rules:
    - host: testhost-ingress.info
      http:
        paths:
          - path: /api/keycloak(/|$)(.*)
            pathType: Prefix
            backend:
              service:
                name: keycloak
                port:
                  number: 8080

其他服务专用Ingress #

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: other-services-ingress
  annotations:
    nginx.ingress.kubernetes.io/use-regex: "true"
spec:
  rules:
    - host: testhost-ingress.info
      http:
        paths:
          - path: /api/departments(/|$)(.*)
            pathType: Prefix
            backend:
              service:
                name: department
                port:
                  number: 8080
          - path: /api/employees(/|$)(.*)
            pathType: Prefix
            backend:
              service:
                name: employee
                port:
                  number: 8080
          - path: /v2(/|$)(.*)
            pathType: Prefix
            backend:
              service:
                name: web2
                port:
                  number: 8080

说明 #

• Nginx Ingress Controller会自动合并同一host下的多个Ingress规则
• Keycloak的Ingress配置了rewrite-target: /$2实现路径重写，其他服务的Ingress无重写配置，保持原路径转发

内容的提问来源于stack exchange，提问作者Abanslash