Ingress Nginx路径重写问题：根路径注入子路径及特定路径转发

问题2：Ingress对象的正确配置方案 #

需要通过多路径规则或原生Nginx片段注入两种方式实现需求，以下是具体方案：

方案1：多路径规则（推荐，符合K8s Ingress规范）

利用Ingress-Nginx的路径匹配优先级（精确匹配 > 正则匹配），拆分两个独立路径规则：

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    kubernetes.io/ingress.class: nginx
    nginx.ingress.kubernetes.io/backend-protocol: HTTPS
    nginx.ingress.kubernetes.io/proxy-connect-timeout: "90s"
    nginx.ingress.kubernetes.io/proxy-read-timeout: "90s"
    nginx.ingress.kubernetes.io/proxy-send-timeout: "90s"
    # 全局处理后端返回的重定向
    nginx.ingress.kubernetes.io/proxy-redirect-from: /devportal/
    nginx.ingress.kubernetes.io/proxy-redirect-to: /
  name: multitenancy-ingress
  namespace: wso2
spec:
  rules:
  - host: example.com
    http:
      paths:
      # 规则1：精确匹配/，转发至/devportal/
      - backend:
          service:
            name: my-svc
            port:
              name: servlet-https
        path: /
        pathType: Exact
        annotations:
          nginx.ingress.kubernetes.io/rewrite-target: /devportal/
      # 规则2：正则匹配/a、/b、/c及子路径，保留原URI转发
      - backend:
          service:
            name: my-svc
            port:
              name: servlet-https
        path: /(a|b|c)(.*)
        pathType: ImplementationSpecific
        annotations:
          nginx.ingress.kubernetes.io/rewrite-target: /$1$2
  tls:
  - hosts:
    - example.com
    secretName: my-tls

方案2：原生Nginx片段注入（完全复刻原有配置）

如果多路径规则无法满足复杂逻辑，可通过server-snippets直接插入原生Nginx配置：

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    kubernetes.io/ingress.class: nginx
    nginx.ingress.kubernetes.io/backend-protocol: HTTPS
    nginx.ingress.kubernetes.io/proxy-connect-timeout: "90s"
    nginx.ingress.kubernetes.io/proxy-read-timeout: "90s"
    nginx.ingress.kubernetes.io/proxy-send-timeout: "90s"
    nginx.ingress.kubernetes.io/server-snippets: |
      location / {
        proxy_pass            https://my-svc:servlet-https/devportal/;
        proxy_redirect        https://my-svc:servlet-https/devportal/ /;
      }
      location ~ (/a|/b|/c) {
        proxy_pass      https://my-svc:servlet-https;
        proxy_redirect  https://my-svc:servlet-https/devportal/ /;
      }
  name: multitenancy-ingress
  namespace: wso2
spec:
  rules:
  - host: example.com
    http:
      paths:
      - backend:
          service:
            name: my-svc
            port:
              name: servlet-https
        path: /
        pathType: Prefix
  tls:
  - hosts:
    - example.com
    secretName: my-tls

配置说明：

• 方案1中，pathType: Exact确保精确/请求优先匹配，单独配置rewrite-target保证转发路径为/devportal/；正则规则覆盖/a、/a/xxx等子路径，通过捕获组保留原URI结构。
• 方案2中，server-snippets直接插入原生Nginx的location规则，完全复刻你原本的配置逻辑，注意将my-svc:servlet-https替换为实际的Service名称和端口。

内容的提问来源于stack exchange，提问作者MiddlewareManiac