Kubernetes Ingress-Nginx如何配置CORS以允许多个源？

问题背景 #

当前Ingress-Nginx官方CORS注解仅支持单个域名/子域名作为允许源，尝试用逗号分隔多个域名配置nginx.ingress.kubernetes.io/cors-allow-origin未生效，需要实现多域名CORS允许。

当前Ingress配置：

kind: Ingress
apiVersion: extensions/v1beta1
metadata:
  name: nginx-ingress
  namespace: default
  selfLink: /apis/extensions/v1beta1/namespaces/default/ingresses/nginx-ingress
  uid: adcd75ab-b44b-420c-874e-abcfd1059592
  resourceVersion: '259992616'
  generation: 7
  creationTimestamp: '2020-06-10T12:15:18Z'
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-prod
    ingress.kubernetes.io/enable-cors: 'true'
    ingress.kubernetes.io/force-ssl-redirect: 'true'
    kubernetes.io/ingress.class: nginx
    kubernetes.io/tls-acme: 'true'
    nginx.ingress.kubernetes.io/cors-allow-credentials: 'true'
    nginx.ingress.kubernetes.io/cors-allow-headers: 'Authorization, X-Requested-With, Content-Type'
    nginx.ingress.kubernetes.io/cors-allow-methods: 'GET, PUT, POST, DELETE, HEAD, OPTIONS'
    nginx.ingress.kubernetes.io/cors-allow-origin: 'https://example.com'
    nginx.ingress.kubernetes.io/enable-cors: 'true'
    nginx.ingress.kubernetes.io/rewrite-target: /
    nginx.ingress.kubernetes.io/secure-backends: 'true'

尝试无效的配置：

nginx.ingress.kubernetes.io/cors-allow-origin: 'https://example.com, https://otherexample.com'

可行解决方案 #

方法1：使用Nginx配置片段实现动态CORS头 #

通过nginx.ingress.kubernetes.io/configuration-snippet注解添加自定义Nginx规则，基于请求的Origin头动态匹配允许的域名：

修改Ingress的annotations，替换原有CORS相关配置：

annotations:
  # 保留其他原有注解（如cert-manager、ssl重定向等）
  nginx.ingress.kubernetes.io/enable-cors: 'false' # 关闭官方自动CORS配置，避免冲突
  nginx.ingress.kubernetes.io/configuration-snippet: |
    if ($http_origin ~* ^(https://example.com|https://otherexample.com)$) {
      add_header Access-Control-Allow-Origin "$http_origin";
      add_header Access-Control-Allow-Methods "GET, PUT, POST, DELETE, HEAD, OPTIONS";
      add_header Access-Control-Allow-Headers "Authorization, X-Requested-With, Content-Type";
      add_header Access-Control-Allow-Credentials "true";
    }

说明：

• 正则表达式^(https://example.com|https://otherexample.com)$可扩展添加更多域名，用|分隔
• 支持子域名匹配，比如https://*.example.com
• 动态返回匹配到的Origin值，符合CORS规范（不能返回多个域名，只能返回单个匹配的源或*）

方法2：Lua脚本管理大量允许域名 #

如果需要允许的域名数量较多，可通过Lua脚本实现更灵活的管理：

annotations:
  nginx.ingress.kubernetes.io/enable-cors: 'false'
  nginx.ingress.kubernetes.io/server-snippet: |
    lua_shared_dict cors_origins 1m;
    init_by_lua_block {
      # 定义允许的域名列表
      allowed_origins = {
        "https://example.com",
        "https://otherexample.com",
        "https://thirdexample.com"
      }
      for _, origin in ipairs(allowed_origins) do
        ngx.shared.cors_origins:set(origin, true)
      end
    }
  nginx.ingress.kubernetes.io/configuration-snippet: |
    access_by_lua_block {
      local origin = ngx.var.http_origin
      if origin and ngx.shared.cors_origins:get(origin) then
        ngx.header["Access-Control-Allow-Origin"] = origin
        ngx.header["Access-Control-Allow-Methods"] = "GET, PUT, POST, DELETE, HEAD, OPTIONS"
        ngx.header["Access-Control-Allow-Headers"] = "Authorization, X-Requested-With, Content-Type"
        ngx.header["Access-Control-Allow-Credentials"] = "true"
      end
    }

注意事项 #

• 修改配置后等待Ingress Controller自动重载配置（通常10秒内生效）
• 测试前清除浏览器CORS缓存，避免旧配置干扰
• 若启用了force-ssl-redirect，确保所有允许的域名均使用HTTPS协议

内容的提问来源于stack exchange，提问作者Vural