GKE Ingress多通配符路径配置问题及解决方案咨询

方法1：基于GCE Ingress Controller的层级通配符配置 #

GCE Ingress Controller支持层级化的通配符匹配，核心是利用路径优先级规则（越长、越精准的路径匹配优先级越高）来避免第一个通配符吞掉后续路径：

• 先定义最精准的目标路径规则，再配置兜底的通用路径，确保只有符合/organizations/*/entity/*/download结构的请求会触发专属超时
• 配置示例：

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: download-timeout-ingress
  annotations:
    networking.gke.io/v1beta1.FrontendConfig: "download-timeout-config"
spec:
  rules:
  - http:
      paths:
      # 最优先匹配目标路径
      - path: /organizations/*/entity/*/download
        pathType: ImplementationSpecific
        backend:
          service:
            name: your-download-service
            port:
              number: 80
      # 匹配其他同层级但末尾为test的路径
      - path: /organizations/*/entity/*/test
        pathType: ImplementationSpecific
        backend:
          service:
            name: your-regular-service
            port:
              number: 80
      # 兜底匹配所有organizations开头的其他请求
      - path: /organizations/*
        pathType: ImplementationSpecific
        backend:
          service:
            name: your-regular-service
            port:
              number: 80
---
# 配置专属超时的FrontendConfig
apiVersion: networking.gke.io/v1beta1
kind: FrontendConfig
metadata:
  name: download-timeout-config
spec:
  timeoutSec: 300  # 设置你需要的超时时长，比如5分钟

注：ImplementationSpecific会让GKE使用GCE负载均衡的原生路径匹配规则，该规则会严格按层级识别通配符，不会让第一个*跨层级匹配后续路径。

方法2：切换为NGINX Ingress Controller（更灵活的正则匹配） #

如果集群允许切换Ingress Controller，NGINX支持正则表达式匹配，能更精准控制路径范围：

• 开启正则匹配注解，用[^/]+替代*，确保只匹配单个层级的动态值（不会跨斜杠）
• 配置示例：

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: download-timeout-ingress
  annotations:
    nginx.ingress.kubernetes.io/use-regex: "true"
    nginx.ingress.kubernetes.io/proxy-read-timeout: "60"  # 全局默认超时
spec:
  rules:
  - http:
      paths:
      - path: /organizations/[^/]+/entity/[^/]+/download
        pathType: ImplementationSpecific
        backend:
          service:
            name: your-download-service
            port:
              number: 80
        annotations:
          nginx.ingress.kubernetes.io/proxy-read-timeout: "300"  # 专属超时
      - path: /organizations/[^/]+/entity/[^/]+/test
        pathType: ImplementationSpecific
        backend:
          service:
            name: your-regular-service
            port:
              number: 80

关键验证步骤 #

配置完成后，用curl测试不同路径确认效果：

curl https://your-ingress-domain/organizations/abc/entity/def/download  # 应触发专属超时
curl https://your-ingress-domain/organizations/abc/entity/def/test       # 应使用默认超时
curl https://your-ingress-domain/organizations/abc/other-path            # 应使用默认超时

内容的提问来源于stack exchange，提问作者Leart Beqiraj