Kubernetes Nginx Ingress Controller实现旧子域名重定向配置问询

你当前提供的Ingress配置无法实现old.example.com到new.example.com的子域名重定向需求。

• nginx.ingress.kubernetes.io/rewrite-target注解的作用是重写请求的URI路径，不涉及域名修改，现有配置只会让新旧两个域名同时访问同一个后端服务，不会触发任何重定向逻辑。
• TLS配置段未包含old.example.com域名，用户访问旧域名时会先触发证书安全告警，即使配置了重定向也会影响访问体验。

你可以根据使用习惯选择以下任意一种配置方式实现需求：

方案1：拆分两个独立Ingress（推荐，逻辑更清晰） #

新域名正常服务的Ingress配置 #

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: rancher-ing-new
  namespace: test
  annotations:
    kubernetes.io/ingress.class: "nginx"
    cert-manager.io/cluster-issuer: letsencrypt-prod
    kubernetes.io/tls-acme: "true"
    ingress.kubernetes.io/secure-backends: "true"
    ingress.kubernetes.io/ssl-redirect: "true"
spec:
  tls:
  - hosts:
    - new.example.com
    secretName: new.example.com
  rules:
  - host: new.example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: rancher-logo-service
            port:
              number: 80

旧域名重定向专用的Ingress配置 #

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: rancher-ing-old-redirect
  namespace: test
  annotations:
    kubernetes.io/ingress.class: "nginx"
    cert-manager.io/cluster-issuer: letsencrypt-prod
    kubernetes.io/tls-acme: "true"
    ingress.kubernetes.io/ssl-redirect: "true"
    # 301永久重定向到新域名，完整保留原请求路径和参数
    nginx.ingress.kubernetes.io/permanent-redirect: https://new.example.com$request_uri
spec:
  tls:
  - hosts:
    - old.example.com
    secretName: old.example.com
  rules:
  - host: old.example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          # 此处填任意集群内存在的Service即可，重定向逻辑会优先于后端转发生效
          service:
            name: rancher-logo-service
            port:
              number: 80

方案2：单个Ingress实现 #

如果你不想拆分Ingress资源，也可以在原有配置基础上增加域名判断逻辑：

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: rancher-ing
  namespace: test
  annotations:
    kubernetes.io/ingress.class: "nginx"
    cert-manager.io/cluster-issuer: letsencrypt-prod
    kubernetes.io/tls-acme: "true"
    ingress.kubernetes.io/secure-backends: "true"
    ingress.kubernetes.io/ssl-redirect: "true"
    # 增加域名判断重定向逻辑
    nginx.ingress.kubernetes.io/server-snippet: |
      if ($host = 'old.example.com') {
        return 301 https://new.example.com$request_uri;
      }
spec:
  tls:
  - hosts:
    - new.example.com
    - old.example.com
    secretName: example.com
  rules:
  - host: new.example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: rancher-logo-service
            port:
              number: 80
  - host: old.example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: rancher-logo-service
            port:
              number: 80

两种方案都可以实现旧域名所有请求301永久重定向到新域名，同时完整保留原请求路径、参数，且旧域名不会触发证书安全告警。

内容的提问来源于stack exchange，提问作者gharbi.bdr