Container Service for Kubernetes：MSE Ingress進階用法

例如：

• 請求Header為mse：always時會訪問灰階服務demo-service-canary；其他情況將訪問正式服務demo-service。配置如下：

  1.19及之後版本叢集

  apiVersion: networking.k8s.io/v1
  kind: Ingress
  metadata:
    annotations:
      nginx.ingress.kubernetes.io/canary: "true"
      nginx.ingress.kubernetes.io/canary-by-header: "mse"
    name: demo-canary
  spec:
    ingressClassName: mse
    rules:
      - http:
          paths:
            - backend:
                service:
                  name: demo-service-canary
                  port: 
                    number: 80
              path: /hello
              pathType: Exact
  ---
  apiVersion: networking.k8s.io/v1
  kind: Ingress
  metadata:
    name: demo
  spec:
    ingressClassName: mse
    rules:
      - http:
          paths:
            - backend:
                service:
                  name: demo-service
                  port: 
                    number: 80
              path: /hello
              pathType: Exact          

  1.19版本之前叢集

  apiVersion: networking.k8s.io/v1beta1
  kind: Ingress
  metadata:
    annotations:
      nginx.ingress.kubernetes.io/canary: "true"
      nginx.ingress.kubernetes.io/canary-by-header: "mse"
    name: demo-canary
  spec:
    ingressClassName: mse
    rules:
      - http:
          paths:
            - path: /hello
              backend:
                serviceName: demo-service-canary
                servicePort: 80
  ---
  apiVersion: networking.k8s.io/v1beta1
  kind: Ingress
  metadata:
    name: demo
  spec:
    ingressClassName: mse
    rules:
      - http:
          paths:
            - path: /hello
              backend:
                serviceName: demo-service
                servicePort: 80

• 請求Header為mse：v1時將訪問灰階服務demo-service-canary-v1；請求Header為mse：v2時將訪問灰階服務demo-service-canary-v2；其他情況將訪問正式服務demo-service。配置如下。

  1.19及之後版本叢集

  apiVersion: networking.k8s.io/v1
  kind: Ingress
  metadata:
    annotations:
      nginx.ingress.kubernetes.io/canary: "true"
      nginx.ingress.kubernetes.io/canary-by-header: "mse"
      nginx.ingress.kubernetes.io/canary-by-header-value: "v1"
    name: demo-canary-v1
  spec:
    ingressClassName: mse
    rules:
      - http:
          paths:
            - backend:
                service:
                  name: demo-service-canary-v1
                  port: 
                    number: 80
              path: /hello
              pathType: Exact
  ---
  apiVersion: networking.k8s.io/v1
  kind: Ingress
  metadata:
    annotations:
      nginx.ingress.kubernetes.io/canary: "true"
      nginx.ingress.kubernetes.io/canary-by-header: "mse"
      nginx.ingress.kubernetes.io/canary-by-header-value: "v2"
    name: demo-canary-v2
  spec:
    ingressClassName: mse
    rules:
      - http:
          paths:
            - backend:
                service:
                  name: demo-service-canary-v2
                  port: 
                    number: 80
              path: /hello
              pathType: Exact
  ---
  apiVersion: networking.k8s.io/v1
  kind: Ingress
  metadata:
    name: demo
  spec:
    ingressClassName: mse
    rules:
      - http:
          paths:
            - backend:
                service:
                  name: demo-service
                  port: 
                    number: 80
              path: /hello
              pathType: Exact

  1.19版本之前叢集

  apiVersion: networking.k8s.io/v1beta1
  kind: Ingress
  metadata:
    annotations:
      nginx.ingress.kubernetes.io/canary: "true"
      nginx.ingress.kubernetes.io/canary-by-header: "mse"
      nginx.ingress.kubernetes.io/canary-by-header-value: "v1"
    name: demo-canary-v1
  spec:
    ingressClassName: mse
    rules:
      - http:
          paths:
            - path: /hello
              backend:
                serviceName: demo-service-canary-v1
                servicePort: 80
  ---
  apiVersion: networking.k8s.io/v1beta1
  kind: Ingress
  metadata:
    annotations:
      nginx.ingress.kubernetes.io/canary: "true"
      nginx.ingress.kubernetes.io/canary-by-header: "mse"
      nginx.ingress.kubernetes.io/canary-by-header-value: "v2"
    name: demo-canary-v2
  spec:
    ingressClassName: mse
    rules:
      - http:
          paths:
            - path: /hello
              backend:
                serviceName: demo-service-canary-v2
                servicePort: 80
  ---
  apiVersion: networking.k8s.io/v1beta1
  kind: Ingress
  metadata:
    name: demo
  spec:
    ingressClassName: mse
    rules:
      - http:
          paths:
            - path: /hello
              backend:
                serviceName: demo-service
                servicePort: 80

在請求轉寄給目標後端服務之前，重寫可以修改原始請求的路徑（Path）和主機域（Host)。

1. 將請求example.com/test轉寄至後端服務之前，重寫為example.com/dev。配置如下：

   1.19及之後版本叢集

   apiVersion: networking.k8s.io/v1
   kind: Ingress
   metadata:
     annotations:
       nginx.ingress.kubernetes.io/rewrite-target: "/dev"
     name: demo
   spec:
     ingressClassName: mse
     rules:
       - host: example.com
         http:
           paths:
             - backend:
                 service:
                   name: demo-service
                   port: 
                     number: 80
               path: /test
               pathType: Exact

   1.19版本之前叢集

   apiVersion: networking.k8s.io/v1beta1
   kind: Ingress
   metadata:
     annotations:
       nginx.ingress.kubernetes.io/rewrite-target: "/dev"
     name: demo
   spec:
     ingressClassName: mse
     rules:
       - http:
           paths:
             - path: /test
               pathType: Exact
               backend:
                 serviceName: demo-service
                 servicePort: 80

2. 將請求example.com/v1/xxx，即以/v1/為首碼的任意Path，轉寄至後端服務之前，去掉Path首碼/v1，重寫為example.com/xxx。配置如下：

   1.19及之後版本叢集

   apiVersion: networking.k8s.io/v1
   kind: Ingress
   metadata:
     annotations:
       nginx.ingress.kubernetes.io/rewrite-target: "/$1"
     name: demo
   spec:
     ingressClassName: mse
     rules:
       - host: example.com
         http:
           paths:
             - backend:
                 service:
                   name: demo-service
                   port: 
                     number: 80
               path: /v1/(.*)
               pathType: Prefix

   1.19版本之前叢集

   apiVersion: networking.k8s.io/v1beta1
   kind: Ingress
   metadata:
     annotations:
       nginx.ingress.kubernetes.io/rewrite-target: "/$1"
     name: demo
   spec:
     ingressClassName: mse
     rules:
       - http:
           paths:
             - path: /v1/(.*) 
             	pathType: Prefix
               backend:
                 serviceName: demo-service
                 servicePort: 80

3. 將請求example.com/v1/xxx，即以/v1/為首碼的任意Path，轉寄至後端服務之前，將Path首碼/v1更改為/v2，重寫為example.com/v2/xxx。配置如下：

   1.19及之後版本叢集

   apiVersion: networking.k8s.io/v1
   kind: Ingress
   metadata:
     annotations:
       nginx.ingress.kubernetes.io/rewrite-target: "/v2/$1"
     name: demo
   spec:
     ingressClassName: mse
     rules:
       - host: example.com
         http:
           paths:
             - backend:
                 service:
                   name: demo-service
                   port: 
                     number: 80
               path: /v1/(.*)
               pathType: Prefix

   1.19版本之前叢集

   apiVersion: networking.k8s.io/v1beta1
   kind: Ingress
   metadata:
     annotations:
       nginx.ingress.kubernetes.io/rewrite-target: "/v2/$1"
     name: demo
   spec:
     ingressClassName: mse
     rules:
       - http:
           paths:
             - path: /v1/(.*)
               pathType: Prefix
               backend:
                 serviceName: demo-service
                 servicePort: 80

例如：

• 對於請求example.com/test添加兩個Header，分別是foo: bar和test: true。配置如下：

  1.19及之後版本叢集

  apiVersion: networking.k8s.io/v1
  kind: Ingress
  metadata:
    annotations:
      mse.ingress.kubernetes.io/request-header-control-add: |
        foo bar
        test true
    name: demo
  spec:
    ingressClassName: mse
    rules:
      - host: example.com
        http:
          paths:
            - backend:
                service:
                  name: demo-service
                  port: 
                    number: 80
              path: /test
              pathType: Exact

  1.19版本之前叢集

  apiVersion: networking.k8s.io/v1beta1
  kind: Ingress
  metadata:
    annotations:
      mse.ingress.kubernetes.io/request-header-control-add: |
        foo bar
        test true
    name: demo
  spec:
    ingressClassName: mse
    rules:
      - host: example.com 
        http:
          paths:
            - path: /test
              backend:
                serviceName: demo-service
                servicePort: 80

• Header控制可以結合灰階發布，對灰階流量進行染色。請求Header為mse：v1時將訪問灰階服務demo-service-canary-v1，並添加Header（stage: gray）；其他情況將訪問正式服務demo-service，並添加Header（stage: production）。配置如下：

  1.19及之後版本叢集

  apiVersion: networking.k8s.io/v1
  kind: Ingress
  metadata:
    annotations:
      nginx.ingress.kubernetes.io/canary: "true"
      nginx.ingress.kubernetes.io/canary-by-header: "mse"
      nginx.ingress.kubernetes.io/canary-by-header-value: "v1"
      mse.ingress.kubernetes.io/request-header-control-add: "stage gray"
    name: demo-canary-v1
  spec:
    ingressClassName: mse
    rules:
      - http:
          paths:
            - backend:
                service:
                  name: demo-service-canary-v1
                  port: 
                    number: 80
              path: /hello
              pathType: Exact
  ---
  apiVersion: networking.k8s.io/v1
  kind: Ingress
  metadata:
    annotations:
      mse.ingress.kubernetes.io/request-header-control-add: "stage production"
    name: demo
  spec:
    ingressClassName: mse
    rules:
      - http:
          paths:
            - backend:
                service:
                  name: demo-service
                  port: 
                    number: 80
              path: /hello
              pathType: Exact

  1.19版本之前叢集

  apiVersion: networking.k8s.io/v1beta1
  kind: Ingress
  metadata:
    annotations:
      nginx.ingress.kubernetes.io/canary: "true"
      nginx.ingress.kubernetes.io/canary-by-header: "mse"
      nginx.ingress.kubernetes.io/canary-by-header-value: "v1"
      mse.ingress.kubernetes.io/request-header-control-add: "stage gray"
    name: demo-canary-v1
  spec:
    ingressClassName: mse
    rules:
      - http:
          paths:
            - path: /hello
              backend:
                serviceName: demo-service-canary-v1
                servicePort: 80
  ---
  apiVersion: networking.k8s.io/v1beta1
  kind: Ingress
  metadata:
    annotations:
      mse.ingress.kubernetes.io/request-header-control-add: |
        foo bar
        test true
    name: demo
  spec:
    ingressClassName: mse
    rules:
      - host: example.com 
        http:
          paths:
            - path: /hello
              backend:
                serviceName: demo-service
                servicePort: 80

例如：

• 僅允許用戶端IP為1.1.xx.xx訪問example.com/test。配置如下：

  1.19及之後版本叢集

  apiVersion: networking.k8s.io/v1
  kind: Ingress
  metadata:
    annotations:
      nginx.ingress.kubernetes.io/whitelist-source-range: 1.1.X.X
    name: demo
  spec:
    ingressClassName: mse
    rules:
      - host: example.com
        http:
          paths:
            - backend:
                service:
                  name: demo-service
                  port: 
                    number: 80
              path: /test
              pathType: Exact

  1.19版本之前叢集

  apiVersion: networking.k8s.io/v1beta1
  kind: Ingress
  metadata:
    annotations:
      nginx.ingress.kubernetes.io/whitelist-source-range: 1.1.X.X
    name: demo
  spec:
    ingressClassName: mse
    rules:
      - host: example.com 
        http:
          paths:
            - path: /test
              backend:
                serviceName: demo-service
                servicePort: 80

• 拒絕用戶端IP為2.2.xx.xx訪問example.com/test。配置如下：

  1.19及之後版本叢集

  apiVersion: networking.k8s.io/v1
  kind: Ingress
  metadata:
    annotations:
      mse.ingress.kubernetes.io/blacklist-source-range: 2.2.2.2
    name: demo
  spec:
    ingressClassName: mse
    rules:
      - host: example.com
        http:
          paths:
            - backend:
                service:
                  name: demo-service
                  port: 
                    number: 80
              path: /test
              pathType: Exact

  1.19版本之前叢集

  apiVersion: networking.k8s.io/v1beta1
  kind: Ingress
  metadata:
    annotations:
      mse.ingress.kubernetes.io/blacklist-source-range: 2.2.2.2
    name: demo
  spec:
    ingressClassName: mse
    rules:
      - host: example.com
        http:
          paths:
            - path: /test
              backend:
                serviceName: demo-service
                servicePort: 80

例如：

• 僅允許用戶端IP為1.1.xx.xx和2.2.xx.xx可以訪問example.com網域名稱下所有路由。配置如下：

  1.19及之後版本叢集

  apiVersion: networking.k8s.io/v1
  kind: Ingress
  metadata:
    annotations:
      mse.ingress.kubernetes.io/domain-whitelist-source-range: 1.1.X.X,2.2.2.2
    name: demo
  spec:
    ingressClassName: mse
    rules:
      - host: example.com
        http:
          paths:
            - backend:
                service:
                  name: demo-service
                  port: 
                    number: 80
              path: /test
              pathType: Exact
           - backend:
                service:
                  name: app-service
                  port: 
                    number: 80
              path: /app
              pathType: Exact

  1.19版本之前叢集

  apiVersion: networking.k8s.io/v1beta1
  kind: Ingress
  metadata:
    annotations:
      mse.ingress.kubernetes.io/domain-whitelist-source-range: 1.1.X.X,2.2.2.2
    name: demo
  spec:
    ingressClassName: mse
    rules:
      - host: example.com
        http:
          paths:
            - path: /test
              backend:
                serviceName: demo-service
                servicePort: 80
            - path: /app
              backend:
                serviceName: app-service
                servicePort: 80

• 網域名稱級和路由級IP存取控制可以結合使用，僅允許用戶端IP為1.1.xx.xx和2.2.xx.xx可以訪問example.com網域名稱下所有路由，但對於example.com/order這條路由，僅允許用戶端IP為3.3.xx.xx可以訪問。配置如下：

  1.19及之後版本叢集

  apiVersion: networking.k8s.io/v1
  kind: Ingress
  metadata:
    annotations:
      mse.ingress.kubernetes.io/domain-whitelist-source-range: 1.1.X.X,2.2.2.2
    name: demo-domain
  spec:
    ingressClassName: mse
    rules:
      - host: example.com
        http:
          paths:
            - backend:
                service:
                  name: demo-service
                  port: 
                    number: 80
              path: /test
              pathType: Exact
           - backend:
                service:
                  name: app-service
                  port: 
                    number: 80
              path: /app
              pathType: Exact
  ---
  apiVersion: networking.k8s.io/v1
  kind: Ingress
  metadata:
    annotations:
      nginx.ingress.kubernetes.io/whitelist-source-range: 3.3.X.X
    name: demo-route
  spec:
    ingressClassName: mse
    rules:
      - host: example.com
        http:
          paths:
            - backend:
                service:
                  name: demo-service
                  port: 
                    number: 80
              path: /order
              pathType: Exact

  1.19版本之前叢集

  apiVersion: networking.k8s.io/v1beta1
  kind: Ingress
  metadata:
    annotations:
      mse.ingress.kubernetes.io/domain-whitelist-source-range: 1.1.X.X,2.2.2.2
    name: demo-domain
  spec:
    ingressClassName: mse
    rules:
      - host: example.com
        http:
          paths:
            - path: /test
              backend:
                serviceName: demo-service
                servicePort: 80
            - path: /app
              backend:
                serviceName: app-service
                servicePort: 80
  ---
  apiVersion: networking.k8s.io/v1beta1
  kind: Ingress
  metadata:
    annotations:
      nginx.ingress.kubernetes.io/whitelist-source-range: 3.3.X.X
    name: demo-route
  spec:
    ingressClassName: mse
    rules:
      - host: example.com
        http:
          paths:
            - path: /order
              backend:
                serviceName: demo-service
                servicePort: 80

例如：

• 限制example.com/test的請求每分鐘最大請求數為100，瞬時請求數為200。配置如下：

  1.19及之後版本叢集

  apiVersion: networking.k8s.io/v1
  kind: Ingress
  metadata:
    annotations:
      mse.ingress.kubernetes.io/route-limit-rpm: "100"
      mse.ingress.kubernetes.io/route-limit-burst-multiplier: "2"
    name: demo
  spec:
    ingressClassName: mse
    rules:
      - host: example.com
        http:
          paths:
            - backend:
                service:
                  name: demo-service
                  port: 
                    number: 80
              path: /test
              pathType: Exact

  1.19版本之前叢集

  apiVersion: networking.k8s.io/v1beta1
  kind: Ingress
  metadata:
    annotations:
      mse.ingress.kubernetes.io/route-limit-rpm: "100"
      mse.ingress.kubernetes.io/route-limit-burst-multiplier: "2"
    name: demo
  spec:
    ingressClassName: mse
    rules:
      - host: example.com
        http:
          paths:
            - path: /test
              backend:
                serviceName: demo-service
                servicePort: 80

• 限制example.com/test的請求每秒最大請求數為10，瞬時請求數50。配置如下：

  1.19及之後版本叢集

  apiVersion: networking.k8s.io/v1
  kind: Ingress
  metadata:
    annotations:
      mse.ingress.kubernetes.io/route-limit-rps: "10"
      # 預設為5
      # mse.ingress.kubernetes.io/route-limit-burst-multiplier: "5"
    name: demo
  spec:
    ingressClassName: mse
    rules:
      - host: example.com
        http:
          paths:
            - backend:
                service:
                  name: demo-service
                  port: 
                    number: 80
              path: /test
              pathType: Exact

  1.19版本之前叢集

  apiVersion: networking.k8s.io/v1beta1
  kind: Ingress
  metadata:
    annotations:
      mse.ingress.kubernetes.io/route-limit-rps: "10"
      # 預設為5
      # mse.ingress.kubernetes.io/route-limit-burst-multiplier: "5"
    name: demo
  spec:
    ingressClassName: mse
    rules:
      - host: example.com
        http:
          paths:
            - path: /test
              backend:
                serviceName: demo-service
                servicePort: 80

範例一：期望限制example.com/test的請求在網關叢集全域上最大處理請求數為1000，保持預設的並發行為。

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    mse.ingress.kubernetes.io/concurrency-limit: "1000"
  name: demo
spec:
  ingressClassName: mse
  rules:
    - host: example.com
      http:
        paths:
          - backend:
              service:
                name: demo-service
                port: 
                  number: 80
            path: /test
            pathType: Exact

apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  annotations:
    mse.ingress.kubernetes.io/concurrency-limit: "1000"
  name: demo
spec:
  ingressClassName: mse
  rules:
    - host: example.com
      http:
        paths:
          - path: /test
            backend:
              serviceName: demo-service
              servicePort: 80

範例二：期望限制example.com/test的請求在網關叢集全域最大處理請求數為1000，觸發並發控制時，響應狀態代碼為503，響應體為server is overloaded。

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    mse.ingress.kubernetes.io/concurrency-limit: "1000"
    mse.ingress.kubernetes.io/concurrency-limit-fallback-custom-response-code: 503
    mse.ingress.kubernetes.io/concurrency-limit-fallback-custom-response-body: "server is overload"
  name: demo
spec:
  ingressClassName: mse
  rules:
    - host: example.com
      http:
        paths:
          - backend:
              service:
                name: demo-service
                port: 
                  number: 80
            path: /test
            pathType: Exact

apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  annotations:
    mse.ingress.kubernetes.io/concurrency-limit: "1000"
    mse.ingress.kubernetes.io/concurrency-limit-fallback-custom-response-code: 503
    mse.ingress.kubernetes.io/concurrency-limit-fallback-custom-response-body: "server is overload"
  name: demo
spec:
  ingressClassName: mse
  rules:
    - host: example.com
      http:
        paths:
          - path: /test
            backend:
              serviceName: demo-service
              servicePort: 80

例如：

• 請求example/test轉寄至後端服務使用HTTPS協議。配置如下：

  1.19及之後版本叢集

  apiVersion: networking.k8s.io/v1
  kind: Ingress
  metadata:
    annotations:
      nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
    name: demo
  spec:
    ingressClassName: mse
    rules:
      - host: example.com
        http:
          paths:
            - backend:
                service:
                  name: demo-service
                  port: 
                    number: 80
              path: /
              pathType: Exact

  1.19版本之前叢集

  apiVersion: networking.k8s.io/v1beta1
  kind: Ingress
  metadata:
    annotations:
      nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
    name: demo
  spec:
    ingressClassName: mse
    rules:
      - host: example.com
        http:
          paths:
            - path: /test
              backend:
                serviceName: demo-service
                servicePort: 80

• 請求example/test轉寄至後端服務使用gRPC協議。此處列舉兩種做法，如下：

  • 方法1：通過註解，配置如下：

    1.19及之後版本叢集

    apiVersion: networking.k8s.io/v1
    kind: Ingress
    metadata:
      annotations:
        nginx.ingress.kubernetes.io/backend-protocol: "GRPC"
      name: demo
    spec:
      ingressClassName: mse
      rules:
        - host: example.com
          http:
            paths:
              - backend:
                  service:
                    name: demo-service
                    port: 
                      number: 80
                path: /test
                pathType: Exact

    1.19版本之前叢集

    apiVersion: networking.k8s.io/v1beta1
    kind: Ingress
    metadata:
      annotations:
        nginx.ingress.kubernetes.io/backend-protocol: "GRPC"
      name: demo
    spec:
      ingressClassName: mse
      rules:
        - host: example.com
          http:
            paths:
              - path: /test
                backend:
                  serviceName: demo-service
                  servicePort: 80

  • 方法2：通過Service Port Name，配置如下：

    1.19及之後版本叢集

    apiVersion: networking.k8s.io/v1
    kind: Ingress
    metadata:
      name: demo
    spec:
      ingressClassName: mse
      rules:
        - host: example.com
          http:
            paths:
              - backend:
                  service:
                    name: demo-service
                    port: 
                      number: 80
                path: /order
                pathType: Exact
    ---
    apiVersion: v1
    kind: Service
    metadata:
      name: demo-service
    spec:
      ports:
        - name: grpc
          port: 80
          protocol: TCP
      selector:
        app: demo-service

    1.19版本之前叢集

    apiVersion: networking.k8s.io/v1beta1
    kind: Ingress
    metadata:
      name: demo
    spec:
      ingressClassName: mse
      rules:
        - host: example.com
          http:
            paths:
              - path: /test
                backend:
                  serviceName: demo-service
                  servicePort: 80
    ---
    apiVersion: v1
    kind: Service
    metadata:
      name: demo-service
    spec:
      ports:
        - name: grpc
          port: 80
          protocol: TCP
      selector:
        app: demo-service

nginx.ingress.kubernetes.io/load-balance：後端服務的普通負載平衡演算法。預設為round_robin。合法值如下：

• round_robin：基於輪詢的負載平衡。

• least_conn：基於最小請求數的負載平衡。

• random：基於隨機的負載平衡。

nginx.ingress.kubernetes.io/upstream-hash-by：基於一致性Hash的負載平衡演算法，雲原生網關支援以下幾種形式：

• 雲原生網關支援配置部分nginx變數：

  • $request_uri：請求的Path（包括路徑參數）作為Hash Key。

  • $host：請求的Host作為Hash Key。

  • $remote_addr：請求的用戶端IP作為Hash Key。

• 基於請求Header的一致性Hash。您只需配置為$http_headerName。

• 基於請求路徑參數的一致性Hash。您只需配置為$arg_varName。

例如：

• 基於請求的用戶端IP作為Hash Key，同一個用戶端IP的請求始終負載到同一個節點。配置如下：

  1.19及之後版本叢集

  apiVersion: networking.k8s.io/v1
  kind: Ingress
  metadata:
    annotations:
      nginx.ingress.kubernetes.io/upstream-hash-by: "$remote_addr"
    name: demo
  spec:
    ingressClassName: mse
    rules:
      - host: example.com
        http:
          paths:
            - backend:
                service:
                  name: demo-service
                  port: 
                    number: 80
              path: /test
              pathType: Exact

  1.19版本之前叢集

  apiVersion: networking.k8s.io/v1beta1
  kind: Ingress
  metadata:
    annotations:
      nginx.ingress.kubernetes.io/upstream-hash-by: "$remote_addr"
    name: demo
  spec:
    ingressClassName: mse
    rules:
      - host: example.com
        http:
          paths:
            - path: /test
              backend:
                serviceName: demo-service
                servicePort: 80

• 基於請求Header x-stage作為Hash key，帶有x-stage頭部的請求且值相同的請求始終負載到同一個節點。配置如下：

  1.19及之後版本叢集

  apiVersion: networking.k8s.io/v1
  kind: Ingress
  metadata:
    annotations:
      nginx.ingress.kubernetes.io/upstream-hash-by: "$http_x-stage"
    name: demo
  spec:
    ingressClassName: mse
    rules:
      - host: example.com
        http:
          paths:
            - backend:
                service:
                  name: demo-service
                  port: 
                    number: 80
              path: /test
              pathType: Exact

  1.19版本之前叢集

  apiVersion: networking.k8s.io/v1beta1
  kind: Ingress
  metadata:
    annotations:
      nginx.ingress.kubernetes.io/upstream-hash-by: "$http_x-stage"
    name: demo
  spec:
    ingressClassName: mse
    rules:
      - host: example.com
        http:
          paths:
            - path: /test
              backend:
                serviceName: demo-service
                servicePort: 80

• 基於請求路徑參數 x-stage作為Hash key，帶有路徑參數x-stage的請求且值相同的請求始終負載到同一個節點。配置如下：

  1.19及之後版本叢集

  apiVersion: networking.k8s.io/v1
  kind: Ingress
  metadata:
    annotations:
      nginx.ingress.kubernetes.io/upstream-hash-by: "$arg_x-stage"
    name: demo
  spec:
    ingressClassName: mse
    rules:
      - host: example.com
        http:
          paths:
            - backend:
                service:
                  name: demo-service
                  port: 
                    number: 80
              path: /test
              pathType: Exact

  1.19版本之前叢集

  apiVersion: networking.k8s.io/v1beta1
  kind: Ingress
  metadata:
    annotations:
      nginx.ingress.kubernetes.io/upstream-hash-by: "$arg_x-stage"
    name: demo
  spec:
    ingressClassName: mse
    rules:
      - host: example.com
        http:
          paths:
            - path: /test
              backend:
                serviceName: demo-service
                servicePort: 80

例如：

• 開啟Cookie親和性，利用MSE Ingress的預設配置，即Cookie的名字為INGRESSCOOKIE，Path為/，Cookie的生命週期為Session會話層級。配置如下：

  1.19及之後版本叢集

  apiVersion: networking.k8s.io/v1
  kind: Ingress
  metadata:
    annotations:
      nginx.ingress.kubernetes.io/affinity: "cookie"
    name: demo
  spec:
    ingressClassName: mse
    rules:
      - host: example.com
        http:
          paths:
            - backend:
                service:
                  name: demo-service
                  port: 
                    number: 80
              path: /test
              pathType: Exact

  1.19版本之前叢集

  apiVersion: networking.k8s.io/v1beta1
  kind: Ingress
  metadata:
    annotations:
      nginx.ingress.kubernetes.io/affinity: "cookie"
    name: demo
  spec:
    ingressClassName: mse
    rules:
      - host: example.com
        http:
          paths:
            - path: /test
              backend:
                serviceName: demo-service
                servicePort: 80

• 開啟Cookie親和性，Cookie的名字為test，Path為/，Cookie的到期時間為10s。配置如下：

  1.19及之後版本叢集

  apiVersion: networking.k8s.io/v1
  kind: Ingress
  metadata:
    annotations:
      nginx.ingress.kubernetes.io/affinity: "cookie"
      nginx.ingress.kubernetes.io/session-cookie-name: "test"
      nginx.ingress.kubernetes.io/session-cookie-max-age: "10"
    name: demo
  spec:
    ingressClassName: mse
    rules:
      - host: example.com
        http:
          paths:
            - backend:
                service:
                  name: demo-service
                  port: 
                    number: 80
              path: /test
              pathType: Exact

  1.19版本之前叢集

  apiVersion: networking.k8s.io/v1beta1
  kind: Ingress
  metadata:
    annotations:
      nginx.ingress.kubernetes.io/affinity: "cookie"
      nginx.ingress.kubernetes.io/session-cookie-name: "test"
      nginx.ingress.kubernetes.io/session-cookie-max-age: "10"
    name: demo
  spec:
    ingressClassName: mse
    rules:
      - host: example.com
        http:
          paths:
            - path: /test
              backend:
                serviceName: demo-service
                servicePort: 80

目前，MSE Ingress預設最小TLS版本為TLSv1.0，預設最大TLS版本為TLSv1.3，預設加密套件為：

• ECDHE-ECDSA-AES128-GCM-SHA256

• ECDHE-RSA-AES128-GCM-SHA256

• ECDHE-ECDSA-AES128-SHA

• ECDHE-RSA-AES128-SHA

• AES128-GCM-SHA256

• AES128-SHA

• ECDHE-ECDSA-AES256-GCM-SHA384

• ECDHE-RSA-AES256-GCM-SHA384

• ECDHE-ECDSA-AES256-SHA

• ECDHE-RSA-AES256-SHA

• AES256-GCM-SHA384

• AES256-SHA

您可以通過以下註解為特定的網域名稱設定最小或者最大TLS版本以及加密套件。