容器服务 Kubernetes 版 ACK：MSE Ingress高级用法

例如：

• 请求Header为mse：always时会访问灰度服务demo-service-canary；其他情况将访问正式服务demo-service。配置如下：

  1.19及之后版本集群

  apiVersion: networking.k8s.io/v1
  kind: Ingress
  metadata:
    annotations:
      nginx.ingress.kubernetes.io/canary: "true"
      nginx.ingress.kubernetes.io/canary-by-header: "mse"
    name: demo-canary
  spec:
    ingressClassName: mse
    rules:
      - http:
          paths:
            - backend:
                service:
                  name: demo-service-canary
                  port: 
                    number: 80
              path: /hello
              pathType: Exact
  ---
  apiVersion: networking.k8s.io/v1
  kind: Ingress
  metadata:
    name: demo
  spec:
    ingressClassName: mse
    rules:
      - http:
          paths:
            - backend:
                service:
                  name: demo-service
                  port: 
                    number: 80
              path: /hello
              pathType: Exact          

  1.19版本之前集群

  apiVersion: networking.k8s.io/v1beta1
  kind: Ingress
  metadata:
    annotations:
      nginx.ingress.kubernetes.io/canary: "true"
      nginx.ingress.kubernetes.io/canary-by-header: "mse"
    name: demo-canary
  spec:
    ingressClassName: mse
    rules:
      - http:
          paths:
            - path: /hello
              backend:
                serviceName: demo-service-canary
                servicePort: 80
  ---
  apiVersion: networking.k8s.io/v1beta1
  kind: Ingress
  metadata:
    name: demo
  spec:
    ingressClassName: mse
    rules:
      - http:
          paths:
            - path: /hello
              backend:
                serviceName: demo-service
                servicePort: 80

• 请求Header为mse：v1时将访问灰度服务demo-service-canary-v1；请求Header为mse：v2时将访问灰度服务demo-service-canary-v2；其他情况将访问正式服务demo-service。配置如下。

  1.19及之后版本集群

  apiVersion: networking.k8s.io/v1
  kind: Ingress
  metadata:
    annotations:
      nginx.ingress.kubernetes.io/canary: "true"
      nginx.ingress.kubernetes.io/canary-by-header: "mse"
      nginx.ingress.kubernetes.io/canary-by-header-value: "v1"
    name: demo-canary-v1
  spec:
    ingressClassName: mse
    rules:
      - http:
          paths:
            - backend:
                service:
                  name: demo-service-canary-v1
                  port: 
                    number: 80
              path: /hello
              pathType: Exact
  ---
  apiVersion: networking.k8s.io/v1
  kind: Ingress
  metadata:
    annotations:
      nginx.ingress.kubernetes.io/canary: "true"
      nginx.ingress.kubernetes.io/canary-by-header: "mse"
      nginx.ingress.kubernetes.io/canary-by-header-value: "v2"
    name: demo-canary-v2
  spec:
    ingressClassName: mse
    rules:
      - http:
          paths:
            - backend:
                service:
                  name: demo-service-canary-v2
                  port: 
                    number: 80
              path: /hello
              pathType: Exact
  ---
  apiVersion: networking.k8s.io/v1
  kind: Ingress
  metadata:
    name: demo
  spec:
    ingressClassName: mse
    rules:
      - http:
          paths:
            - backend:
                service:
                  name: demo-service
                  port: 
                    number: 80
              path: /hello
              pathType: Exact

  1.19版本之前集群

  apiVersion: networking.k8s.io/v1beta1
  kind: Ingress
  metadata:
    annotations:
      nginx.ingress.kubernetes.io/canary: "true"
      nginx.ingress.kubernetes.io/canary-by-header: "mse"
      nginx.ingress.kubernetes.io/canary-by-header-value: "v1"
    name: demo-canary-v1
  spec:
    ingressClassName: mse
    rules:
      - http:
          paths:
            - path: /hello
              backend:
                serviceName: demo-service-canary-v1
                servicePort: 80
  ---
  apiVersion: networking.k8s.io/v1beta1
  kind: Ingress
  metadata:
    annotations:
      nginx.ingress.kubernetes.io/canary: "true"
      nginx.ingress.kubernetes.io/canary-by-header: "mse"
      nginx.ingress.kubernetes.io/canary-by-header-value: "v2"
    name: demo-canary-v2
  spec:
    ingressClassName: mse
    rules:
      - http:
          paths:
            - path: /hello
              backend:
                serviceName: demo-service-canary-v2
                servicePort: 80
  ---
  apiVersion: networking.k8s.io/v1beta1
  kind: Ingress
  metadata:
    name: demo
  spec:
    ingressClassName: mse
    rules:
      - http:
          paths:
            - path: /hello
              backend:
                serviceName: demo-service
                servicePort: 80

在请求转发给目标后端服务之前，重写可以修改原始请求的路径（Path）和主机域（Host)。

1. 将请求example.com/test转发至后端服务之前，重写为example.com/dev。配置如下：

   1.19及之后版本集群

   apiVersion: networking.k8s.io/v1
   kind: Ingress
   metadata:
     annotations:
       nginx.ingress.kubernetes.io/rewrite-target: "/dev"
     name: demo
   spec:
     ingressClassName: mse
     rules:
       - host: example.com
         http:
           paths:
             - backend:
                 service:
                   name: demo-service
                   port: 
                     number: 80
               path: /test
               pathType: Exact

   1.19版本之前集群

   apiVersion: networking.k8s.io/v1beta1
   kind: Ingress
   metadata:
     annotations:
       nginx.ingress.kubernetes.io/rewrite-target: "/dev"
     name: demo
   spec:
     ingressClassName: mse
     rules:
       - http:
           paths:
             - path: /test
               pathType: Exact
               backend:
                 serviceName: demo-service
                 servicePort: 80

2. 将请求example.com/v1/xxx，即以/v1/为前缀的任意Path，转发至后端服务之前，去掉Path前缀/v1，重写为example.com/xxx。配置如下：

   1.19及之后版本集群

   apiVersion: networking.k8s.io/v1
   kind: Ingress
   metadata:
     annotations:
       nginx.ingress.kubernetes.io/rewrite-target: "/$1"
     name: demo
   spec:
     ingressClassName: mse
     rules:
       - host: example.com
         http:
           paths:
             - backend:
                 service:
                   name: demo-service
                   port: 
                     number: 80
               path: /v1/(.*)
               pathType: Prefix

   1.19版本之前集群

   apiVersion: networking.k8s.io/v1beta1
   kind: Ingress
   metadata:
     annotations:
       nginx.ingress.kubernetes.io/rewrite-target: "/$1"
     name: demo
   spec:
     ingressClassName: mse
     rules:
       - http:
           paths:
             - path: /v1/(.*) 
             	pathType: Prefix
               backend:
                 serviceName: demo-service
                 servicePort: 80

3. 将请求example.com/v1/xxx，即以/v1/为前缀的任意Path，转发至后端服务之前，将Path前缀/v1更改为/v2，重写为example.com/v2/xxx。配置如下：

   1.19及之后版本集群

   apiVersion: networking.k8s.io/v1
   kind: Ingress
   metadata:
     annotations:
       nginx.ingress.kubernetes.io/rewrite-target: "/v2/$1"
     name: demo
   spec:
     ingressClassName: mse
     rules:
       - host: example.com
         http:
           paths:
             - backend:
                 service:
                   name: demo-service
                   port: 
                     number: 80
               path: /v1/(.*)
               pathType: Prefix

   1.19版本之前集群

   apiVersion: networking.k8s.io/v1beta1
   kind: Ingress
   metadata:
     annotations:
       nginx.ingress.kubernetes.io/rewrite-target: "/v2/$1"
     name: demo
   spec:
     ingressClassName: mse
     rules:
       - http:
           paths:
             - path: /v1/(.*)
               pathType: Prefix
               backend:
                 serviceName: demo-service
                 servicePort: 80

例如：

• 对于请求example.com/test添加两个Header，分别是foo: bar和test: true。配置如下：

  1.19及之后版本集群

  apiVersion: networking.k8s.io/v1
  kind: Ingress
  metadata:
    annotations:
      mse.ingress.kubernetes.io/request-header-control-add: |
        foo bar
        test true
    name: demo
  spec:
    ingressClassName: mse
    rules:
      - host: example.com
        http:
          paths:
            - backend:
                service:
                  name: demo-service
                  port: 
                    number: 80
              path: /test
              pathType: Exact

  1.19版本之前集群

  apiVersion: networking.k8s.io/v1beta1
  kind: Ingress
  metadata:
    annotations:
      mse.ingress.kubernetes.io/request-header-control-add: |
        foo bar
        test true
    name: demo
  spec:
    ingressClassName: mse
    rules:
      - host: example.com 
        http:
          paths:
            - path: /test
              backend:
                serviceName: demo-service
                servicePort: 80

• Header控制可以结合灰度发布，对灰度流量进行染色。请求Header为mse：v1时将访问灰度服务demo-service-canary-v1，并添加Header（stage: gray）；其他情况将访问正式服务demo-service，并添加Header（stage: production）。配置如下：

  1.19及之后版本集群

  apiVersion: networking.k8s.io/v1
  kind: Ingress
  metadata:
    annotations:
      nginx.ingress.kubernetes.io/canary: "true"
      nginx.ingress.kubernetes.io/canary-by-header: "mse"
      nginx.ingress.kubernetes.io/canary-by-header-value: "v1"
      mse.ingress.kubernetes.io/request-header-control-add: "stage gray"
    name: demo-canary-v1
  spec:
    ingressClassName: mse
    rules:
      - http:
          paths:
            - backend:
                service:
                  name: demo-service-canary-v1
                  port: 
                    number: 80
              path: /hello
              pathType: Exact
  ---
  apiVersion: networking.k8s.io/v1
  kind: Ingress
  metadata:
    annotations:
      mse.ingress.kubernetes.io/request-header-control-add: "stage production"
    name: demo
  spec:
    ingressClassName: mse
    rules:
      - http:
          paths:
            - backend:
                service:
                  name: demo-service
                  port: 
                    number: 80
              path: /hello
              pathType: Exact

  1.19版本之前集群

  apiVersion: networking.k8s.io/v1beta1
  kind: Ingress
  metadata:
    annotations:
      nginx.ingress.kubernetes.io/canary: "true"
      nginx.ingress.kubernetes.io/canary-by-header: "mse"
      nginx.ingress.kubernetes.io/canary-by-header-value: "v1"
      mse.ingress.kubernetes.io/request-header-control-add: "stage gray"
    name: demo-canary-v1
  spec:
    ingressClassName: mse
    rules:
      - http:
          paths:
            - path: /hello
              backend:
                serviceName: demo-service-canary-v1
                servicePort: 80
  ---
  apiVersion: networking.k8s.io/v1beta1
  kind: Ingress
  metadata:
    annotations:
      mse.ingress.kubernetes.io/request-header-control-add: |
        foo bar
        test true
    name: demo
  spec:
    ingressClassName: mse
    rules:
      - host: example.com 
        http:
          paths:
            - path: /hello
              backend:
                serviceName: demo-service
                servicePort: 80

例如：

• 仅允许客户端IP为1.1.xx.xx访问example.com/test。配置如下：

  1.19及之后版本集群

  apiVersion: networking.k8s.io/v1
  kind: Ingress
  metadata:
    annotations:
      nginx.ingress.kubernetes.io/whitelist-source-range: 1.1.X.X
    name: demo
  spec:
    ingressClassName: mse
    rules:
      - host: example.com
        http:
          paths:
            - backend:
                service:
                  name: demo-service
                  port: 
                    number: 80
              path: /test
              pathType: Exact

  1.19版本之前集群

  apiVersion: networking.k8s.io/v1beta1
  kind: Ingress
  metadata:
    annotations:
      nginx.ingress.kubernetes.io/whitelist-source-range: 1.1.X.X
    name: demo
  spec:
    ingressClassName: mse
    rules:
      - host: example.com 
        http:
          paths:
            - path: /test
              backend:
                serviceName: demo-service
                servicePort: 80

• 拒绝客户端IP为2.2.xx.xx访问example.com/test。配置如下：

  1.19及之后版本集群

  apiVersion: networking.k8s.io/v1
  kind: Ingress
  metadata:
    annotations:
      mse.ingress.kubernetes.io/blacklist-source-range: 2.2.2.2
    name: demo
  spec:
    ingressClassName: mse
    rules:
      - host: example.com
        http:
          paths:
            - backend:
                service:
                  name: demo-service
                  port: 
                    number: 80
              path: /test
              pathType: Exact

  1.19版本之前集群

  apiVersion: networking.k8s.io/v1beta1
  kind: Ingress
  metadata:
    annotations:
      mse.ingress.kubernetes.io/blacklist-source-range: 2.2.2.2
    name: demo
  spec:
    ingressClassName: mse
    rules:
      - host: example.com
        http:
          paths:
            - path: /test
              backend:
                serviceName: demo-service
                servicePort: 80

例如：

• 仅允许客户端IP为1.1.xx.xx和2.2.xx.xx可以访问example.com域名下所有路由。配置如下：

  1.19及之后版本集群

  apiVersion: networking.k8s.io/v1
  kind: Ingress
  metadata:
    annotations:
      mse.ingress.kubernetes.io/domain-whitelist-source-range: 1.1.X.X,2.2.2.2
    name: demo
  spec:
    ingressClassName: mse
    rules:
      - host: example.com
        http:
          paths:
            - backend:
                service:
                  name: demo-service
                  port: 
                    number: 80
              path: /test
              pathType: Exact
           - backend:
                service:
                  name: app-service
                  port: 
                    number: 80
              path: /app
              pathType: Exact

  1.19版本之前集群

  apiVersion: networking.k8s.io/v1beta1
  kind: Ingress
  metadata:
    annotations:
      mse.ingress.kubernetes.io/domain-whitelist-source-range: 1.1.X.X,2.2.2.2
    name: demo
  spec:
    ingressClassName: mse
    rules:
      - host: example.com
        http:
          paths:
            - path: /test
              backend:
                serviceName: demo-service
                servicePort: 80
            - path: /app
              backend:
                serviceName: app-service
                servicePort: 80

• 域名级和路由级IP访问控制可以结合使用，仅允许客户端IP为1.1.xx.xx和2.2.xx.xx可以访问example.com域名下所有路由，但对于example.com/order这条路由，仅允许客户端IP为3.3.xx.xx可以访问。配置如下：

  1.19及之后版本集群

  apiVersion: networking.k8s.io/v1
  kind: Ingress
  metadata:
    annotations:
      mse.ingress.kubernetes.io/domain-whitelist-source-range: 1.1.X.X,2.2.2.2
    name: demo-domain
  spec:
    ingressClassName: mse
    rules:
      - host: example.com
        http:
          paths:
            - backend:
                service:
                  name: demo-service
                  port: 
                    number: 80
              path: /test
              pathType: Exact
           - backend:
                service:
                  name: app-service
                  port: 
                    number: 80
              path: /app
              pathType: Exact
  ---
  apiVersion: networking.k8s.io/v1
  kind: Ingress
  metadata:
    annotations:
      nginx.ingress.kubernetes.io/whitelist-source-range: 3.3.X.X
    name: demo-route
  spec:
    ingressClassName: mse
    rules:
      - host: example.com
        http:
          paths:
            - backend:
                service:
                  name: demo-service
                  port: 
                    number: 80
              path: /order
              pathType: Exact

  1.19版本之前集群

  apiVersion: networking.k8s.io/v1beta1
  kind: Ingress
  metadata:
    annotations:
      mse.ingress.kubernetes.io/domain-whitelist-source-range: 1.1.X.X,2.2.2.2
    name: demo-domain
  spec:
    ingressClassName: mse
    rules:
      - host: example.com
        http:
          paths:
            - path: /test
              backend:
                serviceName: demo-service
                servicePort: 80
            - path: /app
              backend:
                serviceName: app-service
                servicePort: 80
  ---
  apiVersion: networking.k8s.io/v1beta1
  kind: Ingress
  metadata:
    annotations:
      nginx.ingress.kubernetes.io/whitelist-source-range: 3.3.X.X
    name: demo-route
  spec:
    ingressClassName: mse
    rules:
      - host: example.com
        http:
          paths:
            - path: /order
              backend:
                serviceName: demo-service
                servicePort: 80

例如：

• 限制example.com/test的请求每分钟最大请求数为100，瞬时请求数为200。配置如下：

  1.19及之后版本集群

  apiVersion: networking.k8s.io/v1
  kind: Ingress
  metadata:
    annotations:
      mse.ingress.kubernetes.io/route-limit-rpm: "100"
      mse.ingress.kubernetes.io/route-limit-burst-multiplier: "2"
    name: demo
  spec:
    ingressClassName: mse
    rules:
      - host: example.com
        http:
          paths:
            - backend:
                service:
                  name: demo-service
                  port: 
                    number: 80
              path: /test
              pathType: Exact

  1.19版本之前集群

  apiVersion: networking.k8s.io/v1beta1
  kind: Ingress
  metadata:
    annotations:
      mse.ingress.kubernetes.io/route-limit-rpm: "100"
      mse.ingress.kubernetes.io/route-limit-burst-multiplier: "2"
    name: demo
  spec:
    ingressClassName: mse
    rules:
      - host: example.com
        http:
          paths:
            - path: /test
              backend:
                serviceName: demo-service
                servicePort: 80

• 限制example.com/test的请求每秒最大请求数为10，瞬时请求数50。配置如下：

  1.19及之后版本集群

  apiVersion: networking.k8s.io/v1
  kind: Ingress
  metadata:
    annotations:
      mse.ingress.kubernetes.io/route-limit-rps: "10"
      # 默认为5
      # mse.ingress.kubernetes.io/route-limit-burst-multiplier: "5"
    name: demo
  spec:
    ingressClassName: mse
    rules:
      - host: example.com
        http:
          paths:
            - backend:
                service:
                  name: demo-service
                  port: 
                    number: 80
              path: /test
              pathType: Exact

  1.19版本之前集群

  apiVersion: networking.k8s.io/v1beta1
  kind: Ingress
  metadata:
    annotations:
      mse.ingress.kubernetes.io/route-limit-rps: "10"
      # 默认为5
      # mse.ingress.kubernetes.io/route-limit-burst-multiplier: "5"
    name: demo
  spec:
    ingressClassName: mse
    rules:
      - host: example.com
        http:
          paths:
            - path: /test
              backend:
                serviceName: demo-service
                servicePort: 80

样例一：期望限制example.com/test的请求在网关集群全局上最大处理请求数为1000，保持默认的并发行为。

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    mse.ingress.kubernetes.io/concurrency-limit: "1000"
  name: demo
spec:
  ingressClassName: mse
  rules:
    - host: example.com
      http:
        paths:
          - backend:
              service:
                name: demo-service
                port: 
                  number: 80
            path: /test
            pathType: Exact

apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  annotations:
    mse.ingress.kubernetes.io/concurrency-limit: "1000"
  name: demo
spec:
  ingressClassName: mse
  rules:
    - host: example.com
      http:
        paths:
          - path: /test
            backend:
              serviceName: demo-service
              servicePort: 80

样例二：期望限制example.com/test的请求在网关集群全局最大处理请求数为1000，触发并发控制时，响应状态码为503，响应体为server is overloaded。

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    mse.ingress.kubernetes.io/concurrency-limit: "1000"
    mse.ingress.kubernetes.io/concurrency-limit-fallback-custom-response-code: 503
    mse.ingress.kubernetes.io/concurrency-limit-fallback-custom-response-body: "server is overload"
  name: demo
spec:
  ingressClassName: mse
  rules:
    - host: example.com
      http:
        paths:
          - backend:
              service:
                name: demo-service
                port: 
                  number: 80
            path: /test
            pathType: Exact

apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  annotations:
    mse.ingress.kubernetes.io/concurrency-limit: "1000"
    mse.ingress.kubernetes.io/concurrency-limit-fallback-custom-response-code: 503
    mse.ingress.kubernetes.io/concurrency-limit-fallback-custom-response-body: "server is overload"
  name: demo
spec:
  ingressClassName: mse
  rules:
    - host: example.com
      http:
        paths:
          - path: /test
            backend:
              serviceName: demo-service
              servicePort: 80

例如：

• 请求example/test转发至后端服务使用HTTPS协议。配置如下：

  1.19及之后版本集群

  apiVersion: networking.k8s.io/v1
  kind: Ingress
  metadata:
    annotations:
      nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
    name: demo
  spec:
    ingressClassName: mse
    rules:
      - host: example.com
        http:
          paths:
            - backend:
                service:
                  name: demo-service
                  port: 
                    number: 80
              path: /
              pathType: Exact

  1.19版本之前集群

  apiVersion: networking.k8s.io/v1beta1
  kind: Ingress
  metadata:
    annotations:
      nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
    name: demo
  spec:
    ingressClassName: mse
    rules:
      - host: example.com
        http:
          paths:
            - path: /test
              backend:
                serviceName: demo-service
                servicePort: 80

• 请求example/test转发至后端服务使用gRPC协议。此处列举两种做法，如下：

  • 方法1：通过注解，配置如下：

    1.19及之后版本集群

    apiVersion: networking.k8s.io/v1
    kind: Ingress
    metadata:
      annotations:
        nginx.ingress.kubernetes.io/backend-protocol: "GRPC"
      name: demo
    spec:
      ingressClassName: mse
      rules:
        - host: example.com
          http:
            paths:
              - backend:
                  service:
                    name: demo-service
                    port: 
                      number: 80
                path: /test
                pathType: Exact

    1.19版本之前集群

    apiVersion: networking.k8s.io/v1beta1
    kind: Ingress
    metadata:
      annotations:
        nginx.ingress.kubernetes.io/backend-protocol: "GRPC"
      name: demo
    spec:
      ingressClassName: mse
      rules:
        - host: example.com
          http:
            paths:
              - path: /test
                backend:
                  serviceName: demo-service
                  servicePort: 80

  • 方法2：通过Service Port Name，配置如下：

    1.19及之后版本集群

    apiVersion: networking.k8s.io/v1
    kind: Ingress
    metadata:
      name: demo
    spec:
      ingressClassName: mse
      rules:
        - host: example.com
          http:
            paths:
              - backend:
                  service:
                    name: demo-service
                    port: 
                      number: 80
                path: /order
                pathType: Exact
    ---
    apiVersion: v1
    kind: Service
    metadata:
      name: demo-service
    spec:
      ports:
        - name: grpc
          port: 80
          protocol: TCP
      selector:
        app: demo-service

    1.19版本之前集群

    apiVersion: networking.k8s.io/v1beta1
    kind: Ingress
    metadata:
      name: demo
    spec:
      ingressClassName: mse
      rules:
        - host: example.com
          http:
            paths:
              - path: /test
                backend:
                  serviceName: demo-service
                  servicePort: 80
    ---
    apiVersion: v1
    kind: Service
    metadata:
      name: demo-service
    spec:
      ports:
        - name: grpc
          port: 80
          protocol: TCP
      selector:
        app: demo-service

nginx.ingress.kubernetes.io/load-balance：后端服务的普通负载均衡算法。默认为round_robin。合法值如下：

• round_robin：基于轮询的负载均衡。

• least_conn：基于最小请求数的负载均衡。

• random：基于随机的负载均衡。

nginx.ingress.kubernetes.io/upstream-hash-by：基于一致性Hash的负载均衡算法，云原生网关支持以下几种形式：

• 云原生网关支持配置部分nginx变量：

  • $request_uri：请求的Path（包括路径参数）作为Hash Key。

  • $host：请求的Host作为Hash Key。

  • $remote_addr：请求的客户端IP作为Hash Key。

• 基于请求Header的一致性Hash。您只需配置为$http_headerName。

• 基于请求路径参数的一致性Hash。您只需配置为$arg_varName。

例如：

• 基于请求的客户端IP作为Hash Key，同一个客户端IP的请求始终负载到同一个节点。配置如下：

  1.19及之后版本集群

  apiVersion: networking.k8s.io/v1
  kind: Ingress
  metadata:
    annotations:
      nginx.ingress.kubernetes.io/upstream-hash-by: "$remote_addr"
    name: demo
  spec:
    ingressClassName: mse
    rules:
      - host: example.com
        http:
          paths:
            - backend:
                service:
                  name: demo-service
                  port: 
                    number: 80
              path: /test
              pathType: Exact

  1.19版本之前集群

  apiVersion: networking.k8s.io/v1beta1
  kind: Ingress
  metadata:
    annotations:
      nginx.ingress.kubernetes.io/upstream-hash-by: "$remote_addr"
    name: demo
  spec:
    ingressClassName: mse
    rules:
      - host: example.com
        http:
          paths:
            - path: /test
              backend:
                serviceName: demo-service
                servicePort: 80

• 基于请求Header x-stage作为Hash key，带有x-stage头部的请求且值相同的请求始终负载到同一个节点。配置如下：

  1.19及之后版本集群

  apiVersion: networking.k8s.io/v1
  kind: Ingress
  metadata:
    annotations:
      nginx.ingress.kubernetes.io/upstream-hash-by: "$http_x-stage"
    name: demo
  spec:
    ingressClassName: mse
    rules:
      - host: example.com
        http:
          paths:
            - backend:
                service:
                  name: demo-service
                  port: 
                    number: 80
              path: /test
              pathType: Exact

  1.19版本之前集群

  apiVersion: networking.k8s.io/v1beta1
  kind: Ingress
  metadata:
    annotations:
      nginx.ingress.kubernetes.io/upstream-hash-by: "$http_x-stage"
    name: demo
  spec:
    ingressClassName: mse
    rules:
      - host: example.com
        http:
          paths:
            - path: /test
              backend:
                serviceName: demo-service
                servicePort: 80

• 基于请求路径参数 x-stage作为Hash key，带有路径参数x-stage的请求且值相同的请求始终负载到同一个节点。配置如下：

  1.19及之后版本集群

  apiVersion: networking.k8s.io/v1
  kind: Ingress
  metadata:
    annotations:
      nginx.ingress.kubernetes.io/upstream-hash-by: "$arg_x-stage"
    name: demo
  spec:
    ingressClassName: mse
    rules:
      - host: example.com
        http:
          paths:
            - backend:
                service:
                  name: demo-service
                  port: 
                    number: 80
              path: /test
              pathType: Exact

  1.19版本之前集群

  apiVersion: networking.k8s.io/v1beta1
  kind: Ingress
  metadata:
    annotations:
      nginx.ingress.kubernetes.io/upstream-hash-by: "$arg_x-stage"
    name: demo
  spec:
    ingressClassName: mse
    rules:
      - host: example.com
        http:
          paths:
            - path: /test
              backend:
                serviceName: demo-service
                servicePort: 80

例如：

• 开启Cookie亲和性，利用MSE Ingress的默认配置，即Cookie的名字为INGRESSCOOKIE，Path为/，Cookie的生命周期为Session会话级别。配置如下：

  1.19及之后版本集群

  apiVersion: networking.k8s.io/v1
  kind: Ingress
  metadata:
    annotations:
      nginx.ingress.kubernetes.io/affinity: "cookie"
    name: demo
  spec:
    ingressClassName: mse
    rules:
      - host: example.com
        http:
          paths:
            - backend:
                service:
                  name: demo-service
                  port: 
                    number: 80
              path: /test
              pathType: Exact

  1.19版本之前集群

  apiVersion: networking.k8s.io/v1beta1
  kind: Ingress
  metadata:
    annotations:
      nginx.ingress.kubernetes.io/affinity: "cookie"
    name: demo
  spec:
    ingressClassName: mse
    rules:
      - host: example.com
        http:
          paths:
            - path: /test
              backend:
                serviceName: demo-service
                servicePort: 80

• 开启Cookie亲和性，Cookie的名字为test，Path为/，Cookie的过期时间为10s。配置如下：

  1.19及之后版本集群

  apiVersion: networking.k8s.io/v1
  kind: Ingress
  metadata:
    annotations:
      nginx.ingress.kubernetes.io/affinity: "cookie"
      nginx.ingress.kubernetes.io/session-cookie-name: "test"
      nginx.ingress.kubernetes.io/session-cookie-max-age: "10"
    name: demo
  spec:
    ingressClassName: mse
    rules:
      - host: example.com
        http:
          paths:
            - backend:
                service:
                  name: demo-service
                  port: 
                    number: 80
              path: /test
              pathType: Exact

  1.19版本之前集群

  apiVersion: networking.k8s.io/v1beta1
  kind: Ingress
  metadata:
    annotations:
      nginx.ingress.kubernetes.io/affinity: "cookie"
      nginx.ingress.kubernetes.io/session-cookie-name: "test"
      nginx.ingress.kubernetes.io/session-cookie-max-age: "10"
    name: demo
  spec:
    ingressClassName: mse
    rules:
      - host: example.com
        http:
          paths:
            - path: /test
              backend:
                serviceName: demo-service
                servicePort: 80

目前，MSE Ingress默认最小TLS版本为TLSv1.0，默认最大TLS版本为TLSv1.3，默认加密套件为：

• ECDHE-ECDSA-AES128-GCM-SHA256

• ECDHE-RSA-AES128-GCM-SHA256

• ECDHE-ECDSA-AES128-SHA

• ECDHE-RSA-AES128-SHA

• AES128-GCM-SHA256

• AES128-SHA

• ECDHE-ECDSA-AES256-GCM-SHA384

• ECDHE-RSA-AES256-GCM-SHA384

• ECDHE-ECDSA-AES256-SHA

• ECDHE-RSA-AES256-SHA

• AES256-GCM-SHA384

• AES256-SHA

您可以通过以下注解为特定的域名设置最小或者最大TLS版本以及加密套件。