skip to Main Content

I want to prevent unsafe requested to reach my application running in GCP GKE with Google Ingress (not nginx) and trying to do this using path rules.
I know nginx Ingress can configure paths using regex but I don know the best way to do with Google Ingress.
Right now I am just duplicating the same rules change the path prefix like this:

spec:
  rules:
  - http:
      paths:
      - backend:
          service:
            name: my-api-service
            port:
              number: 80
        path: /api
        pathType: Prefix
      - backend:
          service:
            name: my-api-service
            port:
              number: 80
        path: /auth
        pathType: Prefix
      - backend:
          service:
            name: my-api-service
            port:
              number: 80
        path: /admin
        pathType: Prefix

Is there a better way to do this?

2

Answers


  1. Everything you’re looking for is covered in this document. As GKE ingress is essentially a GCP Load Balancer, the path key is using a url-map to configure and route the traffic to what you’ve specified in the config. As you’d be able to see there, regexs are not allowed in Path keys.

    One option if you’re using Helm is to make use of the templates to generate this automatically from a variable. Given the following variable in your values.yaml file:

    paths:
     - name: /api
     - name: /admin
     - name: /auth
    

    Then in your ingress YAML definition you can do the following:

    spec:
      rules:
      - http:
          paths:
    {{ range $paths := .Values.paths }}
          - backend:
              service:
                name: my-api-service
                port:
                  number: 80
            path: {{ .name }}
            pathType: Prefix
    {{ end }}
    
    Login or Signup to reply.
  2. In GKE ingress regex is not allowed in paths as it is using the url-map to configure GCP Load Balancers. Only wildcard allowed in paths is *. We cannot use any other wildcards in the path key.

    So you can try like this

      spec:
          rules:
          - http:
              paths:
              - backend:
                  service:
                    name: my-api-service
                    port:
                      number: 80
                path: /*
                pathType: Prefix
              
    

    (or)

    You can use the default backend services to route the traffic to the single service like in this document

       spec:
         defaultBackend:
           service:
            name: my-api-service
            port:
             number: 80
    

    You can give a try by changing the annotation like mentioned in this SO.

    There are other similar SO’s SO1 SO2.

    Login or Signup to reply.
Please signup or login to give your own answer.
Back To Top
Search