Closed aledbf closed 3 years ago
[APPROVALNOTIFIER] This PR is NOT APPROVED
This pull-request has been approved by: aledbf
To complete the pull request process, please assign thockin after the PR has been reviewed.
You can assign the PR to them by writing /assign @thockin
in a comment when ready.
The full list of commands accepted by this bot can be found here.
Note: other ingress controllers like Kong are also impacted by this scenario.
Kong does follow that spec for Ingress v1 resource: https://github.com/Kong/kubernetes-ingress-controller/blob/8c9484644823191b533ee3493afd755a3052c034/internal/ingress/controller/parser/translate.go#L525
A /foo
prefix match is translated into nginx as /foo$
and /foo/
to ensure that it doesn't match /foobar
.
cc @mflendrich @rainest
A /foo prefix match is translated into nginx as /foo$ and /foo/ to ensure that it doesn't match /foobar.
@hbagdi so you generate two locations for that scenario? What if the user also defines an PathTypeExact?
match is translated into nginx
As @mflendrich pointed out out of band, I meant Kong here.
@hbagdi so you generate two locations for that scenario?
Kong doesn't generate location blocks in nginx directly. We populate two paths in a single Route for this use case.
What if the user also defines an PathTypeExact?
In that case, only a single path is populated /foo$
.
What if the user also defines an PathTypeExact?
To add to @hbagdi's response above:
If a user defines an Exact
rule and a Prefix
rule that both translate to /foo$
on the Kong side, then the following KEP rule:
Exact
match is preferred to aPrefix
match.
is followed because Kong ingress controller defines them in Kong with different priorities.
According to the KEP, this is the expected behavior:
https://github.com/kubernetes/enhancements/blob/master/keps/sig-network/20190125-ingress-api-group.md#prefix-match
Now, imposing this behavior in the conformance suite means (at least for ingress-nginx) a breaking change that does not add any benefits. Can we remove this scenario?
cc @bowei @robscott
Note: other ingress controllers like Kong are also impacted by this scenario.this was an mistake