k8s-ci-robot
commented
1 year ago @Gerrit-K: This issue is currently awaiting triage.
If Ingress contributors determines this is a relevant issue, they will accept it by applying the triage/accepted label and provide further guidance.
The triage/accepted label can be added by org members by writing /triage accepted in a comment.
Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md). If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository.
longwuyuan
Gerrit-K
What happened:
When deploying two identical ingresses, except for the second one with the following additional annotations:
the
temporal-redirectannotation doesn't work. I.e., when a request with the canary header hits the canary ingress, it doesn't get redirected tohttps://google.combut instead is just routed to the backend service as if the annotation was not present.What you expected to happen:
The annotation should work, even if used at a canary ingress.
NGINX Ingress controller version (exec into the pod and run nginx-ingress-controller --version.):
Kubernetes version (use
kubectl version):Environment:
Cloud provider or hardware configuration: Azure Kubernetes Service
How was the ingress-nginx-controller installed: helm chart, but via Pulumi. Pulumi doesn't use helm directly, but rather renders the manifests of the chart and manages them on its own. The used chart version is
4.4.0. Values:values
```ts // we're using Pulumi with TypeScript, so this is an object which contains references, but they're likely not relevant for this issue { fullnameOverride: 'nginx', controller: { metrics: { enabled: true, port: metricsPort, service: { annotations: { 'prometheus.io/scrape': 'true', 'prometheus.io/port': `${metricsPort}`, 'prometheus.io/scheme': 'http', }, }, }, ingressClass: ingressClassName, ingressClassResource: { name: ingressClassName, enabled: true, default: true, }, service: { externalTrafficPolicy: 'Local', }, extraArgs: { 'default-ssl-certificate': certificateSecretName, }, priorityClassName: priorityClass.metadata.name, }, } ```How to reproduce this issue: I used RancherDesktop but I assume the steps can also be reproduced on kind/k3s/minikube or any other cluster. I installed the ingress controller as suggested from https://raw.githubusercontent.com/kubernetes/ingress-nginx/main/deploy/static/provider/baremetal/deploy.yaml.
Then I've deployed these two deployments and services (note: I needed to choose a different echoserver due to my ARM architecture):
Deployments and Services
```yaml apiVersion: apps/v1 kind: Deployment metadata: name: production labels: app: production spec: replicas: 1 selector: matchLabels: app: production template: metadata: labels: app: production spec: containers: - name: production image: kicbase/echo-server:1.0 ports: - containerPort: 8080 env: - name: NODE_NAME valueFrom: fieldRef: fieldPath: spec.nodeName - name: POD_NAME valueFrom: fieldRef: fieldPath: metadata.name - name: POD_NAMESPACE valueFrom: fieldRef: fieldPath: metadata.namespace - name: POD_IP valueFrom: fieldRef: fieldPath: status.podIP --- apiVersion: apps/v1 kind: Deployment metadata: name: canary labels: app: canary spec: replicas: 1 selector: matchLabels: app: canary template: metadata: labels: app: canary spec: containers: - name: canary image: kicbase/echo-server:1.0 ports: - containerPort: 8080 env: - name: NODE_NAME valueFrom: fieldRef: fieldPath: spec.nodeName - name: POD_NAME valueFrom: fieldRef: fieldPath: metadata.name - name: POD_NAMESPACE valueFrom: fieldRef: fieldPath: metadata.namespace - name: POD_IP valueFrom: fieldRef: fieldPath: status.podIP --- apiVersion: v1 kind: Service metadata: name: production labels: app: production spec: ports: - port: 80 targetPort: 8080 protocol: TCP name: http selector: app: production --- apiVersion: v1 kind: Service metadata: name: canary labels: app: canary spec: ports: - port: 80 targetPort: 8080 protocol: TCP name: http selector: app: canary ```Those are paired with these two ingress objects:
Ingresses
```yaml apiVersion: networking.k8s.io/v1 kind: Ingress metadata: name: production labels: app.kubernetes.io/name: production annotations: kubernetes.io/ingress.class: nginx spec: rules: - host: foo.bar http: paths: - backend: service: name: production port: number: 80 path: / pathType: Prefix --- apiVersion: networking.k8s.io/v1 kind: Ingress metadata: name: canary labels: app.kubernetes.io/name: canary annotations: kubernetes.io/ingress.class: nginx nginx.ingress.kubernetes.io/canary: "true" nginx.ingress.kubernetes.io/canary-by-header: "canary" nginx.ingress.kubernetes.io/temporal-redirect: "https://google.com" spec: rules: - host: foo.bar http: paths: - backend: service: name: canary port: number: 80 path: / pathType: Prefix ```Now making a request without the canary header results in the expected response:
Commands & output
``` POD_NAME=$(k get pods -n ingress-nginx -l app.kubernetes.io/name=ingress-nginx -o NAME) kubectl exec -it -n ingress-nginx $POD_NAME -- curl -sSLi -H 'Host: foo.bar' localhost # results in: HTTP/1.1 200 OK Date: Tue, 27 Dec 2022 10:56:55 GMT Content-Type: text/plain Content-Length: 318 Connection: keep-alive Request served by production-b7c6f88d5-6bj9f HTTP/1.1 GET / Host: foo.bar Accept: */* User-Agent: curl/7.83.1 X-Forwarded-For: 127.0.0.1 X-Forwarded-Host: foo.bar X-Forwarded-Port: 80 X-Forwarded-Proto: http X-Forwarded-Scheme: http X-Real-Ip: 127.0.0.1 X-Request-Id: 985b163bdceed8bb299d0c4c5b831402 X-Scheme: http ```But when the header
canary: alwaysis added, we just get the redirect to the canary pod, but not the one from thetemporal-redirectannotation:Commands & output
``` POD_NAME=$(k get pods -n ingress-nginx -l app.kubernetes.io/name=ingress-nginx -o NAME) kubectl exec -it -n ingress-nginx $POD_NAME -- curl -sSLi -H 'Host: foo.bar' -H 'canary: always' localhost # results in: HTTP/1.1 200 OK Date: Tue, 27 Dec 2022 10:53:56 GMT Content-Type: text/plain Content-Length: 330 Connection: keep-alive Request served by canary-758dcff8c5-fs2z8 HTTP/1.1 GET / Host: foo.bar Accept: */* Canary: always User-Agent: curl/7.83.1 X-Forwarded-For: 127.0.0.1 X-Forwarded-Host: foo.bar X-Forwarded-Port: 80 X-Forwarded-Proto: http X-Forwarded-Scheme: http X-Real-Ip: 127.0.0.1 X-Request-Id: a3ba406a177b4f3b000cde0bac2908cb X-Scheme: http ```