Skip to content

Commit f5953bb

Browse files
maxlaversemaxlaverse
committed
Add X-Forwarded-Prefix on rewrites
1 parent 6816630 commit f5953bb

File tree

9 files changed

+119
-25
lines changed

9 files changed

+119
-25
lines changed

‎docs/annotations.md

+1
Original file line numberDiff line numberDiff line change
@@ -51,6 +51,7 @@ Key:
5151
| `add-base-url` | Add `<base>` tag to HTML. | | nginx
5252
| `base-url-scheme` | Specify the scheme of the `<base>` tags. | | nginx
5353
| `preserve-host` | Whether to pass the client request host (`true`) or the origin hostname (`false`) in the HTTP Host field. | | trafficserver
54+
| `x-forwarded-prefix` | Add the non-standard `X-Forwarded-Prefix` header to the request with the value of the matched location. | | nginx
5455

5556
## CORS Related
5657
| Name | Meaning | Default | Controller

‎internal/ingress/annotations/annotations.go

+3
Original file line numberDiff line numberDiff line change
@@ -47,6 +47,7 @@ import (
4747
"k8s.io/ingress-nginx/internal/ingress/annotations/upstreamhashby"
4848
"k8s.io/ingress-nginx/internal/ingress/annotations/upstreamvhost"
4949
"k8s.io/ingress-nginx/internal/ingress/annotations/vtsfilterkey"
50+
"k8s.io/ingress-nginx/internal/ingress/annotations/xforwardedprefix"
5051
"k8s.io/ingress-nginx/internal/ingress/errors"
5152
"k8s.io/ingress-nginx/internal/ingress/resolver"
5253
)
@@ -81,6 +82,7 @@ type Ingress struct {
8182
UpstreamVhost string
8283
VtsFilterKey string
8384
Whitelist ipwhitelist.SourceRange
85+
XForwardedPrefix bool
8486
}
8587

8688
// Extractor defines the annotation parsers to be used in the extraction of annotations
@@ -115,6 +117,7 @@ func NewAnnotationExtractor(cfg resolver.Resolver) Extractor {
115117
"UpstreamVhost": upstreamvhost.NewParser(cfg),
116118
"VtsFilterKey": vtsfilterkey.NewParser(cfg),
117119
"Whitelist": ipwhitelist.NewParser(cfg),
120+
"XForwardedPrefix": xforwardedprefix.NewParser(cfg),
118121
},
119122
}
120123
}

‎internal/ingress/annotations/xforwardedprefix/main.go

+23
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
package xforwardedprefix
2+
3+
import (
4+
extensions "k8s.io/api/extensions/v1beta1"
5+
6+
"k8s.io/ingress-nginx/internal/ingress/annotations/parser"
7+
"k8s.io/ingress-nginx/internal/ingress/resolver"
8+
)
9+
10+
type xforwardedprefix struct {
11+
r resolver.Resolver
12+
}
13+
14+
// NewParser creates a new xforwardedprefix annotation parser
15+
func NewParser(r resolver.Resolver) parser.IngressAnnotation {
16+
return xforwardedprefix{r}
17+
}
18+
19+
// Parse parses the annotations contained in the ingress rule
20+
// used to add an x-forwarded-prefix header to the request
21+
func (cbbs xforwardedprefix) Parse(ing *extensions.Ingress) (interface{}, error) {
22+
return parser.GetBoolAnnotation("x-forwarded-prefix", ing)
23+
}

‎internal/ingress/annotations/xforwardedprefix/main_test.go

+46
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
package xforwardedprefix
2+
3+
import (
4+
"testing"
5+
6+
api "k8s.io/api/core/v1"
7+
extensions "k8s.io/api/extensions/v1beta1"
8+
meta_v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
9+
"k8s.io/ingress-nginx/internal/ingress/annotations/parser"
10+
"k8s.io/ingress-nginx/internal/ingress/resolver"
11+
)
12+
13+
func TestParse(t *testing.T) {
14+
annotation := parser.GetAnnotationWithPrefix("x-forwarded-prefix")
15+
ap := NewParser(&resolver.Mock{})
16+
if ap == nil {
17+
t.Fatalf("expected a parser.IngressAnnotation but returned nil")
18+
}
19+
20+
testCases := []struct {
21+
annotations map[string]string
22+
expected bool
23+
}{
24+
{map[string]string{annotation: "true"}, true},
25+
{map[string]string{annotation: "1"}, true},
26+
{map[string]string{annotation: ""}, false},
27+
{map[string]string{}, false},
28+
{nil, false},
29+
}
30+
31+
ing := &extensions.Ingress{
32+
ObjectMeta: meta_v1.ObjectMeta{
33+
Name: "foo",
34+
Namespace: api.NamespaceDefault,
35+
},
36+
Spec: extensions.IngressSpec{},
37+
}
38+
39+
for _, testCase := range testCases {
40+
ing.SetAnnotations(testCase.annotations)
41+
result, _ := ap.Parse(ing)
42+
if result != testCase.expected {
43+
t.Errorf("expected %v but returned %v, annotations: %s", testCase.expected, result, testCase.annotations)
44+
}
45+
}
46+
}

‎internal/ingress/controller/controller.go

+2
Original file line numberDiff line numberDiff line change
@@ -473,6 +473,7 @@ func (n *NGINXController) getBackendServers(ingresses []*extensions.Ingress) ([]
473473
loc.VtsFilterKey = anns.VtsFilterKey
474474
loc.Whitelist = anns.Whitelist
475475
loc.Denied = anns.Denied
476+
loc.XForwardedPrefix = anns.XForwardedPrefix
476477

477478
if loc.Redirect.FromToWWW {
478479
server.RedirectFromToWWW = true
@@ -503,6 +504,7 @@ func (n *NGINXController) getBackendServers(ingresses []*extensions.Ingress) ([]
503504
VtsFilterKey: anns.VtsFilterKey,
504505
Whitelist: anns.Whitelist,
505506
Denied: anns.Denied,
507+
XForwardedPrefix: anns.XForwardedPrefix,
506508
}
507509

508510
if loc.Redirect.FromToWWW {

‎internal/ingress/controller/template/template.go

+9-4
Original file line numberDiff line numberDiff line change
@@ -324,20 +324,25 @@ func buildProxyPass(host string, b interface{}, loc interface{}) string {
324324
}
325325
}
326326

327+
xForwardedPrefix := ""
328+
if location.XForwardedPrefix {
329+
xForwardedPrefix = fmt.Sprintf(`proxy_set_header X-Forwarded-Prefix "%s";
330+
`, path)
331+
}
327332
if location.Rewrite.Target == slash {
328333
// special case redirect to /
329334
// ie /something to /
330335
return fmt.Sprintf(`
331336
rewrite %s(.*) /$1 break;
332337
rewrite %s / break;
333-
proxy_pass %s://%s;
334-
%v`, path, location.Path, proto, upstreamName, abu)
338+
%vproxy_pass %s://%s;
339+
%v`, path, location.Path, xForwardedPrefix, proto, upstreamName, abu)
335340
}
336341

337342
return fmt.Sprintf(`
338343
rewrite %s(.*) %s/$1 break;
339-
proxy_pass %s://%s;
340-
%v`, path, location.Rewrite.Target, proto, upstreamName, abu)
344+
%vproxy_pass %s://%s;
345+
%v`, path, location.Rewrite.Target, xForwardedPrefix, proto, upstreamName, abu)
341346
}
342347

343348
// default proxy_pass

‎internal/ingress/controller/template/template_test.go

+28-21
Original file line numberDiff line numberDiff line change
@@ -36,64 +36,70 @@ import (
3636
var (
3737
// TODO: add tests for secure endpoints
3838
tmplFuncTestcases = map[string]struct {
39-
Path string
40-
Target string
41-
Location string
42-
ProxyPass string
43-
AddBaseURL bool
44-
BaseURLScheme string
45-
Sticky bool
39+
Path string
40+
Target string
41+
Location string
42+
ProxyPass string
43+
AddBaseURL bool
44+
BaseURLScheme string
45+
Sticky bool
46+
XForwardedPrefix bool
4647
}{
47-
"invalid redirect / to /": {"/", "/", "/", "proxy_pass http://upstream-name;", false, "", false},
48+
"invalid redirect / to /": {"/", "/", "/", "proxy_pass http://upstream-name;", false, "", false, false},
4849
"redirect / to /jenkins": {"/", "/jenkins", "~* /",
4950
`
5051
rewrite /(.*) /jenkins/$1 break;
5152
proxy_pass http://upstream-name;
52-
`, false, "", false},
53+
`, false, "", false, false},
5354
"redirect /something to /": {"/something", "/", `~* ^/something\/?(?<baseuri>.*)`, `
5455
rewrite /something/(.*) /$1 break;
5556
rewrite /something / break;
5657
proxy_pass http://upstream-name;
57-
`, false, "", false},
58+
`, false, "", false, false},
5859
"redirect /end-with-slash/ to /not-root": {"/end-with-slash/", "/not-root", "~* ^/end-with-slash/(?<baseuri>.*)", `
5960
rewrite /end-with-slash/(.*) /not-root/$1 break;
6061
proxy_pass http://upstream-name;
61-
`, false, "", false},
62+
`, false, "", false, false},
6263
"redirect /something-complex to /not-root": {"/something-complex", "/not-root", `~* ^/something-complex\/?(?<baseuri>.*)`, `
6364
rewrite /something-complex/(.*) /not-root/$1 break;
6465
proxy_pass http://upstream-name;
65-
`, false, "", false},
66+
`, false, "", false, false},
6667
"redirect / to /jenkins and rewrite": {"/", "/jenkins", "~* /", `
6768
rewrite /(.*) /jenkins/$1 break;
6869
proxy_pass http://upstream-name;
6970
subs_filter '(<(?:H|h)(?:E|e)(?:A|a)(?:D|d)(?:[^">]|"[^"]*")*>)' '$1<base href="$scheme://$http_host/$baseuri">' ro;
70-
`, true, "", false},
71+
`, true, "", false, false},
7172
"redirect /something to / and rewrite": {"/something", "/", `~* ^/something\/?(?<baseuri>.*)`, `
7273
rewrite /something/(.*) /$1 break;
7374
rewrite /something / break;
7475
proxy_pass http://upstream-name;
7576
subs_filter '(<(?:H|h)(?:E|e)(?:A|a)(?:D|d)(?:[^">]|"[^"]*")*>)' '$1<base href="$scheme://$http_host/something/$baseuri">' ro;
76-
`, true, "", false},
77+
`, true, "", false, false},
7778
"redirect /end-with-slash/ to /not-root and rewrite": {"/end-with-slash/", "/not-root", `~* ^/end-with-slash/(?<baseuri>.*)`, `
7879
rewrite /end-with-slash/(.*) /not-root/$1 break;
7980
proxy_pass http://upstream-name;
8081
subs_filter '(<(?:H|h)(?:E|e)(?:A|a)(?:D|d)(?:[^">]|"[^"]*")*>)' '$1<base href="$scheme://$http_host/end-with-slash/$baseuri">' ro;
81-
`, true, "", false},
82+
`, true, "", false, false},
8283
"redirect /something-complex to /not-root and rewrite": {"/something-complex", "/not-root", `~* ^/something-complex\/?(?<baseuri>.*)`, `
8384
rewrite /something-complex/(.*) /not-root/$1 break;
8485
proxy_pass http://upstream-name;
8586
subs_filter '(<(?:H|h)(?:E|e)(?:A|a)(?:D|d)(?:[^">]|"[^"]*")*>)' '$1<base href="$scheme://$http_host/something-complex/$baseuri">' ro;
86-
`, true, "", false},
87+
`, true, "", false, false},
8788
"redirect /something to / and rewrite with specific scheme": {"/something", "/", `~* ^/something\/?(?<baseuri>.*)`, `
8889
rewrite /something/(.*) /$1 break;
8990
rewrite /something / break;
9091
proxy_pass http://upstream-name;
9192
subs_filter '(<(?:H|h)(?:E|e)(?:A|a)(?:D|d)(?:[^">]|"[^"]*")*>)' '$1<base href="http://$http_host/something/$baseuri">' ro;
92-
`, true, "http", false},
93+
`, true, "http", false, false},
9394
"redirect / to /something with sticky enabled": {"/", "/something", `~* /`, `
9495
rewrite /(.*) /something/$1 break;
9596
proxy_pass http://sticky-upstream-name;
96-
`, false, "http", true},
97+
`, false, "http", true, false},
98+
"add the X-Forwarded-Prefix header": {"/there", "/something", `~* ^/there\/?(?<baseuri>.*)`, `
99+
rewrite /there/(.*) /something/$1 break;
100+
proxy_set_header X-Forwarded-Prefix "/there/";
101+
proxy_pass http://sticky-upstream-name;
102+
`, false, "http", true, true},
97103
}
98104
)
99105

@@ -136,9 +142,10 @@ func TestBuildProxyPass(t *testing.T) {
136142

137143
for k, tc := range tmplFuncTestcases {
138144
loc := &ingress.Location{
139-
Path: tc.Path,
140-
Rewrite: rewrite.Config{Target: tc.Target, AddBaseURL: tc.AddBaseURL, BaseURLScheme: tc.BaseURLScheme},
141-
Backend: defaultBackend,
145+
Path: tc.Path,
146+
Rewrite: rewrite.Config{Target: tc.Target, AddBaseURL: tc.AddBaseURL, BaseURLScheme: tc.BaseURLScheme},
147+
Backend: defaultBackend,
148+
XForwardedPrefix: tc.XForwardedPrefix,
142149
}
143150

144151
backends := []*ingress.Backend{}

‎internal/ingress/types.go

+4
Original file line numberDiff line numberDiff line change
@@ -259,6 +259,10 @@ type Location struct {
259259
// DefaultBackend allows the use of a custom default backend for this location.
260260
// +optional
261261
DefaultBackend *apiv1.Service `json:"defaultBackend,omitempty"`
262+
// XForwardedPrefix allows to add a header X-Forwarded-Prefix to the request with the
263+
// original location.
264+
// +optional
265+
XForwardedPrefix bool `json:"xForwardedPrefix,omitempty"`
262266
}
263267

264268
// SSLPassthroughBackend describes a SSL upstream server configured

‎internal/ingress/types_equals.go

+3
Original file line numberDiff line numberDiff line change
@@ -367,6 +367,9 @@ func (l1 *Location) Equal(l2 *Location) bool {
367367
if l1.UpstreamVhost != l2.UpstreamVhost {
368368
return false
369369
}
370+
if l1.XForwardedPrefix != l2.XForwardedPrefix {
371+
return false
372+
}
370373

371374
return true
372375
}

0 commit comments

Comments
 (0)