Ingress 与 Gateway API

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: my-ingress
spec:
  ingressClassName: nginx       # 指定由哪个 Controller 处理(集群可装多个)
  rules:
  - host: api.example.com       # 匹配域名
    http:
      paths:
      - path: /                 # 匹配路径前缀
        pathType: Prefix
        backend:
          service:
            name: api-svc       # 转发到的 Service 名
            port:
              number: 80        # Service 的 port(不是 targetPort)

spec:
  rules:
  - host: api.example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: api-svc
            port:
              number: 80
  - host: app.example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: frontend-svc
            port:
              number: 80
  - host: admin.example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: admin-svc
            port:
              number: 80

spec:
  rules:
  - host: example.com
    http:
      paths:
      - path: /api
        pathType: Prefix        # /api,/api/users,/api/orders 都匹配
        backend:
          service:
            name: api-svc
            port:
              number: 80
      - path: /static
        pathType: Prefix
        backend:
          service:
            name: cdn-svc
            port:
              number: 80
      - path: /
        pathType: Prefix        # 兜底:其他路径走前端
        backend:
          service:
            name: frontend-svc
            port:
              number: 80

spec:
  defaultBackend:               # 不匹配任何 host/path 时的兜底
    service:
      name: default-404-svc
      port:
        number: 80
  rules:
  - host: api.example.com
    ...

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: tls-ingress
spec:
  ingressClassName: nginx
  tls:                            # TLS 配置
  - hosts:
    - api.example.com             # 对哪些域名启用 HTTPS
    secretName: api-tls-secret    # 证书存在哪个 Secret 中
  rules:
  - host: api.example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: api-svc
            port:
              number: 80

# ClusterIssuer:全集群共用的证书签发器
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-prod
spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    email: admin@example.com
    privateKeySecretRef:
      name: letsencrypt-prod-key
    solvers:
    - http01:
        ingress:
          class: nginx

---
# Ingress 加一个 annotation 即可
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: auto-tls-ingress
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-prod   # ← 触发自动签发
spec:
  ingressClassName: nginx
  tls:
  - hosts:
    - api.example.com
    secretName: api-tls-auto      # cert-manager 会自动创建这个 Secret
  rules:
  - host: api.example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: api-svc
            port:
              number: 80

metadata:
  annotations:
    nginx.ingress.kubernetes.io/rewrite-target: /$2
spec:
  rules:
  - host: example.com
    http:
      paths:
      - path: /api(/|$)(.*)        # 正则捕获组
        pathType: ImplementationSpecific
        backend:
          service:
            name: api-svc
            port:
              number: 80

# 效果:
#   请求 /api/v1/users → 转发到 api-svc,路径变为 /v1/users
#   请求 /api/health   → 转发到 api-svc,路径变为 /health

# 1. GatewayClass - 集群管理员创建(通常由 Controller 安装时自动创建)
apiVersion: gateway.networking.k8s.io/v1
kind: GatewayClass
metadata:
  name: nginx                      # 起个名字
spec:
  controllerName: k8s.nginx.org/nginx-gateway-controller

---
# 2. Gateway - 平台团队创建
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: production-gateway
  namespace: infra                  # 可以放在独立的 namespace
spec:
  gatewayClassName: nginx           # 引用 GatewayClass
  listeners:
  - name: http
    port: 80
    protocol: HTTP
    allowedRoutes:
      namespaces:
        from: All                   # 允许所有 namespace 的 Route 绑定
  - name: https
    port: 443
    protocol: HTTPS
    tls:
      mode: Terminate
      certificateRefs:
      - name: wildcard-tls          # 通配符证书 Secret
    allowedRoutes:
      namespaces:
        from: Selector
        selector:
          matchLabels:
            gateway-access: "true"  # 只有带此标签的 ns 可绑定 HTTPS

---
# 3. HTTPRoute - 应用开发者创建(在自己的 namespace)
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: api-route
  namespace: app-team-a             # 应用团队自己的 namespace
spec:
  parentRefs:
  - name: production-gateway
    namespace: infra                # 绑定到哪个 Gateway
  hostnames:
  - api.example.com
  rules:
  - matches:
    - path:
        type: PathPrefix
        value: /v1
    backendRefs:
    - name: api-v1-svc
      port: 80
  - matches:
    - path:
        type: PathPrefix
        value: /v2
    backendRefs:
    - name: api-v2-svc
      port: 80

# 基于 Header 匹配
rules:
- matches:
  - headers:
    - name: x-canary
      value: "true"
  backendRefs:
  - name: api-canary-svc
    port: 80

---
# 权重分流(金丝雀发布)
rules:
- backendRefs:
  - name: api-v1-svc
    port: 80
    weight: 90              # 90% 流量走 v1
  - name: api-v2-svc
    port: 80
    weight: 10              # 10% 流量走 v2

---
# 请求重定向
rules:
- matches:
  - path:
      type: PathPrefix
      value: /old-api
  filters:
  - type: RequestRedirect
    requestRedirect:
      path:
        type: ReplaceFullPath
        replaceFullPath: /v2/api
      statusCode: 301

---
# 请求头修改
rules:
- filters:
  - type: RequestHeaderModifier
    requestHeaderModifier:
      add:
      - name: X-Forwarded-Proto
        value: https
      remove:
      - X-Internal-Only
  backendRefs:
  - name: api-svc
    port: 80