Kubernetes nginx 入口 0.22 不尊重 cookie 亲和注释？

Question

我们最近升级到 nginx-ingress 0.22。在此次升级之前，我的服务使用的是旧命名空间 ingress.kubernetes.io/affinity: cookie，并且一切都按我预期的那样工作。但是，在升级到 0.22 后，affinity 停止应用于我的服务（我在 nginx.conf 中的任何地方都看不到 sticky）。

我查看了文档并将命名空间更改为 nginx.ingress.kubernetes.io，如 in this example 所示，但没有帮助。

是否有一些调试日志可以显示配置 parsing/building 进程？我的猜测是一些其他设置阻止了它的工作（我无法想象 k8s 团队发布了一个完全破坏此功能的版本），但我不确定那可能是什么。

k8s 仪表板显示的我的入口配置如下：

  "kind": "Ingress",
  "apiVersion": "extensions/v1beta1",
  "metadata": {
    "name": "example-ingress",
    "namespace": "master",
    "selfLink": "/apis/extensions/v1beta1/namespaces/master/ingresses/example-ingress",
    "uid": "01e81627-3b90-11e9-bb5a-f6bc944a4132",
    "resourceVersion": "23345275",
    "generation": 1,
    "creationTimestamp": "2019-02-28T19:35:30Z",
    "labels": {
    },
    "annotations": {
      "ingress.kubernetes.io/backend-protocol": "HTTPS",
      "ingress.kubernetes.io/limit-rps": "100",
      "ingress.kubernetes.io/proxy-body-size": "100m",
      "ingress.kubernetes.io/proxy-read-timeout": "60",
      "ingress.kubernetes.io/proxy-send-timeout": "60",
      "ingress.kubernetes.io/secure-backends": "true",
      "ingress.kubernetes.io/secure-verify-ca-secret": "example-ingress-ssl",
      "kubernetes.io/ingress.class": "nginx",
      "nginx.ingress.kubernetes.io/affinity": "cookie",
      "nginx.ingress.kubernetes.io/backend-protocol": "HTTPS",
      "nginx.ingress.kubernetes.io/limit-rps": "100",
      "nginx.ingress.kubernetes.io/proxy-body-size": "100m",
      "nginx.ingress.kubernetes.io/proxy-buffer-size": "8k",
      "nginx.ingress.kubernetes.io/proxy-read-timeout": "60",
      "nginx.ingress.kubernetes.io/proxy-send-timeout": "60",
      "nginx.ingress.kubernetes.io/secure-verify-ca-secret": "example-ingress-ssl",
      "nginx.ingress.kubernetes.io/session-cookie-expires": "172800",
      "nginx.ingress.kubernetes.io/session-cookie-max-age": "172800",
      "nginx.ingress.kubernetes.io/session-cookie-name": "route",
      "nginx.org/websocket-services": "example"
    }
  },
  "spec": {
    "tls": [
      {
        "hosts": [
          "*.example.net"
        ],
        "secretName": "example-ingress-ssl"
      }
    ],
    "rules": [
      {
        "host": "*.example.net",
        "http": {
          "paths": [
            {
              "path": "/",
              "backend": {
                "serviceName": "example",
                "servicePort": 443
              }
            }
          ]
        }
      }
    ]
  },
  "status": {
    "loadBalancer": {
      "ingress": [
        {}
      ]
    }
  }
}

Answer 1

当我用 Nginx Ingress 版本 0.22 测试 Sticky session affinity 时，我可以保证它工作得很好。然后，当我在寻找您的配置时，我将通配符主机 host: "*.example.net" 替换为 host: "stickyingress.example.net" 只是为了忽略通配符，它再次正常工作。所以经过一番搜索，我发现 issue

Wildcard hostnames are not supported by the Ingress spec (only SSL wildcard certificates are)

甚至这个问题是为 NGINX Ingress 控制器版本打开的： 0.21.0

Kubernetes nginx 入口 0.22 不尊重 cookie 亲和注释？

Kubernetes nginx ingress 0.22 not respecting cookie affinity annotation?

kubernetes

kubernetes-ingress

nginx-ingress