How to utilize header based routing approach in latest kubernetes and community nginx version i.e. k8s = 1.32.3 ngnix =1.12.4

Question

I am trying to convert some logic written in kubernetes ingress configuration yaml files.

In latest versions of k8s, keywords that are with "-snippets" values are identified as risky one (e.g. configuration-snippet, auth-snippet, etc).

I have one use case, where am using header based approach to navigate to service, only if specific header is present in the request (this was earlier written using ingress object).

I tried out approach using Gateway API and HTTPRoute objects which supports header based routing, but for that i had to add explicit CRT's via helm and those doesn't come directly with k8s.

I don't want to go with this approach though, and also paths are not supposed to be changed.

How to fix this using classic ingress approach such that no any path changes will be needed.

Please find the configuration I was trying out

apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: i-nginx-gateway
  namespace: my-namespace
spec:
  gatewayClassName: nginx
  listeners:
    - name: http
      protocol: HTTP
      port: 80
      allowedRoutes:
        namespaces:
          from: All

apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: i-app-route
  namespace: my-namespace
spec:
  parentRefs:
    - name: i-nginx-gateway
      namespace: my-namespace
  hostnames:
    - something.com
  rules:
    # Rule 1: Authorization header present → go through asvc
    - matches:
        - path:
            type: PathPrefix
            value: /i/(.*)
          headers:
            - name: authtype
              type: Exact
              value: my-jwt
      backendRefs:
        - name: asvc
          port: 8000

    # Rule 2: No Authorization header → go directly to i
    - matches:
        - path:
            type: PathPrefix
            value: /i/(.*)
      backendRefs:
        - name: i
          port: 8000

Tried to use canary ingress approach, but somehow request are hitting primary ing only and not canary one. Added config that i am trying out.

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: i-direct-ingress
  namespace: mynamespace
spec:
  ingressClassName: nginx
  rules:
  - host: something.com
    http:
      paths:
      - path: /i
        pathType: Prefix
        backend:
          service:
            name: i
            port:
              number: 8000
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: i-canary-ingress
  namespace: mynamespace
  annotations:
    nginx.ingress.kubernetes.io/canary: "true"
    nginx.ingress.kubernetes.io/canary-by-header: "authtype"
    nginx.ingress.kubernetes.io/canary-by-header-value: "myjwt"
spec:
  ingressClassName: nginx
  rules:
  - host: something.com
    http:
      paths:
      - pathType: Prefix
        path: /i
        backend:
          service:
            name: asvc
            port:
              number: 8000

トトロ · Accepted Answer · 2025-08-29 14:17:11Z

1

To utilize header-based routing in your Kubernetes setup using NGINX Ingress Controller, you can use the built-in canary deployment feature via annotations. This works by allowing routing to a secondary (canary) backend based on HTTP headers. When the specified header matches exactly your defined value, all matching traffic routes to the canary backend. While the traffic that doesn't match (either with a missing header or having a different value) is sent to the primary backend.

You'll create two Ingress objects for the same host and path prefix ( /i ). One is the primary Ingress (routing to service i), and the other is the canary ingress (routing to service asvc when the header matches).
Use nginx.ingress.kubernetes.io/canary-by-header for your header name (authtype) and nginx.ingress.kubernetes.io/canary-by-header-value for the exact value (my-jwt).
To preserve your original path matching, set nginx.ingress.kubernetes.io/rewrite-target annotation on both your ingresses.

answered Aug 29 at 14:17

トトロ

4411 silver badge7 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Durgesh Sep 1 at 8:05

Thank you for your response. I tried out canary approach, for some reason all my request are going to primary ing only(stable one) and not canary although i added all headers required. I have added config snippet, can you tell me what could go wrong here

トトロ Sep 1 at 12:16

NGINX Ingress Controller header values are case-sensitive and require an exact match. You're testing with authtype: "my-jwt" (with a dash), that doesn't match with your original HTTP route config "myjwt". Try updating your canary Ingress with the annotation set with the correct value (with a dash): nginx.ingress.kubernetes.io/canary-by-header-value: "my-jwt".

Collectives™ on Stack Overflow

How to utilize header based routing approach in latest kubernetes and community nginx version i.e. k8s = 1.32.3 ngnix =1.12.4

1 Answer 1

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related