Some notes on creating website proxies in Nginx with only Kubernetes resources.

To use a recent example I worked on, say we've been using an Amazon S3 bucket with a custom domain name - This works nicely as you can CNAME your custom domain to the bucket's FQDN. However we need to migrate this to a different object-storage provider, and they pass the bucket name in the URL path. i.e.:

  • CNAME ->
  • New bucket URI on Oracle Cloud:

This poses a new problem - we need to rewrite URLs to be prefixed by the bucket path. This can all be achived with a minimal Nginx reverse proxy:

server {
  rewrite ^/?(.*) /n/example/b/$1 break;
  proxy_redirect off;

That works, but it would be nice to add this into our cluster ingress controller. After some experimentation, I found that Ingress-Nginx can only proxy to internal services. I also found that you can declare a service of type ExternalName, that is effectively a DNS CNAME. This allows Ingresses to route externally out of the cluster.

apiVersion: v1
kind: Service
  name: objectstore
  type: ExternalName
    - name: https
      port: 443
      targetPort: 443
      protocol: TCP

Then, we can add an ingress to expose this service:

apiVersion: extensions/v1beta1
kind: Ingress
  name: files-example-com
  annotations: "nginx"

    # URL rewriting - see paths for $1 "true" "/n/example/b/$1"
    - host: ""
          - path: "/(.*)"
              serviceName: objectstore
              servicePort: 443

SSL termination and other Nginx configurations can be applied in the usual way. Oracle's object store has a couple of undocumented quirks - it only operates on HTTPS and requires a Host header. We'd also like to have an alias directory to redirect requests to an older resource:

apiVersion: extensions/v1beta1
kind: Ingress

    # Use https for upstream proxy_pass "HTTPS"

    # Send a Host header to the upstream ""

    # Redirect certain paths with a temporary redirect (302) |
     rewrite ^/myapp/(.*) /apps/myapp/1.0.0/$1 redirect;