Ingress regex path priority

Questions
1

Hi, I have an ingress with a single rule containing several paths using regex matching:

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: my-ingress
  annotations:
    kubernetes.io/ingress.class: "kong"
    [...]
    konghq.com/strip-path: "true"
spec:
  [...]
  rules:
    - http:
        paths:
        [...]
        - path: /api/restrictions/(.*)
          backend:
            serviceName: restriction-api
            servicePort: 80
        [...]
        - path: /api/(.*)
          backend:
            serviceName: api
            servicePort: 80

What I want to achieve is that /api/whatever goes to a service and /api/restriction/whatever goes to another service. The example is simplified and may not make much sense. We can de-simplify it if any questions why I am attempting this.

The problem I have is that the last regex is evaluated first and shadows the one about “restrictions”. This is in a cluster running k8s 1.18. In another cluster running k8s 1.17 the order of the paths determines the evaluation order (restrictions getting higher priority if they are defined above in the yaml).

I couldn’t find in the documentation how this works. I’ve found the following:

  • Some doc writen in a Kong Nation entry:
    A few words on regex URIs usage and common pitfalls. It mentions “URI regexes are evaluated in the order that they are defined too”. Would that ordering be the one of the Ingress paths? In that case this behavior would be a bug (and I would report it).

  • It seems that we can use a regex-priority annotation at the Ingress level. If this is the only solution I’d need to split the Ingress in two, in order to set different regex-priority, is that right?

Any help is appreciated.

2

It mentions “URI regexes are evaluated in the order that they are defined too”. Would that ordering be the one of the Ingress paths? In that case this behavior would be a bug (and I would report it).

The “order of definition” is about the created_at field that records when the path was created by the API. If you’re using declarative configuration, it’s all created on the same operation, so I suspect both paths have the same created_at value. Or, if there’s any difference, it’s not guaranteed to be in lexical order, since the configuration is parsed as a whole before being applied.

Note that the explanation you link to is a little old. In the current documentation you can see there’s a regex_priority field in the path object. That way you can set the /api/restrictions/(.*) path higher than the /api/(.*) one.

3

Hi Javier, many thanks for your help.

Indeed that (setting the regex priority) is my second point. I tried to keep only one ingress for all my services but it
seems that is just not possible if you want different configurations for the different endpoints. Even overriding the Ingress
with a KongIngress will not help, as it would affect all the resources in the overridden Ingress.

Creating a couple of ingresses and setting the konghq.com/regex-priority works well.