Ingress NGINX - Support Redirect

pkg/i2gw/providers/ingressnginx/annotations.go

@@ -25,6 +25,15 @@ const (
 	// Rewrite annotations
 	RewriteTargetAnnotation = "nginx.ingress.kubernetes.io/rewrite-target"
 
+	// Redirect annotations
+	PermanentRedirectAnnotation     = "nginx.ingress.kubernetes.io/permanent-redirect"
+	PermanentRedirectCodeAnnotation = "nginx.ingress.kubernetes.io/permanent-redirect-code"
+	TemporalRedirectAnnotation      = "nginx.ingress.kubernetes.io/temporal-redirect"
+	TemporalRedirectCodeAnnotation  = "nginx.ingress.kubernetes.io/temporal-redirect-code"
+	FromToWWWRedirectAnnotation     = "nginx.ingress.kubernetes.io/from-to-www-redirect"
+	ProxyRedirectFromAnnotation     = "nginx.ingress.kubernetes.io/proxy-redirect-from"
+	ProxyRedirectToAnnotation       = "nginx.ingress.kubernetes.io/proxy-redirect-to"
+
 	// Header annotations
 	XForwardedPrefixAnnotation      = "nginx.ingress.kubernetes.io/x-forwarded-prefix"
 	UpstreamVhostAnnotation         = "nginx.ingress.kubernetes.io/upstream-vhost"

pkg/i2gw/providers/ingressnginx/converter.go

@@ -34,6 +34,7 @@ func newResourcesToIRConverter() *resourcesToIRConverter {
 	return &resourcesToIRConverter{
 		featureParsers: []i2gw.FeatureParser{
 			canaryFeature,
+			redirectFeature,
 			headerModifierFeature,
 			regexFeature,
 		},

pkg/i2gw/providers/ingressnginx/redirect.go

@@ -18,10 +18,14 @@ package ingressnginx
 
 import (
 	"fmt"
+	"net/url"
 	"strconv"
 
 	emitterir "github.com/kubernetes-sigs/ingress2gateway/pkg/i2gw/emitter_intermediate"
+	"github.com/kubernetes-sigs/ingress2gateway/pkg/i2gw/notifications"
 	providerir "github.com/kubernetes-sigs/ingress2gateway/pkg/i2gw/provider_intermediate"
+	"github.com/kubernetes-sigs/ingress2gateway/pkg/i2gw/providers/common"
+	networkingv1 "k8s.io/api/networking/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/types"
 	"k8s.io/apimachinery/pkg/util/validation/field"
@@ -30,6 +34,170 @@ import (
 	gatewayv1 "sigs.k8s.io/gateway-api/apis/v1"
 )
 
+// redirectFeature converts permanent and temporal redirect annotations to Gateway API RequestRedirect filters.
+// - permanent-redirect uses a 301 status code
+// - temporal-redirect uses a 302 status code
+func redirectFeature(ingresses []networkingv1.Ingress, _ map[types.NamespacedName]map[string]int32, ir *providerir.ProviderIR) field.ErrorList {
+	var errs field.ErrorList
+
+	ruleGroups := common.GetRuleGroups(ingresses)
+	for _, rg := range ruleGroups {
+		for _, rule := range rg.Rules {
+
+			// Warn about unsupported proxy-redirect annotations
+			if rule.Ingress.Annotations[ProxyRedirectFromAnnotation] != "" {
+				notify(notifications.WarningNotification, fmt.Sprintf("ingress %s/%s uses unsupported annotation %s",
+					rule.Ingress.Namespace, rule.Ingress.Name, ProxyRedirectFromAnnotation), &rule.Ingress)
+			}
+			if rule.Ingress.Annotations[ProxyRedirectToAnnotation] != "" {
+				notify(notifications.WarningNotification, fmt.Sprintf("ingress %s/%s uses unsupported annotation %s",
+					rule.Ingress.Namespace, rule.Ingress.Name, ProxyRedirectToAnnotation), &rule.Ingress)
+			}
+
+			permanentRedirectURL, hasPermanent := rule.Ingress.Annotations[PermanentRedirectAnnotation]
+			temporalRedirectURL, hasTemporal := rule.Ingress.Annotations[TemporalRedirectAnnotation]
+
+			// Skip if neither annotation is present
+			if !hasPermanent && !hasTemporal {
+				continue
+			}
+
+			// Determine redirect URL and status code
+			// If both are present, temporal takes priority
+			var redirectURL string
+			var statusCode int
+			var annotationUsed string
+
+			if hasTemporal {
+				redirectURL = temporalRedirectURL
+				statusCode = 302
+				annotationUsed = TemporalRedirectAnnotation
+
+				// Warn if both annotations are present
+				if hasPermanent {
+					notify(notifications.WarningNotification, fmt.Sprintf("ingress %s/%s has both %s and %s annotations, using %s",
+						rule.Ingress.Namespace, rule.Ingress.Name, PermanentRedirectAnnotation, TemporalRedirectAnnotation, TemporalRedirectAnnotation), &rule.Ingress)
+				}
+
+				// Warn about unsupported custom status code annotation
+				if rule.Ingress.Annotations[TemporalRedirectCodeAnnotation] != "" {
+					notify(notifications.WarningNotification, fmt.Sprintf("ingress %s/%s uses unsupported annotation %s",
+						rule.Ingress.Namespace, rule.Ingress.Name, TemporalRedirectCodeAnnotation), &rule.Ingress)
+				}
+			} else {
+				redirectURL = permanentRedirectURL
+				statusCode = 301
+				annotationUsed = PermanentRedirectAnnotation
+
+				// Warn about unsupported custom status code annotation
+				if rule.Ingress.Annotations[PermanentRedirectCodeAnnotation] != "" {
+					notify(notifications.WarningNotification, fmt.Sprintf("ingress %s/%s uses unsupported annotation %s",
+						rule.Ingress.Namespace, rule.Ingress.Name, PermanentRedirectCodeAnnotation), &rule.Ingress)
+				}
+			}
+
+			// Validate redirect URL is not empty
+			if redirectURL == "" {
+				errs = append(errs, field.Invalid(
+					field.NewPath("ingress", rule.Ingress.Namespace, rule.Ingress.Name, "metadata", "annotations", annotationUsed),
+					redirectURL,
+					"redirect URL cannot be empty",
+				))
+				continue
+			}
+
+			// Parse the redirect URL
+			parsedURL, err := url.Parse(redirectURL)
+			if err != nil {
+				errs = append(errs, field.Invalid(
+					field.NewPath("ingress", rule.Ingress.Namespace, rule.Ingress.Name, "metadata", "annotations", annotationUsed),
+					redirectURL,
+					fmt.Sprintf("invalid redirect URL: %v", err),
+				))
+				continue
+			}
+
+			// Apply redirect to all rules in the ingress
+			for _, ingressRule := range rule.Ingress.Spec.Rules {
+				routeName := common.RouteName(rule.Ingress.Name, ingressRule.Host)
+				routeKey := types.NamespacedName{Namespace: rule.Ingress.Namespace, Name: routeName}
+				httpRouteContext, routeExists := ir.HTTPRoutes[routeKey]
+				if !routeExists {
+					continue
+				}
+
+				// Create the redirect filter
+				redirectFilterConfig := &gatewayv1.HTTPRequestRedirectFilter{
+					StatusCode: ptr.To(statusCode),
+				}
+
+				// Set scheme if present
+				if parsedURL.Scheme != "" {
+					redirectFilterConfig.Scheme = ptr.To(parsedURL.Scheme)
+				}
+
+				// Set hostname if present
+				if parsedURL.Hostname() != "" {
+					hostname := gatewayv1.PreciseHostname(parsedURL.Hostname())
+					redirectFilterConfig.Hostname = &hostname
+				}
+
+				// Set port if present
+				if parsedURL.Port() != "" {
+					port, err := strconv.Atoi(parsedURL.Port())
+					if err == nil {
+						portNumber := gatewayv1.PortNumber(port)
+						redirectFilterConfig.Port = &portNumber
+					} else {
+						errs = append(errs, field.Invalid(
+							field.NewPath("ingress", rule.Ingress.Namespace, rule.Ingress.Name, "metadata", "annotations", annotationUsed),
+							redirectURL,
+							fmt.Sprintf("invalid port in redirect URL: %v", err),
+						))
+						continue
+					}
+				}
+
+				// Set path if present
+				if parsedURL.Path != "" {
+					pathType := gatewayv1.FullPathHTTPPathModifier
+					redirectFilterConfig.Path = &gatewayv1.HTTPPathModifier{
+						Type:            pathType,
+						ReplaceFullPath: ptr.To(parsedURL.Path),
+					}
+				}
+
+				redirectFilter := gatewayv1.HTTPRouteFilter{
+					Type:            gatewayv1.HTTPRouteFilterRequestRedirect,
+					RequestRedirect: redirectFilterConfig,
+				}
+
+				// Add redirect rule at the beginning of all rules
+				redirectRule := gatewayv1.HTTPRouteRule{
+					Filters: []gatewayv1.HTTPRouteFilter{redirectFilter},
+					// Clear backend refs as redirects don't route to backends
+					BackendRefs: nil,
+				}
+
+				// Prepend the redirect rule to existing rules
+				httpRouteContext.HTTPRoute.Spec.Rules = append(
+					[]gatewayv1.HTTPRouteRule{redirectRule},
+					httpRouteContext.HTTPRoute.Spec.Rules...,
+				)
+
+				ir.HTTPRoutes[routeKey] = httpRouteContext
+
+				notify(notifications.InfoNotification,
+					fmt.Sprintf("parsed %q annotation of ingress %s/%s with redirect to %q (status code: %d). ",
+						annotationUsed, rule.Ingress.Namespace, rule.Ingress.Name, redirectURL, statusCode),
+					&httpRouteContext.HTTPRoute)
+			}
+		}
+	}
+
+	return errs
+}
+
 // Ingress NGINX has some quirky behaviors around SSL redirect.
 // The formula we follow is that if an ingress has certs configured, and it does not have the
 // "nginx.ingress.kubernetes.io/ssl-redirect" annotation set to "false" (or "0", etc), then we