How to implement Nginx reverse proxy using Nginx Fabric HttpRoute

[Reyadeyat]

I've problem defining correct HttpRoute I want a simple flag for service by path, if path prefix is /reyadeyat/v1 the make it /, the problem is with GET parameters in URL
when I call "/reyadeyat/v1" i get "Running Service version 0.0.0", correct,
while calling "/reyadeyat/v1/qrcode?qrcode=123456" is rewritten along its parameters as a singl fixed path "/qrcode%3Fqrcode=123456" ang get this error:
{"timestamp":"2024-12-03T17:36:14.873+00:00","status":404,"error":"Not Found","path":"/qrcode%3Fqrcode=123456"}
to be sure service is work right this call returns exception from the backend
curl -L -H "Host: reyadeyat.net" -H "Origin: http://reyadeyat.net" http://$NGINX_FABRIC_SERVICE_IP:$NGINX_FABRIC_SERVICE_PORT/reyadeyat/v1/qrcode
{"timestamp":"2024-12-03T17:41:48.509+00:00","status":500,"error":"Internal Server Error","path":"/qrcode"}


How to implement a rewrite while passing GET parameters to service correctly.
below Nginx Fabric yaml and $cat /opt/k8s/nginx-fabric/conf.d/http.conf using $kubectl cp nginx-gateway/ngf-nginx-gateway-fabric-867995b6b5-l2kts:/etc/nginx/ /home/admin/nginx-fabric/ -c nginx)
and system info.

Nginx Fabric yaml:
------------------


apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: reyadeyat-spring-gateway
  namespace: reyadeyat-spring
spec:
  gatewayClassName: nginx
  listeners:
  - name: reyadeyat-spring-gateway-http
    port: 80
    protocol: HTTP
    hostname: "reyadeyat.net"
    allowedRoutes:
      namespaces:
        from: Same
---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: net-reyadeyat-api-gateway-route
  namespace: reyadeyat-spring
spec:
  parentRefs:
  - name: reyadeyat-spring-gateway
    namespace: reyadeyat-spring
    sectionName: reyadeyat-spring-gateway-http
  hostnames:
  - "reyadeyat.net"
  rules:
  - matches:
    - path:
        type: PathPrefix
        value: /reyadeyat/v1
      method: GET
    filters:
      - type: URLRewrite
        urlRewrite:
          hostname: "reyadeyat.net"
          path:
            type: ReplacePrefixMatch
            replacePrefixMatch: /
    backendRefs:
    - kind: Service
      name: net-reyadeyat-api-service
      namespace: reyadeyat-spring
      port: 80
---
apiVersion: gateway.networking.k8s.io/v1beta1
kind: ReferenceGrant
metadata:
  name: net-reyadeyat-api-httproute-referencegrant
  namespace: reyadeyat-spring
spec:
  from:
  - group: gateway.networking.k8s.io
    kind: HTTPRoute
    namespace: reyadeyat-spring
  to:
  - group: ""
    kind: Service


------------------------------------------------------
$cat /opt/k8s/nginx-fabric/conf.d/http.conf
------------------------------------------------------
http2 on;

# Set $gw_api_compliant_host variable to the value of $http_host unless $http_host is empty, then set it to the value
# of $host. We prefer $http_host because it contains the original value of the host header, which is required by the
# Gateway API. However, in an HTTP/1.0 request, it's possible that $http_host can be empty. In this case, we will use
# the value of $host. See http://nginx.org/en/docs/http/ngx_http_core_module.html#var_host.
map $http_host $gw_api_compliant_host {
    '' $host;
    default $http_host;
}

# Set $connection_header variable to upgrade when the $http_upgrade header is set, otherwise, set it to close. This
# allows support for websocket connections. See https://nginx.org/en/docs/http/websocket.html.
map $http_upgrade $connection_upgrade {
    default upgrade;
    '' close;
}

## Returns just the path from the original request URI.
map $request_uri $request_uri_path {
  "~^(?P<path>[^?]*)(\?.*)?$"  $path;
}


js_preload_object matches from /etc/nginx/conf.d/matches.json;
server {
    listen 80 default_server;
    listen [::]:80 default_server;
    default_type text/html;
    return 404;
}

server {
    listen 80;
    listen [::]:80;

    server_name reyadeyat.net;

        
    location /reyadeyat/v1/ {
        
        set $match_key 1_0;
        js_content httpmatches.redirect;

        

        proxy_http_version 1.1;
    }
    location = /reyadeyat/v1 {
        
        set $match_key 1_0;
        js_content httpmatches.redirect;

        

        proxy_http_version 1.1;
    }
    location /_ngf-internal-rule0-route0 {
        internal;
        
        rewrite ^ $request_uri;
        rewrite ^/reyadeyat/v1(?:/(.*))?$ /$1 break;

        

        proxy_http_version 1.1;
        proxy_set_header Host "reyadeyat.net";
        proxy_set_header X-Forwarded-For "$proxy_add_x_forwarded_for";
        proxy_set_header Upgrade "$http_upgrade";
        proxy_set_header Connection "$connection_upgrade";
        proxy_set_header X-Real-IP "$remote_addr";
        proxy_set_header X-Forwarded-Proto "$scheme";
        proxy_set_header X-Forwarded-Host "$host";
        proxy_set_header X-Forwarded-Port "$server_port";
        proxy_pass http://reyadeyat-spring_net-reyadeyat-api-service_80;
            
            
            
    }
    location / {
        
        return 404 "";

        

        proxy_http_version 1.1;
    }
}

server {
    listen unix:/var/run/nginx/nginx-503-server.sock;
    access_log off;

    return 503;
}

server {
    listen unix:/var/run/nginx/nginx-500-server.sock;
    access_log off;

    return 500;
}


upstream reyadeyat-spring_net-reyadeyat-api-service_80 {
    random two least_conn;
    zone reyadeyat-spring_net-reyadeyat-api-service_80 512k;
    
    server 10.128.120.205:19000;
}

upstream invalid-backend-ref {
    random two least_conn;
    
    server unix:/var/run/nginx/nginx-500-server.sock;
}





----------------
System Info
----------------

if that would be any help i use these versions of software
$cat /etc/os-release
PRETTY_NAME="Debian GNU/Linux trixie/sid"
NAME="Debian GNU/Linux"
VERSION_CODENAME=trixie
ID=debian$ uname -a
Linux server1.domain.org 6.11.7-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.11.7-1 (2024-11-09) x86_64 GNU/Linux$kubeadm version
kubeadm version: &version.Info{Major:"1", Minor:"31", GitVersion:"v1.31.2", GitCommit:"5864a4677267e6adeae276ad85882a8714d69d9d", GitTreeState:"clean", BuildDate:"2024-10-22T20:33:59Z", GoVersion:"go1.22.8", Compiler:"gc", Platform:"linux/amd64"}$ kubelet --version
Kubernetes v1.31.2$ kubectl version --client
Client Version: v1.31.2
Kustomize Version: v5.4.2$ podman --version
podman version 5.2.5$ helm list --all-namespaces
NAME                	NAMESPACE           	REVISION	UPDATED                                	STATUS  	CHART                      	APP VERSION
calico              	tigera-operator     	1       	2024-11-04 07:06:26.760149985 +0000 UTC	deployed	tigera-operator-v3.29.0    	v3.29.0
kubernetes-dashboard	kubernetes-dashboard	1       	2024-11-04 07:20:27.74932002 +0000 UTC 	deployed	kubernetes-dashboard-7.10.0	          
ngf                 	nginx-gateway       	1       	2024-11-27 17:38:36.621764497 +0000 UTC	deployed	nginx-gateway-fabric-1.5.0 	1.5.0

[kate-osborn]

@Reyadeyat thanks for your interest in NGINX Gateway Fabric!

Just to make sure I understand the question:

You want NGINX Gateway Fabric to rewrite the URL of the following request
curl -L -H "Host: reyadeyat.net" -H "Origin: http://reyadeyat.net" http://$NGINX_FABRIC_SERVICE_IP:$NGINX_FABRIC_SERVICE_PORT/reyadeyat/v1/qrcode?qrcode=123456

to /qrcode?qrcode=123456?

[Reyadeyat]

yes I want to get /qrcode?qrcode=123456
but /qrcode and parameters, what I get is a fixed path /qrcode%3Fqrcode=123456 which is 404 as if there is an endpoint called /qrcode%3Fqrcode=123456 not just /qrcode, thank you

[kate-osborn]

@Reyadeyat I was able to reproduce your issue and filed #2862 to track it. We will take a closer look when we get a chance.

[Reyadeyat]

@kate-osborn have you checked method POST too, curl -X POST -d "param=value", I think but not sure it may has some issue too!

rules:

• matches:
  • path:
    type: PathPrefix
    value: /coffee/v1
    ---> method: POST

curl -L -X POST -d "qrcode=123456" -H "Host: reyadeyat.net" -H "Origin: http://reyadeyat.net" http://$NGINX_FABRIC_SERVICE_IP:$NGINX_FABRIC_SERVICE_PORT/reyadeyat/v1/qrcode
{"timestamp":"2024-12-07T21:05:38.332+00:00","status":405,"error":"Method Not Allowed","path":"/"}

[salonichf5]

@Reyadeyat just wanted to clarify where the error message Method not Allowed is coming from?

The above issue could also be happening due to the rewrite issue. We are currently looking into it.

[Reyadeyat]

@salonichf5 from the root path that doesn't have POST while /qrcode has which mean that the NGF API yaml forwards to / instead of to /qrcode

#my service root
$ curl -L -X POST -d "qrcode=123456" http://10.111.243.146:80
{"timestamp":"2024-12-10T05:58:58.722+00:00","status":405,"error":"Method Not Allowed","path":"/"}

#my service /qrcode
$ curl -L -X POST -d "qrcode=123456" http://10.111.243.146:80/qrcode
{"status":"success","http_response_code":200,"service_response_code":200,"message":"sucess","INFO":"Exceution time","resultset":["data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAMgAAADIAQAAAACFI5MzAAAA5UlEQVR4Xu2WsQ7DIAxEzeTP4E8J/CmfkQnXZ6cd0nbODZwiBH4ZTlhnIfZPci98tMkm0CY05BRXsdmkdmwrE8F2nNLUxvvIQ7pUJ8eJtRASv1GFd0bihT+unyWGbtcF79eRhkRKYLneU/I4SYFHLUVCIrtdZzHztnelItlkOex7ujxNbJYISkDkmIo0qUunZC1FQsKyT74jgrLcPg9JeU1tCXpORK7pEg8BReeZCLYD8ZV2c01AotvmN9rxgMKPXCS67YkRQhIzxvJjIr4MrIAd3nnIlZLmd4msMJGf2mQTaBNu8gKSY5BSn1oq8AAAAABJRU5ErkJggg=="]}

#not work
$ curl -L -X POST -d "qrcode=123456" --resolve reyadeyat.net:$NGINX_FABRIC_SERVICE_PORT:$NGINX_FABRIC_SERVICE_IP http://reyadeyat.net:$NGINX_FABRIC_SERVICE_PORT/reyadeyat/v1/qrcode
{"timestamp":"2024-12-10T06:04:42.523+00:00","status":405,"error":"Method Not Allowed","path":"/"}

#for same setup but POST instead of GET
rules:

• matches:
  • path:
    type: PathPrefix
    value: /reyadeyat/v1
    method: POST
    backendRefs:
  • kind: Service
    name: reyadeyat-api-service
    namespace: reyadeyat-spring
    port: 80
    filters:
  • type: URLRewrite
    urlRewrite:
    path:
    type: ReplaceFullPath
    replaceFullPath: "/"

i get this
$ kubectl cp nginx-gateway/$NGINX_FABRIC_POD_NAME:/etc/nginx/ /home/admin/nginx-fabric/ -c nginx
$ nano /home/admin/nginx-fabric/conf.d/http.conf

location /_ngf-internal-rule0-route0 {
internal;

    rewrite ^ $request_uri;
    rewrite ^ / break;



    proxy_http_version 1.1;
    proxy_set_header Host "$gw_api_compliant_host";
    proxy_set_header X-Forwarded-For "$proxy_add_x_forwarded_for";
    proxy_set_header Upgrade "$http_upgrade";
    proxy_set_header Connection "$connection_upgrade";
    proxy_set_header X-Real-IP "$remote_addr";
    proxy_set_header X-Forwarded-Proto "$scheme";
    proxy_set_header X-Forwarded-Host "$host";
    proxy_set_header X-Forwarded-Port "$server_port";
    proxy_pass http://reyadeyat-spring_net-reyadeyat-api-service_80;
}

[Reyadeyat]

@salonichf5 I've discovered I made a mistake and POST is working fine with the parameters, I'm sorry for wasting your time, please accept my apology for this.

it was my wrong mix between matche ReplacePrefixMatch and filter ReplaceFullPath, so since corrected to ReplacePrefixMatch and replacePrefixMatch it works as expected

rules:

• matches:
  • path:
    type: PathPrefix
    value: /reyadeyat-authentication/v1
    method: POST
    backendRefs:
  • kind: Service
    name: $RELEASE_ARTIFACTID_NAME-service
    namespace: reyadeyat-spring
    port: $SERVICE_PORT
    filters:
  • type: URLRewrite
    urlRewrite:
    path:
    type: ReplaceFullPath
    replaceFullPath: "/"

Now filters are:
rules:

• matches:
  • path:
    type: PathPrefix
    value: /reyadeyat-authentication/v1
    method: POST
    backendRefs:
  • kind: Service
    name: $RELEASE_ARTIFACTID_NAME-service
    namespace: reyadeyat-spring
    port: $SERVICE_PORT
    filters:
  • type: URLRewrite
    urlRewrite:
    path:
    type: ReplacePrefixMatch
    replacePrefixMatch: "/"

[salonichf5]

No worries @Reyadeyat, thank you for letting us know. It helps us narrow down the problem as well.