k8s ingress 转发会把 encode 后的 uri 还原成转义前的字符串

[dhq]

我有一个 ingress 转发的配置，就是把匹配/dhq 前缀的请求，转发到后端服务， 访问 /dhq/api/v1/%40aa

ingress 转发时会直接 把它还原成 /api/v1/@aa

但我就是不想给他还原，大佬们，有啥经验建议么，目前试了几个 ai 给的答案都不奏效

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    nginx.ingress.kubernetes.io/proxy-body-size: 200m
    nginx.ingress.kubernetes.io/proxy-next-upstream-timeout: "60"
    nginx.ingress.kubernetes.io/proxy-read-timeout: "360"
    nginx.ingress.kubernetes.io/rewrite-target: /$2
    nginx.ingress.kubernetes.io/configuration-snippet: |
      proxy_set_header Accept-Encoding "";
      proxy_set_header X-Real-IP $remote_addr;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header X-Forwarded-Proto $scheme;
    nginx.ingress.kubernetes.io/use-regex: "true"
    nginx.ingress.kubernetes.io/ssl-redirect: "false"
    nginx.ingress.kubernetes.io/enable-rewrite-log: "true"
  name: dhq-ingress
  namespace: monitor
spec:
  ingressClassName: idataexplorer
  rules:
  - http:
      paths:
      - backend:
          service:
            name: dhq-service
            port:
              number: 80
        path: /dhq(/|$)(.*)
        pathType: ImplementationSpecific

这个是 ingress 把 uri 还原的具体日志
原始 uri 是 /dhq/mos/aa%40aa.sh?tagging

```
2025/09/19 07:00:15 [notice] 18054#18054: *46865544 "(?i)/dhq(/|$)(.*)" matches "/dhq/mos/[email protected]", client: 10.10.241.64, server: _, request: "GET /dhq/mos/aa%40aa.sh?tagging HTTP/1.1", host: "20.20.45.26", referrer: "http://20.20.45.26:6690/"
2025/09/19 07:00:15 [notice] 18054#18054: *46865544 rewritten data: "/mos/[email protected]", args: "tagging", client: 10.10.241.64, server: _, request: "GET /dhq/mos/aa%40aa.sh?tagging HTTP/1.1", host: "20.20.45.26", referrer: "http://20.20.45.26:6690/"
10.10.241.64 - - [19/Sep/2025:07:00:15 +0000] "GET /dhq/mos/aa%40aa.sh?tagging HTTP/1.1" 403 239 "http://20.20.45.26:6690/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36" 497 0.002 [monitor-dhq-service-80] [] 20.20.45.27:8002 239 0.002 403 9e7d3ad78c5b90d6473b14d1ae75423b
```

[illl]

请求时双重编码？

[xwjlucky]

mark 一下 感觉这种双重编码解码是个很头疼的问题

[dhq]

@illl 客户端请求的时候会执行一个 urlencode ，像 js 本身有这样的函数，但是 ingress 在拿到编码后的 uri 的时候，会自动给你把 encode 过的字符串给你 decode 还原回去，但我不期望它帮我做这个事情，

[feedcode]

这个不是 ingress 的问题！
你只是恰巧用了 nginx ，解决方法
https://my.f5.com/manage/s/article/K000148648
试试在 configuration-snippet 再加一个
rewrite ^ $request_uri;

[dhq]

@feedcode 昨天又尝试过，但加了这个，它会把 /xxx?aa=bb 修改为 /xxx%3Faa=bb
```
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
annotations:
nginx.ingress.kubernetes.io/proxy-body-size: 200m
nginx.ingress.kubernetes.io/proxy-next-upstream-timeout: "60"
nginx.ingress.kubernetes.io/proxy-read-timeout: "360"
# 移除 rewrite-target 和 use-regex 注解
# nginx.ingress.kubernetes.io/rewrite-target: /$2
# nginx.ingress.kubernetes.io/use-regex: "true"
nginx.ingress.kubernetes.io/ssl-redirect: "false"
nginx.ingress.kubernetes.io/enable-rewrite-log: "true"
nginx.ingress.kubernetes.io/configuration-snippet: |
# 新增的重写逻辑
# 1. 将当前 URI 重置为原始的、未解码的 URI
# rewrite ^ $request_uri;

# 2. 对原始 URI 进行重写，剥离/dhq/前缀
# 'break'标志表示停止处理后续的 rewrite 规则，并进行内部转发
rewrite ^/dhq/(.*)$ /$1 break;
```

[ca2oh4]

七层的网络真复杂

[feedcode]

不要 rewrite query parameter

nginx.ingress.kubernetes.io/configuration-snippet: |
if ($request_uri ~ "/dhq/([^\?]*)") {
set $path1 $1;
rewrite ^/dhq/ /$path1 break;
}

[dhq]

@feedcode 没有作用，我 ai 的回答是，nginx 的 rewrite 本身就是会做 uri 的 decode 这一步的，貌似没法避免