<p>I'm trying to figure out how to use nginx proxy cache with some specific rules. For exemple, when i'm hosting Ghost or Wordpress, I don't want to cache admin section. Using server snippet, I've tried a lot of different combinaison but still have issues with cache in admin section.</p>

<pre><code>nginx.ingress.kubernetes.io/proxy-buffering: "on"
nginx.ingress.kubernetes.io/server-snippet: |-
  proxy_ignore_headers X-Accel-Expires Expires Cache-Control;
  proxy_ignore_headers Set-Cookie;
  proxy_cache app_cache;
  proxy_cache_lock on;
  proxy_cache_valid any 30m;
  add_header X-Cache-Status $upstream_cache_status;
</code></pre>

<p>I want to use nginx code snippet for (ghost|sinout) paths to bypass cache when in admin area, but i'm loosing the proxy_pass context resulting to a 502 bad gateway.</p>

<p>Here is the current ingress config caching every pages, admin path too:</p>

<pre><code>apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  annotations:
    nginx.ingress.kubernetes.io/proxy-buffering: "on"
    nginx.ingress.kubernetes.io/server-snippet: |-
      proxy_cache my_blog_cache;
      proxy_cache_lock on;
      proxy_cache_valid any 30m;
      add_header X-Cache-Status $upstream_cache_status;
      proxy_ignore_headers X-Accel-Expires Expires Cache-Control;
  name: my-blog
  namespace: web
spec:
  rules:
  - host: blog.example.com
    http:
      paths:
      - backend:
          serviceName: ingress-541322b8660dbd2ceb1e8ff1813f0dd5
          servicePort: 2368
        path: /
  tls:
  - hosts:
    - blog.example.com
    secretName: my-blog-cert
status:
  loadBalancer:
    ingress:
    - ip: 1.2.3.4
</code></pre>

<p>Here is the nginx config i'm trying to get but not compatible with ingress annotations:</p>

<pre><code>   location / {
        proxy_cache my_blog_cache;
        proxy_cache_valid 200 30m;
        proxy_cache_valid 404 1m;
        proxy_pass http://ghost_upstream;
        proxy_ignore_headers X-Accel-Expires Expires Cache-Control;
        proxy_ignore_headers Set-Cookie;
        proxy_hide_header Set-Cookie;
        proxy_hide_header X-powered-by;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header Host $http_host;
        expires 10m;
    }
    location /content/images {
        alias /path/to/ghost/content/images;
        access_log off;
        expires max;
    }
    location /assets {
        alias /path/to/ghost/content/themes/uno-master/assets;
        access_log off;
        expires max;
    }
    location /public {
        alias /path/to/ghost/core/built/public;
        access_log off;
        expires max;
    }
    location /ghost/scripts {
        alias /path/to/ghost/core/built/scripts;
        access_log off;
        expires max;
    }
    location ~ ^/(?:ghost|signout) { 
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header Host $http_host;
        proxy_pass http://ghost_upstream;
        add_header Cache-Control "no-cache, private, no-store, must-revalidate, max-stale=0, post-check=0, pre-check=0";
    }
</code></pre>

<p>Thanks for your help !</p>

<p>I had exact same desire: cache Ghost responses with respect to their <code>Cache-Control</code> headers directly on Nginx Ingress in the Kubernetes cluster.</p>
<p>After some hours spent on it here is my solution:</p>
<h1>First step</h1>
<p>First of all, you need to define <code>proxy_cache_path</code> on Nginx Ingress <a href="https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/" rel="noreferrer"><code>ConfigMap</code> level</a> (the docs are really unclear on how to apply it tbh).</p>
<p>In my case, I manage Nginx Ingress installation via Helm, so I've added it to Helm values chart:</p>
<pre class="lang-yaml prettyprint-override"><code># Default values https://github.com/kubernetes/ingress-nginx/blob/main/charts/ingress-nginx/values.yaml
controller:
  config:
    http-snippet: &quot;proxy_cache_path /tmp/nginx_my_cache levels=1:2 keys_zone=mycache:2m use_temp_path=off max_size=2g inactive=48h;&quot;
</code></pre>
<p>Then apply this change:</p>
<pre><code>helm upgrade -f my-nginx-ingress-values.yaml ingress-nginx ingress-nginx/ingress-nginx --recreate-pods
</code></pre>
<h1>Second step</h1>
<p>Now that we have <code>proxy_cache_path</code> set, we need to configure Ingress for particular host with annotations:</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: myingress
  namespace: mynamespace
  annotations:
    kubernetes.io/ingress.class: &quot;nginx&quot;
    # Buffering must be enabled for Nginx disk cache to work.
    nginx.ingress.kubernetes.io/proxy-buffering: &quot;on&quot;
    # See https://www.nginx.com/blog/nginx-caching-guide/
    # Cache Key Zone is configured in Helm config.
    nginx.ingress.kubernetes.io/server-snippet: |
      proxy_cache mycache;
      proxy_cache_use_stale error timeout http_500 http_502 http_503 http_504;
      proxy_cache_background_update on;
      proxy_cache_revalidate on;
      proxy_cache_lock on;
      add_header X-Cache-Status $upstream_cache_status;
</code></pre>
<p>Note:</p>
<blockquote>
<p>I spent most time figuring out why I was still getting <code>MISS</code>es. Turned out it's due to <code>nginx.ingress.kubernetes.io/proxy-buffering</code> <a href="https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/#proxy-buffering" rel="noreferrer">default in Ingress</a> — <code>off</code> — this DISABLES Nginx caching, thus you <strong>have</strong> to set it to <code>on</code> which is what we do.</p>
</blockquote>
<p>Apply the change to Ingress.</p>
<h1>Debugging resulting Nginx config</h1>
<p>You can and should I think verify resulting <code>nginx.conf</code> used for Ingress that is generated as result of applying <code>ConfigMap</code> and Ingress-level annotations.</p>
<p>To do so, you can copy <code>nginx.conf</code> from Ingress Controller pod to your local machine and verify its content (or <code>exec</code> into pod and see it there):</p>
<pre><code># Make sure to use correct namespace where Ingress Controller is deployed
# and correct Ingress Controller Pod name
kubectl cp -n default ingress-nginx-controller-xxxx:/etc/nginx/nginx.conf ~/Desktop/nginx.conf
</code></pre>
<p>It should contain all the changes we've made!</p>
<h1>Debugging actual response caching</h1>
<p>Now that we have everything configured — it's time to verify actual caching. Note that we have added <code>X-Cache-Status</code> header which will indicate if it's a <code>HIT</code> or <code>MISS</code>.</p>
<p>I personally like <a href="https://httpie.io/" rel="noreferrer">httpie</a> for HTTP requests from Terminal, you can use <code>curl</code> or browser:</p>
<p>First request is going to be <code>MISS</code>:</p>
<pre><code>http https://example.com/myimage.jpg
HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: public, max-age=31536000
Connection: keep-alive
Content-Length: 53588
Content-Type: image/jpeg
Date: Wed, 20 Oct 2021 10:39:06 GMT
ETag: W/&quot;d154-17c3aa43389&quot;
Last-Modified: Fri, 01 Oct 2021 06:56:52 GMT
Strict-Transport-Security: max-age=15724800; includeSubDomains
X-Cache-Status: HIT
X-Powered-By: Express
X-Request-ID: 0c73f97cb51d3071f14968720a26a99a

+-----------------------------------------+
| NOTE: binary data not shown in terminal |
+-----------------------------------------+
</code></pre>
<p>Second request to same URL is now a <code>HIT</code> and doesn't hit the actual Ghost installation, success!</p>
<pre><code>http https://example.com/myimage.jpg
HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: public, max-age=31536000
Connection: keep-alive
Content-Length: 53588
Content-Type: image/jpeg
Date: Wed, 20 Oct 2021 10:39:43 GMT
ETag: W/&quot;d154-17c3aa43389&quot;
Last-Modified: Fri, 01 Oct 2021 06:56:52 GMT
Strict-Transport-Security: max-age=15724800; includeSubDomains
X-Cache-Status: HIT
X-Powered-By: Express
X-Request-ID: 0c73f97cb51d3071f14968720a26a99a

+-----------------------------------------+
| NOTE: binary data not shown in terminal |
+-----------------------------------------+
</code></pre>
<p>It's also useful to verify logs on Ghost to double-check that cache HIT requests actually served directly from Nginx and never hit Ghost.</p>
<hr />
