<p>I've got an Ingress object with multiple backends, like this:</p>

<pre><code>kind: Ingress
apiVersion: extensions/v1beta1
metadata:
  name: my-app
  annotations:
    certmanager.k8s.io/issuer: letsencrypt-prod
    fabric8.io/generated-by: exposecontroller
    kubernetes.io/ingress.class: nginx
    kubernetes.io/tls-acme: 'true'
    nginx.ingress.kubernetes.io/affinity: cookie
    nginx.ingress.kubernetes.io/backend-protocol: HTTPS
    nginx.ingress.kubernetes.io/proxy-body-size: 500m
    nginx.ingress.kubernetes.io/session-cookie-expires: '172800'
    nginx.ingress.kubernetes.io/session-cookie-max-age: '172800'
spec:
  tls:
    - hosts:
        - my-app.&lt;tld&gt;
      secretName: tls-my-app
  rules:
    - host: my-app.&lt;tld&gt;
      http:
        paths:
          - path: /_ui/
            backend:
              serviceName: ui
              servicePort: 443
          - backend:
              serviceName: api
              servicePort: 443
</code></pre>

<p>I only need session stickiness on my <code>api</code> service. But the <code>nginx.ingress.kubernetes.io/affinity: cookie</code> annotation applies to all backend services. Does someone know how I can accomplish what I need?</p>

gazal
<p>Annotations are <a href="https://kubernetes.github.io/ingress-nginx/how-it-works/#building-the-nginx-model" rel="nofollow noreferrer">applied to every <code>path</code></a> (location) defined on your <code>Ingress</code> object. If you need different annotations for each path, you could create one different <code>Ingress</code> for each <code>path</code>:</p>

<blockquote>
  <ul>
  <li>Annotations are applied to all the paths in the Ingress.</li>
  <li>Multiple Ingresses can define different annotations. These definitions are not shared between Ingresses.</li>
  <li>If multiple Ingresses define different paths for the same host, the    ingress controller will merge the definitions.</li>
  </ul>
</blockquote>

<p>Nginx Ingress Controller will watch and collect those <code>Ingress</code> rules, applying them accordingly.</p>

<p>For example:</p>

<pre><code>kind: Ingress
apiVersion: extensions/v1beta1
metadata:
  name: my-app-ui
  annotations:
    certmanager.k8s.io/issuer: letsencrypt-prod
    fabric8.io/generated-by: exposecontroller
    kubernetes.io/ingress.class: nginx
    kubernetes.io/tls-acme: 'true'
    # No session affinity here
    nginx.ingress.kubernetes.io/backend-protocol: HTTPS
    nginx.ingress.kubernetes.io/proxy-body-size: 500m
    nginx.ingress.kubernetes.io/session-cookie-expires: '172800'
    nginx.ingress.kubernetes.io/session-cookie-max-age: '172800'
spec:
  tls:
    - hosts:
        - my-app.&lt;tld&gt;
      secretName: tls-my-app
  rules:
    - host: my-app.&lt;tld&gt;
      http:
        paths:
          - path: /_ui/
            backend:
              serviceName: ui
              servicePort: 443
---
kind: Ingress
apiVersion: extensions/v1beta1
metadata:
  name: my-app-api
  annotations:
    certmanager.k8s.io/issuer: letsencrypt-prod
    fabric8.io/generated-by: exposecontroller
    kubernetes.io/ingress.class: nginx
    kubernetes.io/tls-acme: 'true'
    nginx.ingress.kubernetes.io/affinity: cookie  # &lt;-- Session affiniy is here
    nginx.ingress.kubernetes.io/backend-protocol: HTTPS
    nginx.ingress.kubernetes.io/proxy-body-size: 500m
    nginx.ingress.kubernetes.io/session-cookie-expires: '172800'
    nginx.ingress.kubernetes.io/session-cookie-max-age: '172800'
spec:
  tls:
    - hosts:
        - my-app.&lt;tld&gt;
      secretName: tls-my-app
  rules:
    - host: my-app.&lt;tld&gt;
      http:
        paths:
          - path: /_api/
            backend:
              serviceName: api
              servicePort: 443
---
</code></pre>

<p><em>Note: The API <code>extensions/v1beta1</code> was <a href="https://kubernetes.io/blog/2019/07/18/api-deprecations-in-1-16/" rel="nofollow noreferrer">deprecated</a> on Kubernetes 1.16. Consider migrating to <code>networking.k8s.io/v1beta1</code>.</em></p>
