<p>I want my Jenkins to be only accessible in the private network via VPN to protect it from the dangers of the public internet. Nonetheless, I also want to use GitHub webhooks. So the Jenkins needs to expose a single path to the public internet.</p>
<p>To expose the whole service I could simply create an ingress rule like:</p>
<pre class="lang-yaml prettyprint-override"><code>  rules:
    - host: example.com
      http:
        paths:
        - path: /jenkins
          pathType: Prefix
          backend:
            service:
              name: jenkins-service
              port:
                number: 80
</code></pre>
<p>This would expose the WHOLE service at <code>https://example.com/jenkins</code>. But this is bad from a security perspective. Therefore I would like to expose only the webhook path of the service. I.e. <code>/generic-webhook-trigger/invoke</code>. So that it is the only URL you can reach from the public internet. Like this:</p>
<pre><code>curl https://example.com/generic-webhook-trigger/invoke
</code></pre>
<p>Is that possible? Thanks for any suggestion!</p>

ss1
<p>So this doesn't seem to be possible with the native ingress functionalities but requires an ingress controller, like the Nginx Ingress Controller. These come with additional functionalities, like URI rewrite rules (see <a href="https://kubernetes.github.io/ingress-nginx/examples/rewrite/" rel="nofollow noreferrer">here</a>).</p>
<p>In case of the Nginx Ingress Controller you need the <code>nginx.ingress.kubernetes.io/rewrite-target</code> and rewrite your ingress path to the desired path.</p>
<pre><code>apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: jenkins-ingress
  namespace: jenkins
  annotations:
    nginx.ingress.kubernetes.io/rewrite-target: /jenkins/generic-webhook-trigger/invoke
spec:
  ingressClassName: nginx

  rules:
    - host: example.com
      http:
        paths:
        - path: /jenkins
          pathType: Prefix
          backend:
            service:
              name: jenkins-service
              port:
                number: 80
</code></pre>
<p>If you now visit <code>https://example.com/jenkins</code> then it will get internally rewritten to <code>https://example.com/jenkins/generic-webhook-trigger/invoke</code>. No redirects involved.</p>
