<p>I have many domain pointing to Ingress Controller IP. I want to block /particular-path for all the domains/sites. Is there a way to do this.
I can use <code>nginx.ingress.kubernetes.io/configuration-snippet: | </code> for each site. But looking for way to do for all sites/domains/Ingress resource at once.</p>
<p>Controller used: <a href="https://kubernetes.github.io/ingress-nginx/" rel="nofollow noreferrer">https://kubernetes.github.io/ingress-nginx/</a></p>

Tek Nath Acharya
<p>There are two ways to achieve this:</p>
<p><strong>1. First one is with using <code>server-snippet</code> annotation:</strong></p>
<blockquote>
<p>Using the annotation  <code>nginx.ingress.kubernetes.io/server-snippet</code>  it
is possible to add custom configuration in the server configuration
block.</p>
</blockquote>
<p>Here is my manifest for the ingress object:</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  name: minimal-ingress
  annotations:
     nginx.ingress.kubernetes.io/server-snippet: |
          location ~* /admin-access {
              deny all;
              return 403;
            }
spec:
  rules:
  - host: domain.com
    http:
      paths:
      - path: /
        backend:
          serviceName: web 
          servicePort: 80
</code></pre>
<p>Please note that using  <a href="https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/#server-snippet" rel="nofollow noreferrer">this</a> approach :</p>
<blockquote>
<p>This annotation can be used only once per host.</p>
</blockquote>
<hr />
<p><strong>2. Second one is with usage of <a href="https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#configmaps" rel="nofollow noreferrer">ConfigMaps</a> and <a href="https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#server-snippet" rel="nofollow noreferrer">Server-snippet</a>:</strong></p>
<p>What you have to do is to locate your <code>configMap</code>:</p>
<pre><code> kubectl get pod &lt;nginx-ingress-controller&gt;  -o yaml
</code></pre>
<p>This is located the container <code>args</code>:</p>
<pre class="lang-yaml prettyprint-override"><code>  spec:
   containers:
   - args:
     -  /nginx-ingress-controller
     - configmap=$(POD_NAMESPACE)/nginx-loadbalancer-conf
</code></pre>
<p>And then just edit it and place add the <code>server-snippet</code> part:</p>
<pre class="lang-yaml prettyprint-override"><code>   apiVersion: v1 
   data:  
   server-snippet:  |
   location /admin-access {
   deny  all;
    }
</code></pre>
<p>This approach allows you to define restricted location globally for all host defined in Ingress resource.</p>
<hr />
<p>Please note that with usage of <code>server-snippet</code> the path that you are blocking cannot be defined in ingress resource object. There is however another way with <code>location-snippet</code> via <code>ConfigMap</code>:</p>
<pre class="lang-yaml prettyprint-override"><code>location ~* &quot;^/web/admin { 
        deny all; 
        }
</code></pre>
<p>With this for every existing path in ingress object there will be ingress rule but it will be blocked for specific uri (In the example above it be be blocked when <code>admin</code> will appear after <code>web</code>). All of the other uri will be passed through.</p>
<hr />
<p><strong>3. Here`s a test:</strong></p>
<pre class="lang-sh prettyprint-override"><code>➜  curl -H &quot;Host: domain.com&quot;  172.17.0.4/test             
...
 &quot;path&quot;: &quot;/test&quot;,
 &quot;headers&quot;: {
...
 },
 &quot;method&quot;: &quot;GET&quot;,
 &quot;body&quot;: &quot;&quot;,
 &quot;fresh&quot;: false,
 &quot;hostname&quot;: &quot;domain.com&quot;,
 &quot;ip&quot;: &quot;172.17.0.1&quot;,
 &quot;ips&quot;: [
   &quot;172.17.0.1&quot;
 ],
 &quot;protocol&quot;: &quot;http&quot;,
 &quot;query&quot;: {},
 &quot;subdomains&quot;: [],
 &quot;xhr&quot;: false,
 &quot;os&quot;: {
   &quot;hostname&quot;: &quot;web-6b686fdc7d-4pxt9&quot;
...  
</code></pre>
<p>And here is a test with a path that has been denied:</p>
<pre class="lang-html prettyprint-override"><code>➜  curl -H &quot;Host: domain.com&quot;  172.17.0.4/admin-access

&lt;html&gt;
&lt;head&gt;&lt;title&gt;403 Forbidden&lt;/title&gt;&lt;/head&gt;
&lt;body&gt;
&lt;center&gt;&lt;h1&gt;403 Forbidden&lt;/h1&gt;&lt;/center&gt;
&lt;hr&gt;&lt;center&gt;nginx/1.19.0&lt;/center&gt;
&lt;/body&gt;
&lt;/html&gt;

➜  curl -H &quot;Host: domain.com&quot;  172.17.0.4/admin-access/test
&lt;html&gt;
&lt;head&gt;&lt;title&gt;403 Forbidden&lt;/title&gt;&lt;/head&gt;
&lt;body&gt;
&lt;center&gt;&lt;h1&gt;403 Forbidden&lt;/h1&gt;&lt;/center&gt;
&lt;hr&gt;&lt;center&gt;nginx/1.19.0&lt;/center&gt;
&lt;/body&gt;
&lt;/html&gt;
</code></pre>
<hr />
<p>Additional information: <a href="https://kubernetes.io/blog/2019/07/18/api-deprecations-in-1-16/" rel="nofollow noreferrer">Deprecated  APIs  Removed  In  1.16</a>.  Here’s What  You  Need  To  Know:</p>
<blockquote>
<p>The v1.22 release will stop serving the following deprecated API
versions in favor of newer and more stable API versions:</p>
<p>Ingress  in the extensions/v1beta1 API version will no longer be
served</p>
</blockquote>
