Implement support for URL and Host Header Rewrite for Application Load Balancer

[andreybutenko]

Implement support for URL and Host Header Rewrite for Application Load Balancer

Motivation

This PR adds AWS Load Balancer Controller support for 1/ URL and Host Header Rewrite, and 2/ regex rule conditions.

• See documentation: https://docs.aws.amazon.com/elasticloadbalancing/latest/application/rule-transforms.html
• See launch announcement: https://aws.amazon.com/about-aws/whats-new/2025/10/application-load-balancer-url-header-rewrite/
• See blog: https://aws.amazon.com/blogs/networking-and-content-delivery/introducing-url-and-host-header-rewrite-with-aws-application-load-balancers/

Usage in LBC

Transforms

Added alb.ingress.kubernetes.io/transforms.${transforms-name} annotation, which provides a method for specifying transforms on Ingress spec.

Example transform to remove the leading /api/ from request paths:

alb.ingress.kubernetes.io/transforms.my-service: >
    [
        {
            "type": "url-rewrite",
            "urlRewriteConfig": {
                "rewrites": [
                    {
                        "regex": "^\\/api\\/(.+)$",
                        "replace": "/$1"
                    }
                ]
            }
        }
    ]

Example transform to replace example.com with example.org from request host headers:

alb.ingress.kubernetes.io/transforms.my-service: >
    [
        {
            "type": "host-header-rewrite",
            "hostHeaderRewriteConfig": {
                "rewrites": [
                    {
                        "regex": "^(.+)\\.example\\.com$",
                        "replace": "$1.example.org"
                    }
                ]
            }
        }
    ]

Regex rule conditions (annotations)

Extended alb.ingress.kubernetes.io/conditions.${conditions-name} to support new regexValues property.

HTTP header condition using regex values:

alb.ingress.kubernetes.io/conditions.my-service: >
    [{ "field": "http-header", "httpHeaderConfig": { "httpHeaderName": "User-Agent", "regexValues": [ ".+Chrome.+" ] } }]

Path condition using regex values:

alb.ingress.kubernetes.io/conditions.my-service: >
    [{ "field": "path-pattern", "pathPatternConfig": { "regexValues": [ "^/api/?(.*)$" ] } }]

Host header condition using regex values:

alb.ingress.kubernetes.io/conditions.my-service: >
    [{ "field": "host-header", "hostHeaderConfig": { "regexValues": [ "^(.+)\\.example\\.com" ] } }]

Regex rule conditions (ingress spec)

Added alb.ingress.kubernetes.io/use-regex-path-match annotation, which configures whether HTTP paths in the Ingress specification should be evaluated using regex.

• This configuration only applies to HTTP paths using pathType: ImplementationSpecific. HTTP paths using pathType: Exact or pathType: Prefix are not affected by this annotation.
• A leading / must precede the regex. The leading / will be removed from the regex.

Annotation:

alb.ingress.kubernetes.io/use-regex-path-match: "true"

Ingress rule path:

-   path: "/^/api/(.+)$"
    pathType: ImplementationSpecific
    backend:
        service:
        name: service-2048
        port:
            number: 80

With this configuration, the rule condition regex value will be ^/api/(.+)$ as the leading / is removed from the regex.

Details

• Implement support for RegexValues in conditions annotation
• Implement support for RegexValues in ingress spec paths
  • Add alb.ingress.kubernetes.io/use-regex-path-match annotation
  • Update buildPathPatternsForImplementationSpecificPathType to treat spec path as regex when annotation is "true"
• Implement transforms annotation
  • Implement buildTransforms to get transforms from transforms.${svc-name} annotation
  • Implement buildSDKTransforms to marshall transforms
  • Add interface for transforms model
  • Update enhanced backend, ListenerRuleManager, buildListenerRules, matchResAndSDKListenerRules to handle transforms
  • Rename resLRDesiredActionsAndConditionsPair to resLRDesiredRuleConfig, extend to support transforms property
  • Update matchResAndSDKListenerRules and related helpers to support transforms property
  • Implement CompareOptionForTransform to compare transforms objects
  • Add and update unit tests
• Misc
  • Add documentation for URL Rewrite
  • Add client-side validation to prevent mixing Values and RegexValues for host-name and path-pattern conditions
  • Remove leading slash from regex rule path
  • Implement host regex value support

Issues

• Add support for rewrite-target #142
• URL rewrite? #835
• Remove path prefix from url? #1133
• [Feature Request ] Features for AWS ALB / NLB #1571
• Support for URL rewite annotation #2082
• Does ALB annotation support URL rewrite? #2428

Checklist

• Added tests that cover your change (if possible)
• Added/modified documentation as required (such as the README.md, or the docs directory)
• Manually tested
  • Previously did manual tests, doing some more final testing now
• Made sure the title of the PR is a good description that can go into the release notes

BONUS POINTS checklist: complete for good vibes and maybe prizes?! 🤯

• Backfilled missing tests for code in same general area 🎉
• Refactored something and made the world a better place 🌟

[k8s-ci-robot]

Hi @andreybutenko. Thanks for your PR.

I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[zac-nixon]

/ok-to-test

[shraddhabang]

/lgtm
/approve

[andreybutenko]

Looking at test failures

[zac-nixon]

/lgtm

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: andreybutenko, shraddhabang, zac-nixon

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [shraddhabang,zac-nixon]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment