Emit event message for ingresses which include a configuration snippet when snippets are disabled

[brross]

When snippets are disabled by allow-snippet-annotations: false, ingress-nginx should emit an event message for ingresses which include a configuration snippet annotation.

Perhaps something like $ingress created but ignoring configuration-snippet annotation; snippet-by-annotation is disabled

Currently, with allow-snippet-annotations: false, ingress-nginx creates the requested ingress resource but silently ignores any -snippet annotation creating confusion for end-users.

This is related to the fix for Issue kubernetes/kubernetes#126811 introduced in PRs #7666 and #7670

[strongjz]

/triage accepted
/priority important-soon
/assign @strongjz

[strongjz]

Do you have the admission webhook disabled?

I was testing this with a local cluster and a default install. The admission webhook did not create the ingress object.

pod/foo-app unchanged
service/foo-service unchanged
pod/bar-app unchanged
service/bar-service unchanged
Error from server (BadRequest): error when creating "test.yml": admission webhook "validate.nginx.ingress.kubernetes.io" denied the request: nginx.ingress.kubernetes.io/configuration-snippet annotation cannot be used. Snippet directives are disabled by the Ingress administrator

apiVersion: v1
metadata:
  name: foo-app
  labels:
    app: foo
spec:
  containers:
  - name: foo-app
    image: hashicorp/http-echo:0.2.3
    args:
    - "-text=foo"
---
kind: Service
apiVersion: v1
metadata:
  name: foo-service
spec:
  selector:
    app: foo
  ports:
  # Default port used by the image
  - port: 5678
---
kind: Pod
apiVersion: v1
metadata:
  name: bar-app
  labels:
    app: bar
spec:
  containers:
  - name: bar-app
    image: hashicorp/http-echo:0.2.3
    args:
    - "-text=bar"
---
kind: Service
apiVersion: v1
metadata:
  name: bar-service
spec:
  selector:
    app: bar
  ports:
  # Default port used by the image
  - port: 5678
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: example-ingress
  annotations:
    nginx.ingress.kubernetes.io/configuration-snippet: |
      more_set_headers "Request-Id: $req_id";
spec:
  rules:
  - http:
      paths:
      - pathType: Prefix
        path: "/foo"
        backend:
          service:
            name: foo-service
            port:
              number: 5678
      - pathType: Prefix
        path: "/bar"
        backend:
          service:
            name: bar-service
            port:
              number: 5678
---

[brross]

I double-checked and, indeed, I do have the validating webhook enabled. I'll have to investigate why it's not doing the proper thing in my test environment.

I do think emitting and event message for this would be useful in any case.

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue or PR as fresh with /remove-lifecycle stale
• Mark this issue or PR as rotten with /lifecycle rotten
• Close this issue or PR with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[strongjz]

@brross any update?