From 056964075ed3d1e80655ce14a35187bff179a909 Mon Sep 17 00:00:00 2001 From: rock Date: Tue, 27 Oct 2026 14:24:06 -0700 Subject: [PATCH] fix(comfyui): drop the snippet that made nginx reject the whole ingress The controller logs "annotation group ConfigurationSnippet contains risky annotation" and a rejected annotation group drops the entire ingress from nginx.conf. comfyui.riotpiao.com therefore answered 404 for every request with no line in the access log, which is why the host looked routed but served nothing. ingress-nginx sets the Upgrade and Connection headers itself for a websocket upgrade, so the snippet was never needed. --- k8s/apps/comfyui/ingress.yaml | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/k8s/apps/comfyui/ingress.yaml b/k8s/apps/comfyui/ingress.yaml index 3e18e9c..49aa6c7 100644 --- a/k8s/apps/comfyui/ingress.yaml +++ b/k8s/apps/comfyui/ingress.yaml @@ -18,9 +18,11 @@ metadata: nginx.ingress.kubernetes.io/auth-url: "http://comfyui-oauth2-proxy.comfyui.svc.cluster.local:4180/oauth2/auth" nginx.ingress.kubernetes.io/auth-signin: "https://comfyui.riotpiao.com/oauth2/start?rd=$scheme://$host$request_uri" nginx.ingress.kubernetes.io/auth-response-headers: "x-auth-request-user,x-auth-request-email" - nginx.ingress.kubernetes.io/configuration-snippet: | - proxy_set_header Upgrade $http_upgrade; - proxy_set_header Connection "upgrade"; + # No configuration-snippet. The controller rejects that annotation as risky + # ("annotation group ConfigurationSnippet contains risky annotation"), and a + # rejected annotation drops the WHOLE ingress from nginx.conf: the host then + # answers 404 with no entry in the access log. ingress-nginx sets the Upgrade + # and Connection headers itself for a websocket upgrade. spec: ingressClassName: nginx rules: