rock
056964075e
The controller logs "annotation group ConfigurationSnippet contains risky annotation" and a rejected annotation group drops the entire ingress from nginx.conf. comfyui.riotpiao.com therefore answered 404 for every request with no line in the access log, which is why the host looked routed but served nothing. ingress-nginx sets the Upgrade and Connection headers itself for a websocket upgrade, so the snippet was never needed.
51 lines
2.3 KiB
YAML
51 lines
2.3 KiB
YAML
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: comfyui
|
|
namespace: comfyui
|
|
annotations:
|
|
# No cert-manager annotation and no tls: block. This host is covered by
|
|
# the *.riotpiao.com wildcard, which nginx serves as its
|
|
# default-ssl-certificate (ingress-nginx/riotpiao-com-tls).
|
|
nginx.ingress.kubernetes.io/proxy-read-timeout: "600"
|
|
nginx.ingress.kubernetes.io/proxy-send-timeout: "600"
|
|
nginx.ingress.kubernetes.io/proxy-body-size: "0"
|
|
# WebSocket support for ComfyUI's live preview
|
|
nginx.ingress.kubernetes.io/proxy-http-version: "1.1"
|
|
nginx.ingress.kubernetes.io/upstream-hash-by: "$remote_addr"
|
|
# Single sign-on. ComfyUI has no auth of its own, so every request is handed to
|
|
# oauth2-proxy for an allow or deny decision.
|
|
nginx.ingress.kubernetes.io/auth-url: "http://comfyui-oauth2-proxy.comfyui.svc.cluster.local:4180/oauth2/auth"
|
|
nginx.ingress.kubernetes.io/auth-signin: "https://comfyui.riotpiao.com/oauth2/start?rd=$scheme://$host$request_uri"
|
|
nginx.ingress.kubernetes.io/auth-response-headers: "x-auth-request-user,x-auth-request-email"
|
|
# No configuration-snippet. The controller rejects that annotation as risky
|
|
# ("annotation group ConfigurationSnippet contains risky annotation"), and a
|
|
# rejected annotation drops the WHOLE ingress from nginx.conf: the host then
|
|
# answers 404 with no entry in the access log. ingress-nginx sets the Upgrade
|
|
# and Connection headers itself for a websocket upgrade.
|
|
spec:
|
|
ingressClassName: nginx
|
|
rules:
|
|
- host: comfyui.riotpiao.com
|
|
http:
|
|
paths:
|
|
# The login path lives on the SAME ingress as the app. Two Ingresses on
|
|
# one host do not merge their annotations: nginx applies the annotations
|
|
# of a single ingress per host, so a separate /oauth2 object silently
|
|
# dropped the auth_request above and every request fell through to the
|
|
# backend, which answered 404.
|
|
- path: /oauth2
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: comfyui-oauth2-proxy
|
|
port:
|
|
number: 4180
|
|
- path: /
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: comfyui
|
|
port:
|
|
number: 80
|