rock
2485b5f165
Gating /oauth2 with the app redirects /oauth2/start to itself and the browser loops. ingress-nginx applies an ingress's annotations to the locations that ingress defines, so the login path belongs on its own object without auth-url. This split failed once before, and the split was not the reason: the app ingress carried a configuration-snippet that the controller rejects, which dropped that whole object and left only the login path rendered.
39 lines
1.7 KiB
YAML
39 lines
1.7 KiB
YAML
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: comfyui
|
|
namespace: comfyui
|
|
annotations:
|
|
# No cert-manager annotation and no tls: block. This host is covered by
|
|
# the *.riotpiao.com wildcard, which nginx serves as its
|
|
# default-ssl-certificate (ingress-nginx/riotpiao-com-tls).
|
|
nginx.ingress.kubernetes.io/proxy-read-timeout: "600"
|
|
nginx.ingress.kubernetes.io/proxy-send-timeout: "600"
|
|
nginx.ingress.kubernetes.io/proxy-body-size: "0"
|
|
# WebSocket support for ComfyUI's live preview
|
|
nginx.ingress.kubernetes.io/proxy-http-version: "1.1"
|
|
nginx.ingress.kubernetes.io/upstream-hash-by: "$remote_addr"
|
|
# Single sign-on. ComfyUI has no auth of its own, so every request is handed to
|
|
# oauth2-proxy for an allow or deny decision.
|
|
nginx.ingress.kubernetes.io/auth-url: "http://comfyui-oauth2-proxy.comfyui.svc.cluster.local:4180/oauth2/auth"
|
|
nginx.ingress.kubernetes.io/auth-signin: "https://comfyui.riotpiao.com/oauth2/start?rd=$scheme://$host$request_uri"
|
|
nginx.ingress.kubernetes.io/auth-response-headers: "x-auth-request-user,x-auth-request-email"
|
|
# No configuration-snippet. The controller rejects that annotation as risky
|
|
# ("annotation group ConfigurationSnippet contains risky annotation"), and a
|
|
# rejected annotation drops the WHOLE ingress from nginx.conf: the host then
|
|
# answers 404 with no entry in the access log. ingress-nginx sets the Upgrade
|
|
# and Connection headers itself for a websocket upgrade.
|
|
spec:
|
|
ingressClassName: nginx
|
|
rules:
|
|
- host: comfyui.riotpiao.com
|
|
http:
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: comfyui
|
|
port:
|
|
number: 80
|