rock
a1bb64dd98
Two Ingresses on one host do not merge annotations. nginx applies the annotations of a single ingress per host, so the separate /oauth2 object silently dropped the auth_request on the app ingress: every request fell through to the backend and ComfyUI answered 404 for the site root. Move /oauth2 and / into the same ingress, so the auth annotations and both paths belong to one object.
49 lines
2.1 KiB
YAML
49 lines
2.1 KiB
YAML
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: comfyui
|
|
namespace: comfyui
|
|
annotations:
|
|
# No cert-manager annotation and no tls: block. This host is covered by
|
|
# the *.riotpiao.com wildcard, which nginx serves as its
|
|
# default-ssl-certificate (ingress-nginx/riotpiao-com-tls).
|
|
nginx.ingress.kubernetes.io/proxy-read-timeout: "600"
|
|
nginx.ingress.kubernetes.io/proxy-send-timeout: "600"
|
|
nginx.ingress.kubernetes.io/proxy-body-size: "0"
|
|
# WebSocket support for ComfyUI's live preview
|
|
nginx.ingress.kubernetes.io/proxy-http-version: "1.1"
|
|
nginx.ingress.kubernetes.io/upstream-hash-by: "$remote_addr"
|
|
# Single sign-on. ComfyUI has no auth of its own, so every request is handed to
|
|
# oauth2-proxy for an allow or deny decision.
|
|
nginx.ingress.kubernetes.io/auth-url: "http://comfyui-oauth2-proxy.comfyui.svc.cluster.local:4180/oauth2/auth"
|
|
nginx.ingress.kubernetes.io/auth-signin: "https://comfyui.riotpiao.com/oauth2/start?rd=$scheme://$host$request_uri"
|
|
nginx.ingress.kubernetes.io/auth-response-headers: "x-auth-request-user,x-auth-request-email"
|
|
nginx.ingress.kubernetes.io/configuration-snippet: |
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection "upgrade";
|
|
spec:
|
|
ingressClassName: nginx
|
|
rules:
|
|
- host: comfyui.riotpiao.com
|
|
http:
|
|
paths:
|
|
# The login path lives on the SAME ingress as the app. Two Ingresses on
|
|
# one host do not merge their annotations: nginx applies the annotations
|
|
# of a single ingress per host, so a separate /oauth2 object silently
|
|
# dropped the auth_request above and every request fell through to the
|
|
# backend, which answered 404.
|
|
- path: /oauth2
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: comfyui-oauth2-proxy
|
|
port:
|
|
number: 4180
|
|
- path: /
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: comfyui
|
|
port:
|
|
number: 80
|