location-snippets: if directives are ignored in NGINX Ingress Controller

[JunlinDu]

Version

nginx/nginx-ingress:5.3.2

Platform

Amazon EKS

Background

I am migrating from the community Ingress-NGINX Controller to the NGINX Ingress Controller (nginx/kubernetes-ingress) and am running into an issue where if directives inside nginx.org/location-snippets ignored.

In the community ingress-nginx controller, I rely on built-in annotations for rewrite rules and CORS handling. For example

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: test_app
  annotations:
    nginx.ingress.kubernetes.io/rewrite-target: "/$2"
    nginx.ingress.kubernetes.io/enable-cors: "true"
    nginx.ingress.kubernetes.io/cors-allow-methods: "GET, PUT, POST, DELETE, PATCH, OPTIONS"
    nginx.ingress.kubernetes.io/cors-allow-headers: "x-forwarded-for"
    nginx.ingress.kubernetes.io/cors-expose-headers: "authorization"
    nginx.ingress.kubernetes.io/cors-max-age: "1800"
    nginx.ingress.kubernetes.io/cors-allow-origin: WEB_ORIGIN

Since the NGINX Ingress Controller does not support these annotations on Ingress resources, I attempted to replicate the same behavior using nginx.org/location-snippets.

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: test_app
  annotations:
    nginx.org/rewrite-target: "/$2"
    nginx.org/path-regex: "case_insensitive"
    nginx.org/location-snippets: |
      if ($http_origin ~* WEB_ORIGIN_REGEX) {
        add_header 'Access-Control-Allow-Origin' $http_origin;
        add_header 'Access-Control-Allow-Methods' 'GET, PUT, POST, DELETE, PATCH, OPTIONS';
        add_header 'Access-Control-Allow-Headers' 'x-forwarded-for';
        add_header 'Access-Control-Expose-Headers' 'authorization';
        add_header 'Access-Control-Max-Age' 1800;
        break;
      }

      if ($request_method = 'OPTIONS') {
        add_header 'Access-Control-Allow-Origin' $http_origin;
        add_header 'Access-Control-Allow-Methods' 'GET, PUT, POST, DELETE, PATCH, OPTIONS';
        add_header 'Access-Control-Allow-Headers' 'x-forwarded-for';
        add_header 'Access-Control-Expose-Headers' 'authorization';
        add_header 'Access-Control-Max-Age' 1800;
        add_header 'Content-Length' 0;
        add_header 'Content-Type' 'text/plain charset=UTF-8';
        return 204;
      }

      add_header 'Cache-Control' 'no-store, max-age=0' always;
      proxy_set_header CQ-Select "";

spec:
  ingressClassName: nginx-class-name
  rules:
    - host: my.website
      http:
        paths:
          - path: /coffee(/|$)(.*)
            pathType: ImplementationSpecific
            backend:
              service:
                name: coffee-svc
                port:
                  number: 80

Issue

After successfully deployed, I noticed that CORS headers are not conditionally applied and the OPTIONS preflight handling is ignored. While investigating, I noticed that the generated location block includes a rewrite ... break directive that may be interfering with the snippet logic:

location ~* "^/coffee(/|$)(.*)" {
                set $service "coffee-svc";
                rewrite (?i)^/coffee/|$)(.*) /$2 break;
...
}

My question is what is the recommended way to implement conditional CORS handling and preflight (OPTIONS) responses when using nginx.org/location-snippets alongside rewrite rules?

[haywoodsh]

Can you confirm that you have the -enable-snippets command line argument enable when you deployed the NGINX Ingress Controller? Can you please share your generated NGINX config from the snippet so we can help with you with the troubleshooting?