Predefined server-snippet that can only be reference and used in ingress

[Anddd7]

What do you want to happen?

We want to host a set of multi-tenant applications in our cluster. There are a lot of similar server-snippets in those ingresses, e.g. filter header, redirection. Because everyone shares a same nginx-controller, so we want to limit or even stop the use of snippets to secure our platform.

So we're wondering if it's possible to have:

• AdminOps creates pre-defined snippets in a custom nginx.tmpl
• AdminOps rollouts those 'features' by replacing the nginx.tmpl
• DevOps use custom annotations to call those snippets

So, we can ensure server-snippets is used under restricted conditions.

Is there currently another issue associated with this?

No

Does it require a particular kubernetes version?

No (only nginx template rendering)

If this is actually about documentation, uncomment the following block

No

[k8s-ci-robot]

This issue is currently awaiting triage.

If Ingress contributors determines this is a relevant issue, they will accept it by applying the triage/accepted label and provide further guidance.

The triage/accepted label can be added by org members by writing /triage accepted in a comment.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[longwuyuan]

There is no interest in the project to keep adding new annotations on-demand. The reason is that the volume of unique important use-cases is too large to cater to all expectations. Meaning if annotations are created for all requirements, then it becomes a combination of limited use of huge maintenance effort, of non-generic annotations or other features.

Secondly, the planning and execution of the Gateway API is already underway. The Gateway API will impact many expectations and alter designs. So adding annotations is not a improvement.

Thank you for your other contribution of gRPC_timeout annotation. That timeout annotation exists for HTTP but not for gRPC. So its a generic use-case for all gRPC deployments and hence its a improvement.

Wait for comments from others.

[Anddd7]

sure, i don't want to add annotations directly in this repo, that will bring chaos (like you said). 😄

i just want a mechanism that support custom annotations at runtime, like https://docs.nginx.com/nginx-ingress-controller/configuration/ingress-resources/custom-annotations/.

• the nginx.tmpl can be mounted to controller
• the annotations can be added to ingress, and only effect when it has been defined in nginx.tmpl

so, we don't need to create a full set of codes for annotation, just expose a map of variables for tmpl.

（let's see others 👍 ）

[longwuyuan]

I don't think this project's controller has the design & architecture for supporting anything resembling dynamic runtime annotations.

Wait for other comments.

[github-actions]

This is stale, but we won't close it automatically, just bare in mind the maintainers may be busy with other tasks and will reach your issue ASAP. If you have any question or request to prioritize this, please reach #ingress-nginx-dev on Kubernetes Slack.