Add override for proxy intercept errors when using Custom HTTP Errors on default backend

[GerryWilko]

This PR adds a new flag to the global ConfigMap configurations and Ingress Annotations to disable the proxy_intercept_errors setting in nginx.conf when using CustomHTTPErrors.

What this PR does / why we need it:

The motivation behind this change is to enable the use case outlined in #8376. We would like to be able to override the default nginx error pages (e.g. 503 service unavailable and 404 not found) with a custom error page without intercepting genuine error responses from proxied services.

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation only

Which issue/s this PR fixes

fixes #8376

How Has This Been Tested?

Added unit tests to cover this change. Tested locally and confirmed fix by applying manually to our test site by editing nginx.conf and removing proxy_intercept_errors line.

Checklist:

• My change requires a change to the documentation.
• I have updated the documentation accordingly.
• I've read the CONTRIBUTION guide
• I have added tests to cover my changes.
• All new and existing tests passed.

[linux-foundation-easycla]

• ❌ - login: @GerryWilko / name: Gerard Wilkinson . The commit (0f07afa, 67589fa, 25aadc7, cf80fb2, 2c8744c, 13375dc) is not authorized under a signed CLA. Please click here to be authorized. For further assistance with EasyCLA, please submit a support request ticket.

[k8s-ci-robot]

Welcome @GerryWilko!

It looks like this is your first PR to kubernetes/ingress-nginx 🎉. Please refer to our pull request process documentation to help your PR have a smooth ride to approval.

You will be prompted by a bot to use commands during the review process. Do not be afraid to follow the prompts! It is okay to experiment. Here is the bot commands documentation.

You can also check if kubernetes/ingress-nginx has its own contribution guidelines.

You may want to refer to our testing guide if you run into trouble with your tests not passing.

If you are having difficulty getting your pull request seen, please follow the recommended escalation practices. Also, for tips and tricks in the contribution process you may want to read the Kubernetes contributor cheat sheet. We want to make sure your contribution gets all the attention it needs!

Thank you, and welcome to Kubernetes. 😃

[k8s-ci-robot]

Hi @GerryWilko. Thanks for your PR.

I'm waiting for a kubernetes member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: GerryWilko
To complete the pull request process, please assign rikatz after the PR has been reviewed.
You can assign the PR to them by writing /assign @rikatz in a comment when ready.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[longwuyuan]

@GerryWilko , thank you for your contribution.

• Please sign CLA
• Please create an issue that contains all the details of the problems.
• Please put enough information there so that anybody can read and understand what the tiny specifics of the problem are
• Please link that issue here with the string fixes # <issuenumber>
• Please write tests for this code-change
• Please write documentation for this new flag and show examples if appropriate

[GerryWilko]

Hi @longwuyuan,

I'll get to work on those points.

The CLA is a really frustrating thing to ask contributors to sign it is very much anti Open Source. I have started the process of getting this signed within my organisation. It is very unclear who this meant to protect and what actual purpose it serves beyond being a stick to beat contributors with should any legal issues arise. Rant over...

[longwuyuan]

@GerryWilko thank you for the contribution. It helps. Its possible to have a healthy discussion on the problem to sign CLA and explore solution. Also clicking on the details link above, takes you to a page where there is info on CLA, if you want. There is no getting around the CLA in the near future though. Thanks again. If there is enough content, like verified working code and tests and docs, then someone else without CLA problems can submit the PR using your content.

[strongjz]

Thank you for your contribution. As this is a CNCF Project we must adhere to their rules, and practices which includes the CLA. If you have any problems signing the CLA please let them know by emailing them at cla@cncf.io.

Thank you,
James

[strongjz]

/triage accepted
/priority backlog
/kind feature

[JohannesLamberts]

@GerryWilko thanks for creating this pull request 🙂. Can you tell whether you will be able to sign the CLA? In case its hard to get through the process at your company - is there any other way?

I'm very much looking forward to this PR being merged as it will unblock one of our issues 🙏 .

[k8s-ci-robot]

@GerryWilko: PR needs rebase.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue or PR as fresh with /remove-lifecycle stale
• Mark this issue or PR as rotten with /lifecycle rotten
• Close this issue or PR with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[k8s-triage-robot]

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue or PR as fresh with /remove-lifecycle rotten
• Close this issue or PR with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle rotten

[simhnna]

We're currently testing a modified version of this patch at our organisation and would very much like the merge request be merged.
@GerryWilko if you can't/won't sign the CLA, with your permission I'd open a merge myself to get it merged faster

[simhnna]

this is the default for ingress annotations only, and not the global config, correct? The global config value should also default to true, shouldn't it?

[simhnna]

I would drop the set- prefix, to align the naming to all other options

[rikatz]

/close

CLA is part of the contribution process of Kubernetes. Once you have it signed, please let us know and feel free to open a new PR

[k8s-ci-robot]

@rikatz: Closed this PR.

In response to this:

/close

CLA is part of the contribution process of Kubernetes. Once you have it signed, please let us know and feel free to open a new PR

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.