http-snippets on virtual server's

[sass1997]

We have detected that the snippets which are part in http-snippets are being places without any context in the http-core and must be unique in all the virtualserver of the whole cluster. This being said leads me to wanting to block this feature since I don't want that virtualserver responsible persons can manipulate or open stuff which has impact on the whole nginx. Is there somebody else who have maybe the same issue? In my opinion there should be a possibility to do a configuration of the http-snippet but only triggered on base of configmap from nginx not being triggered by a virtualserver.

[vepatel]

HI @sass1997, currently snippets can only be set to either on or off based on -enable-snippets arg in manifests or enableSnippets in helm

[j1m-ryan]

You can block snippets, but still have the ability to edit the nginx config via the configmap by using custom templates.
Custom templates don't rely on the enable-snippets flag. There is a tradeoff here that they are more work to maintain than snippets, as over releases, the templates can change.

[jjngx]

@sass1997 could you please share the snippets you are using?

[sass1997]

apiVersion: k8s.nginx.org/v1
kind: VirtualServer
metadata:
  labels:
    env: staging
  name: gateway-vs
spec:
  host: staging.host.mycompany.ch
  ingressClassName: nginx
  routes:
  - path: /gateway
    route: staging-gateway/gateway-service-vsr
  http-snippets: large_client_header_buffers 4 16k;
  tls:
    secret: ""

Actually wanted to setup a new environment of this and noticed the error that nginx is telling me that the block large_client_header_buffers 4 16k; is only allowed once. Exactly this is why I'm concerned that someone could overwrite a global behaviour for others which don't know about this.