<p>I am trying to write the nginx ingress config for my k8s cluster.</p>
<pre><code>apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  name: blabla-data-api-ingress
  annotations:
    nginx.ingress.kubernetes.io/proxy-connect-timeout: &quot;360&quot;
    nginx.ingress.kubernetes.io/proxy-send-timeout: &quot;360&quot;
    nginx.ingress.kubernetes.io/proxy-read-timeout: &quot;360&quot;
    nginx.ingress.kubernetes.io/proxy-body-size: 256m
    nginx.ingress.kubernetes.io/configuration-snippet: |
      proxy_set_header Authorization $http_authorization;
      proxy_pass_header  Authorization;
    kubernetes.io/ingress.class: nginx
    cert-manager.io/cluster-issuer: letsencrypt
spec:
  tls:
    - hosts:
        - blabla-data.api.staging.20-74-47-80.nip.io
      secretName: blabla-data-api-certification-staging
  rules:
    - host: blabla-data.api.staging.20-74-47-80.nip.io
      http:
        paths:
          - backend:
              serviceName: blabla-data-api
              servicePort: 80
            path: /
          - backend:
              serviceName: blabla-data-api
              servicePort: 443
            path: /

</code></pre>
<p>When I apply this config, I get this error:</p>
<pre><code>for: &quot;kubernetes/staging/blabla-data-api-ingress.staging.yaml&quot;: admission webhook &quot;validate.nginx.ingress.kubernetes.io&quot; denied the request: nginx.ingress.kubernetes.io/configuration-snippet annotation contains invalid word proxy_pass
</code></pre>
<p>In fact, this piece of code used to work in the past.</p>
<p>I tried to add <code>--set controller.admissionWebhooks.enabled=false</code> in my <code>helm install nginx-ingress ingress-nginx/ingress-nginx</code> like that:</p>
<pre><code>helm install nginx-ingress ingress-nginx/ingress-nginx \
    --namespace ingress \
    --set controller.replicaCount=2 \
    --set controller.nodeSelector.&quot;beta\.kubernetes\.io/os&quot;=linux \
    --set defaultBackend.nodeSelector.&quot;beta\.kubernetes\.io/os&quot;=linux \
    --set controller.admissionWebhooks.enabled=false
</code></pre>
<p>In this case, I don't get any error while applying this ingress config but then I get a <code>404</code> from nginx when I try to access my server through the external API.</p>

<p>OP has confirmed, that the issue was solved in <a href="https://github.com/kubernetes/ingress-nginx/issues/7837" rel="nofollow noreferrer">this github topic</a></p>
<blockquote>
<p>it was exactly the issue you mentioned, thanks for your help</p>
</blockquote>
<p>This problem is related to <a href="https://nvd.nist.gov/vuln/detail/CVE-2021-25742" rel="nofollow noreferrer">CVE-2021-25742</a>. Problem is solved based on this message:</p>
<blockquote>
<p>Hi folks we just released  <a href="https://github.com/kubernetes/ingress-nginx/releases/tag/controller-v1.0.5" rel="nofollow noreferrer">Ingress NGINX v1.0.5.</a>  Thanks to  <a href="https://github.com/rikatz" rel="nofollow noreferrer">@rikatz</a>  who helped implement<br />
<a href="https://github.com/kubernetes/ingress-nginx/pull/7874" rel="nofollow noreferrer">#7874</a>  which added the option to sanitize annotation inputs</p>
<p><code>annotation-value-word-blocklist</code>  defaults are  <code>&quot;load_module,lua_package,_by_lua,location,root,proxy_pass,serviceaccount,{,},',\&quot;</code></p>
<p>Users from mod_security and other features should be aware that some blocked values may be used by those features and must be manually unblocked by the Ingress Administrator.</p>
<p>For more details please check  <a href="https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#annotation-value-word-blocklist" rel="nofollow noreferrer">https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#annotation-value-word-blocklist</a></p>
<p>If you have any issues with this new feature or the release please  <a href="https://github.com/kubernetes/ingress-nginx/issues/new/choose" rel="nofollow noreferrer">open a new issue</a>  so we can track it there.</p>
</blockquote>
