<p>I am running into a very strange issue, I cannot set single quotes that are required by Content-Security-Policy. I assume I was running an older version of ingress which only got updated after I disabled and re-enabled it (microk8s).</p>
<pre><code>    nginx.ingress.kubernetes.io/configuration-snippet: |
      add_header Access-Control-Allow-Origin &quot;https://myhost&quot;;
      more_set_headers &quot;X-FRAME-OPTIONS: SAMEORIGIN&quot;;
      more_set_headers &quot;Content-Security-Policy: default-src 'self' blob:;&quot;;
</code></pre>
<p>Result:</p>
<pre><code>skipping ingress ...: nginx.ingress.kubernetes.io/configuration-snippet annotation contains invalid word '
</code></pre>
<p>I've tried using <code>x2</code>, escaping with <code>\</code>, wrapping everything with single quotes and escaping, nothing worked. I'm grateful if anyone can tell me how to add single quotes to the headers or if I can avoid them and still send the CSP.</p>
<p>EDIT: just to be clear, this configuration used to work on older versions, right now the ingress version is v1.0.5. There is nothing wrong with the syntax or other settings.</p>

<p>Changes has been appeared exactly in <a href="https://github.com/kubernetes/ingress-nginx/releases/tag/controller-v1.0.5" rel="nofollow noreferrer">1.0.5</a> related to sanitizing annotation inputs.</p>
<p>You may want to check <a href="https://github.com/kubernetes/ingress-nginx/issues/7837#issuecomment-969750366" rel="nofollow noreferrer">CVE-2021-25742: Ingress-nginx custom snippets</a>. I put in <strong>bold</strong> interested for you part.</p>
<blockquote>
<p><strong>annotation-value-word-blocklist defaults are</strong>
&quot;load_module,lua_package,_by_lua,location,root,proxy_pass,serviceaccount,{,},<strong>'</strong>,&quot;</p>
<p>Users from mod_security and other features should be aware that some
blocked <strong>values may be used by those features and must be manually
unblocked by the Ingress Administrator</strong>.</p>
</blockquote>
<p>It seems to me your issue related to <code>mod_security</code> + above blocklist, that contains <code>'</code> symbol.</p>
<p>For more details please check <a href="https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#annotation-value-word-blocklist" rel="nofollow noreferrer">https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#annotation-value-word-blocklist</a></p>
<p>In order to fix your issue you should either</p>
<ul>
<li>set the value of annotation-value-word-blocklist to an empty string &quot;&quot;</li>
</ul>
<p>or</p>
<ul>
<li>change the value of annotation-value-word-blocklist and remove <code>'</code> from its list.</li>
</ul>
