<p>I am new to kubernetes and using AWS EKS cluster 1.21. I am trying to write the nginx ingress config for my k8s cluster and blocking some request using <strong>server-snippet</strong>. My ingress config is below</p>
<pre><code>apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: abc-ingress-external
  namespace: backend
  annotations:
    nginx.ingress.kubernetes.io/rewrite-target: /
    kubernetes.io/ingress.class: nginx-external
    nginx.ingress.kubernetes.io/server-snippet: |
       location = /ping {
         deny all;
         return 403;
       }
spec:
  rules:
  - host: dev-abc.example.com
    http:
      paths:
      - backend:
          service:
              name: miller
              port:
                number: 80
        path: /
        pathType: Prefix
</code></pre>
<p>When I apply this config, I get this error:</p>
<pre><code>for: &quot;ingress.yml&quot;: admission webhook &quot;validate.nginx.ingress.kubernetes.io&quot; denied the request: nginx.ingress.kubernetes.io/server-snippet annotation contains invalid word location
</code></pre>
<p>I looked into this and got this is something related to <em><strong>annotation-value-word-blocklist</strong></em>. However i don't know how to resolve this. Any help would be appreciated.</p>

Rahul Kumar Aggarwal
<p>Seems there's <a href="https://github.com/kubernetes/ingress-nginx/issues/5738#issuecomment-971799464" rel="nofollow noreferrer">issue</a> using <code>location</code> with some versions. The following was tested successfully on EKS cluster.</p>
<p>Install basic ingress-nginx on EKS:</p>
<p><code>kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.1.0/deploy/static/provider/aws/deploy.yaml</code></p>
<p><strong>Note:</strong> If your cluster version is &lt; 1.21, you need to comment out <code>ipFamilyPolicy</code> and <code>ipFamilies</code> in the service spec.</p>
<p>Run a http service:</p>
<p><code>kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/main/docs/examples/http-svc.yaml</code></p>
<p>Create an ingress for the service:</p>
<pre><code>apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: http-svc
  annotations:
    kubernetes.io/ingress.class: nginx
    nginx.ingress.kubernetes.io/server-snippet: |
       location = /ping {
         deny all;
         return 403;
       }
spec:
  rules:
  - host: test.domain.com
    http:
      paths:
      - path: /
        pathType: ImplementationSpecific
        backend:
          service:
            name: http-svc
            port:
              number: 8080
</code></pre>
<p>Return 200 as expected:
<code>curl -H 'HOST: test.domain.com' http://&lt;get your nlb address from the console&gt;</code></p>
<p>Return 200 as expected:
<code>curl -H 'HOST: test.domain.com' -k https://&lt;get your nlb address from the console&gt;</code></p>
<p>Return 403 as expected, the snippet is working:
<code>curl -H 'HOST: test.domain.com' -k https://&lt;get your nlb address from the console&gt;/ping</code></p>
<p><a href="https://i.stack.imgur.com/n8BRc.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/n8BRc.png" alt="enter image description here" /></a></p>
<p>Use the latest release to avoid the &quot;annotation contains invalid word location&quot; issue.</p>
