<p>I've been trying to connect to my websocket endpoint over https at <code>wss://api.mywebsite.com/ws/chat</code> from my frontend client.</p>
<p>I can't seem to figure out the correct NGINX configuration for my ingress on kubernetes to allow a connection. Currently the controller keeps logging a <code>426 needs upgrade</code> everytime I try to connect to the endpoint.</p>
<p>This is my current ingress:</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  name: ingress-service
  annotations:
    kubernetes.io/ingress.class: nginx
    nginx.ingress.kubernetes.io/use-regex: &quot;true&quot;
    cert-manager.io/cluster-issuer: &quot;letsencrypt-prod&quot;
    nginx.ingress.kubernetes.io/secure-backends: &quot;true&quot;
    nginx.ingress.kubernetes.io/proxy-read-timeout: &quot;3600&quot;
    nginx.ingress.kubernetes.io/proxy-send-timeout: &quot;3600&quot;
    nginx.ingress.kubernetes.io/ssl-redirect: &quot;true&quot;
    nginx.ingress.kubernetes.io/server-snippets: |
      location /ws {
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection &quot;Upgrade&quot;;
        proxy_set_header Proxy &quot;&quot;;
        proxy_set_header Host $http_host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_pass http://ws;
      }

spec:
  tls:
    - hosts:
        - mywebsite.com
        - api.mywebsite.com
      secretName: mywebsite-com
  rules:
    - host: api.mywebsite.com
      http:
        paths:
          - path: /
            backend:
              serviceName: gateway-cluster-ip-service
              servicePort: 5000
          - path: /ws/*
            backend:
              serviceName: gateway-cluster-ip-service
              servicePort: 5000
    - host: mywebsite.com
      http:
        paths:
          - path: /
            backend:
              serviceName: gateway-cluster-ip-service
              servicePort: 5000

</code></pre>

Adrian Coutsoftides
<p>The solution was to add the following annotation (as found <a href="https://pumpingco.de/blog/using-signalr-in-kubernetes-behind-nginx-ingress/" rel="nofollow noreferrer">here</a>): <code>nginx.org/websocket-services: &quot;gateway-cluster-ip-service&quot;</code></p>
<p>resulting in:</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  name: ingress-service
  annotations:
    kubernetes.io/ingress.class: nginx
    nginx.ingress.kubernetes.io/use-regex: &quot;true&quot;
    cert-manager.io/cluster-issuer: &quot;letsencrypt-prod&quot;
    nginx.ingress.kubernetes.io/rewrite-target: /
    nginx.org/websocket-services: &quot;gateway-cluster-ip-service&quot;
    nginx.ingress.kubernetes.io/affinity: cookie
    nginx.ingress.kubernetes.io/secure-backends: &quot;true&quot;
    nginx.ingress.kubernetes.io/proxy-read-timeout: &quot;3600&quot;
    nginx.ingress.kubernetes.io/proxy-send-timeout: &quot;3600&quot;
    nginx.ingress.kubernetes.io/ssl-redirect: &quot;true&quot;
spec:
    ...
</code></pre>
