[Bug]: client-max-body-size Ignored When OIDC Policy Is Enabled

[bj0rn]

Version

edge

What Kubernetes platforms are you running on?

AKS Azure

Steps to reproduce

When using the client-max-body-size setting in a VirtualServer object in combination with an OIDC policy, the setting is ignored and the default limit of 1MB is applied instead. The restriction appears to originate from the following location https://github.com/nginx/kubernetes-ingress/blob/main/internal/configs/oidc/oidc.conf#L9

We are currently running the latest release of the ingress controller: v5.0.0

Steps to reproduce:

1. Create a VirtualServer object with client-max-body-size explicitly set.
2. Configure the server to use OIDC.
3. Send a request larger than 1MB.

Expected Result:
The request should be accepted if it is within the configured client-max-body-size.

Actual Result:
The request is rejected due to the default 1MB limit, indicating that the custom setting is not being applied.

[github-actions]

Hi @bj0rn thanks for reporting!

Be sure to check out the docs and the Contributing Guidelines while you wait for a human to take a look at this 🙂

Cheers!

[vepatel]

Hey @bj0rn can you please try setting client-max-body-size at http context using https://docs.nginx.com/nginx-ingress-controller/configuration/global-configuration/configmap-resource/#using-configmap instead of virtualServer and see if that works

[bj0rn]

@vepatel I'll look at it first thing on Monday

[bj0rn]

Setting the configuration globally works, but it's not an acceptable solution, as it allows all virtual servers connected to the shard to use large requests. We still need the ability to set client-max-body-size individually for each virtual server that requires support for larger requests than the default.

[vepatel]

@bj0rn we're using reference implementation of OIDC which is restricting the usability of client-max-body-size in oidc location, we'll be discussing this issue and will come back

[github-actions]

This issue is stale because it has been open 90 days with no activity. Remove stale label or comment or this will be closed in 10 days.