Ingress-nginx: Nginx fails to start: duplicate location "/_external-auth"

Created on 12 Nov 2020 · 3Comments · Source: kubernetes/ingress-nginx

NGINX Ingress controller version: v0.41.1

Kubernetes version (use kubectl version): v1.19.3

Environment:

Cloud provider or hardware configuration: On-prem cluster
OS (e.g. from /etc/os-release): Ubuntu 18.04.5 LTS
Kernel (e.g. uname -a): Linux n0211 5.4.0-52-generic #57~18.04.1-Ubuntu SMP Thu Oct 15 14:04:49 UTC 2020 x86_64 x86_64 x86_64 GNU/Linux
Install tools: kubeadm
Others: N/A

What happened:

When starting release v0.41.1, Nginx fails to start:

I1112 16:13:55.945585       6 nginx.go:291] "Starting NGINX process"
I1112 16:13:55.945776       6 leaderelection.go:243] attempting to acquire leader lease  ingress-nginx/ingress-controller-leader-nginx...
I1112 16:13:55.945985       6 nginx.go:311] "Starting validation webhook" address=":8443" certPath="/usr/local/certificates/cert" keyPath="/usr/local/certificates/key"
I1112 16:13:55.979425       6 controller.go:144] "Configuration changes detected, backend reload required"
I1112 16:13:55.996006       6 template.go:792] empty byte size, hence it will not be set
I1112 16:13:55.996384       6 template.go:792] empty byte size, hence it will not be set
I1112 16:13:55.996603       6 template.go:792] empty byte size, hence it will not be set
I1112 16:13:55.996798       6 template.go:792] empty byte size, hence it will not be set
I1112 16:13:55.996941       6 template.go:792] empty byte size, hence it will not be set
I1112 16:13:55.997126       6 template.go:792] empty byte size, hence it will not be set
I1112 16:13:55.997332       6 template.go:792] empty byte size, hence it will not be set
I1112 16:13:55.997539       6 template.go:792] empty byte size, hence it will not be set
I1112 16:13:55.997746       6 template.go:792] empty byte size, hence it will not be set
I1112 16:13:55.997899       6 template.go:792] empty byte size, hence it will not be set
I1112 16:13:55.998005       6 template.go:792] empty byte size, hence it will not be set
I1112 16:13:55.998153       6 template.go:792] empty byte size, hence it will not be set
I1112 16:13:55.998250       6 template.go:792] empty byte size, hence it will not be set
I1112 16:13:55.998489       6 template.go:792] empty byte size, hence it will not be set
I1112 16:13:55.998673       6 template.go:792] empty byte size, hence it will not be set
I1112 16:13:55.998819       6 template.go:792] empty byte size, hence it will not be set
I1112 16:13:55.998948       6 template.go:792] empty byte size, hence it will not be set
I1112 16:13:55.999131       6 template.go:792] empty byte size, hence it will not be set
I1112 16:13:55.999298       6 template.go:792] empty byte size, hence it will not be set
I1112 16:13:55.999422       6 template.go:792] empty byte size, hence it will not be set
I1112 16:13:55.999634       6 template.go:792] empty byte size, hence it will not be set
I1112 16:13:55.999814       6 template.go:792] empty byte size, hence it will not be set
I1112 16:13:56.000001       6 template.go:792] empty byte size, hence it will not be set
I1112 16:13:56.000236       6 template.go:792] empty byte size, hence it will not be set
I1112 16:13:56.000459       6 template.go:792] empty byte size, hence it will not be set
I1112 16:13:56.000687       6 template.go:792] empty byte size, hence it will not be set
I1112 16:13:56.000924       6 template.go:792] empty byte size, hence it will not be set
I1112 16:13:56.001232       6 template.go:792] empty byte size, hence it will not be set
I1112 16:13:56.001370       6 template.go:792] empty byte size, hence it will not be set
I1112 16:13:56.001537       6 template.go:792] empty byte size, hence it will not be set
I1112 16:13:56.001637       6 template.go:792] empty byte size, hence it will not be set
I1112 16:13:56.001802       6 template.go:792] empty byte size, hence it will not be set
I1112 16:13:56.001967       6 template.go:792] empty byte size, hence it will not be set
I1112 16:13:56.002492       6 template.go:792] empty byte size, hence it will not be set
I1112 16:13:56.002954       6 template.go:792] empty byte size, hence it will not be set
I1112 16:13:56.003194       6 template.go:792] empty byte size, hence it will not be set
I1112 16:13:56.004075       6 template.go:792] empty byte size, hence it will not be set
I1112 16:13:56.004546       6 template.go:792] empty byte size, hence it will not be set
I1112 16:13:56.004952       6 template.go:792] empty byte size, hence it will not be set
I1112 16:13:56.005328       6 template.go:792] empty byte size, hence it will not be set
I1112 16:13:56.005880       6 template.go:792] empty byte size, hence it will not be set
I1112 16:13:56.006411       6 template.go:792] empty byte size, hence it will not be set
I1112 16:13:56.006882       6 template.go:792] empty byte size, hence it will not be set
I1112 16:13:56.007284       6 template.go:792] empty byte size, hence it will not be set
I1112 16:13:56.007682       6 template.go:792] empty byte size, hence it will not be set
I1112 16:13:56.008049       6 template.go:792] empty byte size, hence it will not be set
I1112 16:13:56.008411       6 template.go:792] empty byte size, hence it will not be set
I1112 16:13:56.008771       6 template.go:792] empty byte size, hence it will not be set
E1112 16:13:56.142361       6 controller.go:156] Unexpected failure reloading the backend:

-------------------------------------------------------------------------------
Error: exit status 1
2020/11/12 16:13:56 [emerg] 38#38: duplicate location "/_external-auth-L3N0YXRzLw" in /tmp/nginx-cfg836695880:3282
nginx: [emerg] duplicate location "/_external-auth-L3N0YXRzLw" in /tmp/nginx-cfg836695880:3282
nginx: configuration file /tmp/nginx-cfg836695880 test failed

-------------------------------------------------------------------------------
E1112 16:13:56.142476       6 queue.go:130] "requeuing" err="\n-------------------------------------------------------------------------------\nError: exit status 1\n2020/11/12 16:13:56 [emerg] 38#38: duplicate location \"/_external-auth-L3N0YXRzLw\" in /tmp/nginx-cfg836695880:3282\nnginx: [emerg] duplicate location \"/_external-auth-L3N0YXRzLw\" in /tmp/nginx-cfg836695880:3282\nnginx: configuration file /tmp/nginx-cfg836695880 test failed\n\n-------------------------------------------------------------------------------\n" key="initial-sync"
I1112 16:13:56.142583       6 event.go:282] Event(v1.ObjectReference{Kind:"Pod", Namespace:"ingress-nginx", Name:"ingress-nginx-controller-686bf85544-fz9th", UID:"6a13eb38-4917-40bd-92f9-57b54e3d38e7", APIVersion:"v1", ResourceVersion:"128756489", FieldPath:""}): type: 'Warning' reason: 'RELOAD' Error reloading NGINX: 
-------------------------------------------------------------------------------
Error: exit status 1
2020/11/12 16:13:56 [emerg] 38#38: duplicate location "/_external-auth-L3N0YXRzLw" in /tmp/nginx-cfg836695880:3282
nginx: [emerg] duplicate location "/_external-auth-L3N0YXRzLw" in /tmp/nginx-cfg836695880:3282
nginx: configuration file /tmp/nginx-cfg836695880 test failed

-------------------------------------------------------------------------------
I1112 16:13:56.309738       6 status.go:84] "New leader elected" identity="ingress-nginx-controller-84f7dc4ff7-7sf8n"
I1112 16:13:59.306645       6 controller.go:144] "Configuration changes detected, backend reload required"

Maybe this is an issue with nginx.ingress.kubernetes.io/auth-signin and nginx.ingress.kubernetes.io/auth-url.

What you expected to happen:

Ingress Controller should start as usual.

How to reproduce it: Note sure. We have these annotations in many Ingresses:

    nginx.ingress.kubernetes.io/auth-signin: https://$host/oauth2/start?rd=$escaped_request_uri
    nginx.ingress.kubernetes.io/auth-url: http://oauth2-proxy.default.svc.k8s.domain.company.com/oauth2/auth

Anything else we need to know:

No issues with v0.40.2 and v0.41.0 (but path matching issue with v0.41.0, so I cannot use it).

/kind bug

kinbug

Source