fcgi annotation error incorrect interpretation of PHP_VALUE

[jidckii]

What happened:

I updated the controller using helm from version 4.7.2 (controller-v1.8.2) to the latest version helm 4.12.1 (controller-v1.12.1)
After that, the ingress resource stopped deploying with the error "ingress contains invalid annotation value" err="annotation fastcgi-params-configmap contains invalid value". This also repeats on version helm 4.11.5 (controller-v1.11.5).

here is the complete error:

E0408 12:59:44.682718       7 main.go:149] "fcgi annotation error" err="fcgi contains invalid key or value" configmap="jidckii-test-api" namespace="dev-sdelka-api" key="PHP_VALUE" value=<
        upload_max_filesize=100M
        post_max_size=100M
        memory_limit=256M'
 >
E0408 12:59:44.682747       7 annotations.go:196] "ingress contains invalid annotation value" err="annotation fastcgi-params-configmap contains invalid value"

I didn't change the specs and it worked before.

configmap itself looked like this:

$ kubectl get -n dev-sdelka-api -o yaml  configmap/jidckii-test-api
apiVersion: v1
data:
  PHP_VALUE: |-
    upload_max_filesize=100M
    post_max_size=100M
    memory_limit=256M
kind: ConfigMap

Full example of resources

---
apiVersion: v1
kind: ConfigMap
metadata:
  name: jidckii-test-api
  labels:
    app.kubernetes.io/name: api
    app.kubernetes.io/instance: jidckii-test
data:
  PHP_VALUE: |-
    upload_max_filesize=100M
    post_max_size=100M
    memory_limit=256M

---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: jidckii-test-api
  labels:
    app.kubernetes.io/name: api
    app.kubernetes.io/instance: jidckii-test
  annotations:
    nginx.ingress.kubernetes.io/fastcgi-params-configmap: "jidckii-test-api"
spec:
  tls:
    - hosts:
        - "dev.example.com"
  rules:
    - host: "dev.example.com""
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: jidckii-test-api
                port:
                  number: 9000

I tried to reduce it to one line but started getting a different error:

Full example of resources

---
apiVersion: v1
kind: ConfigMap
metadata:
  name: jidckii-test-api
  labels:
    app.kubernetes.io/name: api
    app.kubernetes.io/instance: jidckii-test
data:
  PHP_VALUE: 'upload_max_filesize=100M\npost_max_size=100M\nmemory_limit=256M'

---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: jidckii-test-api
  labels:
    app.kubernetes.io/name: api
    app.kubernetes.io/instance: jidckii-test
  annotations:
    nginx.ingress.kubernetes.io/fastcgi-params-configmap: "jidckii-test-api"
spec:
  tls:
    - hosts:
        - "dev.example.com"
  rules:
    - host: "dev.example.com""
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: jidckii-test-api
                port:
                  number: 9000

configmap itself looked like this:

$ kubectl get -n dev-sdelka-api -o yaml  configmap/jidckii-test-api
apiVersion: v1
data:
  PHP_VALUE: upload_max_filesize=100M\npost_max_size=100M\nmemory_limit=256M
kind: ConfigMap

E0408 13:00:45.356945       7 main.go:149] "fcgi annotation error" err="fcgi contains invalid key or value" configmap="jidckii-test-api" namespace="dev-sdelka-api" key="PHP_VALUE" value="upload_max_filesize=100M\\npost_max_size=100M\\nmemory_limit=256M"
E0408 13:00:45.357039       7 annotations.go:196] "ingress contains invalid annotation value" err="annotation fastcgi-params-configmap contains invalid value"
E0408 13:00:45.357420       7 main.go:96] "invalid ingress configuration" err="annotation fastcgi-params-configmap contains invalid value" ingress="dev-sdelka-api/jidckii-test-api"

As you can see, for some reason when passing to the controller \n is replaced by \\n and apparently this breaks the validation.

Well, I can't go back to the earlier version due to vulnerabilities, but I can't work on the new one either. Can anyone tell me if this is a bug or if I can somehow make the correct configuration?

[longwuyuan]

You are aware that work was done on validations and so the parsing here seems to have got impacted.

I think you can try to play with the syntax of the configMap line but there are no resources to debug this so expect delay in any useful update.

Just FYI, because of lack of resources to support/maintain, there is also a long-term intention to remove the fcgi support.
/triage accepted

[Gacko]

If I understand the current validation correctly, it is not meant to support defining an .ini file format, but only key-value pairs for setting environment variables for FastCGI. Therefore you'll probably need to disable the annotation validation, which got enabled by default in v1.12.

[Gacko]

FYI, this is the validation code:

ingress-nginx/internal/ingress/annotations/fastcgi/main.go

Lines 147 to 152 in 387b459

	for k, v := range cmap.Data {
	if !regexValidIndexAnnotationAndKey.MatchString(k) || !validFCGIValue.MatchString(v) {
	klog.ErrorS(fmt.Errorf("fcgi contains invalid key or value"), "fcgi annotation error", "configmap", cmap.Name, "namespace", cmap.Namespace, "key", k, "value", v)
	return fcgiConfig, ing_errors.NewValidationError(fastCGIParamsAnnotation)
	}
	}