external auth - proxy_pass_request_body off + big bodies give 500/413

[olvesh]

This might be a config bug in ingress controller or a bug in Nginx.

I have annotated the ingress with:

    kubernetes.io/ingress.class: nginx
    kubernetes.io/tls-acme: "true"
    ingress.kubernetes.io/proxy-body-size: 100M

in order to upload some big project files to a new rundeck instance.

I get a 500 internal server error because the subrequest fails with client intended to send too large body

Even though the template for the part should not send bodies.

       location = /_external-auth-Lw {
            internal;
            set $proxy_upstream_name "internal";

            proxy_pass_request_body     off;
            proxy_set_header            Content-Length "";
            proxy_pass_request_headers  on;
            proxy_set_header            Host $host;
            proxy_ssl_server_name       on;

            set $target https://$host/oauth2/auth;
            proxy_pass $target;
        }

Logs for the incident:

2017/06/02 13:34:13 [error] 8357#8357: *195161 client intended to send too large body: 8964179 bytes, client: 127.0.0.1, server: rundeck.example.com, request: "POST /project/CI-env/importArchive HTTP/2.0", subrequest: "/_external-auth-Lw", host: "rundeck.example.com", referrer: "https://rundeck.example.com/project/CI-env/configure"
2017/06/02 13:34:13 [error] 8357#8357: *195161 auth request unexpected status: 413, client: 127.0.0.1, server: rundeck.example.com, request: "POST /project/CI-env/importArchive HTTP/2.0", host: "rundeck.example.com", referrer: "https://rundeck.example.com/project/CI-env/configure"