Ingress-nginx-v-1.12.2- 400 issue

[gokulapandi-idevopz]

Hi,

My EKS version is : 1.32.

"I have updated to ingress-nginx version 1.12.2 and am currently facing a 400 error issue with my application.
I have also updated the ConfigMap, Ingress rules, and Service configuration (shared below). Can someone help me identify and fix the issue?"

apiVersion: v1
data:
enable-snippets: "true"
allow-snippet-annotations: "true"
annotations-risk-level: Critical
http-snippet: |
server {
listen 80;
listen [::]:80;
listen 443 ssl proxy_protocol;
listen [::]:443 ssl proxy_protocol;
##listen 2443;
if ($scheme = http) {
return 308 https://$host$request_uri;
}
}
ssl-redirect: "true"
force-ssl-redirect: "true"
proxy-body-size: 20m
use-forwarded-headers: "true"
##use-http2: "true"
use-proxy-protocol: "true"
proxy-real-ip-cidr: "172.16.0.0/16"
kind: ConfigMap
metadata:
labels:
app.kubernetes.io/component: controller
app.kubernetes.io/instance: ingress-nginx
app.kubernetes.io/name: ingress-nginx
app.kubernetes.io/part-of: ingress-nginx
app.kubernetes.io/version: 1.12.2
name: ingress-nginx-controller
namespace: ingress-nginx

apiVersion: v1
kind: Service
metadata:
annotations:
service.beta.kubernetes.io/aws-load-balancer-backend-protocol: tcp
service.beta.kubernetes.io/aws-load-balancer-cross-zone-load-balancing-enabled: "true"
service.beta.kubernetes.io/aws-load-balancer-type: nlb
service.beta.kubernetes.io/aws-load-balancer-type: "external"
service.beta.kubernetes.io/aws-load-balancer-nlb-target-type: "instance"
service.beta.kubernetes.io/aws-load-balancer-scheme: "internet-facing"
service.beta.kubernetes.io/aws-load-balancer-ssl-cert: arn:aws:acm:eu-north-1:xxxxxxxxxxxxxx:certificate/xxxxxxxxxxxxxxxxxxxx
service.beta.kubernetes.io/aws-load-balancer-ssl-ports: https
service.beta.kubernetes.io/aws-load-balancer-connection-idle-timeout: "60"
service.beta.kubernetes.io/aws-load-balancer-proxy-protocol: "*"
labels:
app.kubernetes.io/component: controller
app.kubernetes.io/instance: ingress-nginx
app.kubernetes.io/name: ingress-nginx
app.kubernetes.io/part-of: ingress-nginx
app.kubernetes.io/version: 1.12.2
name: ingress-nginx-controller
namespace: ingress-nginx
spec:
externalTrafficPolicy: Local
ipFamilies:

• IPv4
  ipFamilyPolicy: SingleStack
  ports:
• appProtocol: http
  name: http
  port: 80
  protocol: TCP
  targetPort: http
• appProtocol: https
  name: https
  port: 443
  protocol: TCP
  targetPort: https
  selector:
  app.kubernetes.io/component: controller
  app.kubernetes.io/instance: ingress-nginx
  app.kubernetes.io/name: ingress-nginx
  type: LoadBalancer

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: beta-nlb
namespace: beta
annotations:
nginx.ingress.kubernetes.io/proxy-connect-timeout: "300"
nginx.ingress.kubernetes.io/proxy-send-timeout: "86400"
nginx.ingress.kubernetes.io/proxy-read-timeout: "86400"
nginx.ingress.kubernetes.io/affinity: "cookie"
nginx.ingress.kubernetes.io/affinity-mode: "persistent"
spec:
ingressClassName: nginx
rules:

• host:
  http:
  paths:
  • path: /
    pathType: Prefix
    backend:
    service:
    name: beta-176
    port:
    number: 80

15.158.30.110 - - [30/May/2025:15:04:57 +0000] "GET /zhealth HTTP/1.1" 400 248 "-" "Blackbox Exporter/0.24.0" 284 0.000 [] [] - - - - 00c825e0bf6d25d93e9015077aa2466f
15.158.30.110 - - [30/May/2025:15:05:42 +0000] "GET /zhealth HTTP/1.1" 400 248 "-" "Blackbox Exporter/0.24.0" 284 0.000 [] [] - - - - 245df0b8b661f92cab113c62cbe0595e
15.158.30.110 - - [30/May/2025:15:06:42 +0000] "GET /zhealth HTTP/1.1" 400 248 "-" "Blackbox Exporter/0.24.0" 284 0.000 [] [] - - - - daceb903f80bee6d2fc68030ebdd0e1c
15.158.30.110 - - [30/May/2025:15:07:42 +0000] "GET /zhealth HTTP/1.1" 400 248 "-" "Blackbox Exporter/0.24.0" 284 0.000 [] [] - - - - 89c1efbc92ee8c004a6277dee9efa388
15.158.30.110 - - [30/May/2025:15:07:57 +0000] "GET /zhealth HTTP/1.1" 400 248 "-" "Blackbox Exporter/0.24.0" 284 0.000 [] [] - - - - 49dd195295a45275a1ea0f706fd95917
15.158.30.115 - - [30/May/2025:15:08:27 +0000] "GET /zhealth HTTP/1.1" 400 248 "-" "Blackbox Exporter/0.24.0" 284 0.000 [] [] - - - - 58cc993d28e440ade0450b79064e0e0a
106.51.50.236 - - [30/May/2025:15:08:42 +0000] "GET /favicon.ico HTTP/1.1" 400 650 "https://xxxxxxxxxxx.no/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 Edg/136.0.0.0" 612 0.000 [] [] - - - - a7bb916108bb1d698e2a25b3ecc6b765

[k8s-ci-robot]

This issue is currently awaiting triage.

If Ingress contributors determines this is a relevant issue, they will accept it by applying the triage/accepted label and provide further guidance.

The triage/accepted label can be added by org members by writing /triage accepted in a comment.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[Gacko]

This is because your AWS Load Balancer is doing off-loading (accepting HTTPS, but forwarding as plain HTTP) to the HTTPS port. I doubt this has something to do with the upgrade to v1.12.2. Have you tried setting aws-load-balancer-backend-protocol to ssl?

[k8s-ci-robot]

@Nandhu910: The label triage/accepted cannot be applied. Only GitHub organization members can add the label.

In response to this:

We’re experiencing consistent HTTP 400 responses when probing our NGINX Ingress /zhealth endpoint using Blackbox Exporter (User-Agent: Blackbox Exporter/0.24.0). Direct curl requests work fine and return 200 OK, so this seems to happen only when accessed via Blackbox Exporter.

We've verified:

• The Ingress resource is correctly defined and routes to a healthy backend.
• The application responds properly to curl and browser requests.
• Only Blackbox probes (without headers) return 400.

This could be related to how Ingress handles minimal HTTP requests from the Blackbox probe, possibly due to missing Host headers or routing logic.

We'd appreciate it if someone from the team could help confirm whether this is a bug or expected behavior.

Thank you in advance!

/triage accepted

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[Nandhu910]

We’re experiencing consistent HTTP 400 responses when probing our NGINX Ingress /zhealth endpoint using Blackbox Exporter (User-Agent: Blackbox Exporter/0.24.0). Direct curl requests work fine and return 200 OK,

We've verified:

• The Ingress resource is correctly defined and routes to a healthy backend.
• The application responds properly to curl and browser requests.
• Only Blackbox probes (without headers) return 400.

This could be related to how Ingress handles minimal HTTP requests from the Blackbox probe, possibly due to missing Host headers or routing logic.

We'd appreciate it if someone from the team could help confirm whether this is a bug or expected behavior.

Thank you in advance!

[longwuyuan]

/remove-kind bug
If you answer the questions that are asked in a new bug report template, then it is possible that you will post info that relates to the problem. Also, if you fix the markdown formatting, then others can read the data better.

Right now, its not easy to tell how you installed.

/kind support