How to remove ingress annotation using Kustomize

Question

In the Base Ingress file I have added the following annotation nginx.ingress.kubernetes.io/auth-snippet and it needs to be removed in one of the environment.

Base Ingress:

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: ingress
  annotations:
     nginx.ingress.kubernetes.io/auth-snippet: test

I created a ingress-patch.yml in overlays and added the below

- op: remove
  path: /metadata/annotations/nginx.ingress.kubernetes.io/auth-snippet

But it gives the below error when executing Kustomize Build

Error: remove operation does not apply: doc is missing path: "/metadata/annotations/nginx.ingress.kubernetes.io/auth-snippet": missing value

Answer 1

The path /metadata/annotations/nginx.ingress.kubernetes.io/auth-snippet doesn't work because / is the character that JSONPath uses to separate elements in the document; there's no way for a JSONPath parser to know that the / in nginx.ingress.kubernetes.io/auth-snippet means something different from the / in /metadata/annotations.

The JSON Pointer RFC (which is the syntax used to specify the path component of a patch) tells us that we need to escape / characters using ~1. If we have the following in ingress.yaml:

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: ingress
  annotations:
    example-annotation: foo
    nginx.ingress.kubernetes.io/auth-snippet: test

And write our kustomization.yaml like this:

apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ingress.yaml

patches:
  - target:
      kind: Ingress
      name: ingress
    patch: |
      - op: remove
        path: /metadata/annotations/nginx.ingress.kubernetes.io~1auth-snippet

Then the output of kustomize build is:

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    example-annotation: foo
  name: ingress