Implement annotation validation #9673

rikatz · 2023-02-27T00:54:58Z

What this PR does / why we need it:

This is the initial work on getting a better sanitization on all annotations.

It changes the checkAnnotation string to get some AnnotationConfig and fields, and receives a validation function for each annotation.

It also enforces the existence of the functions. Also, adds some documentations and risks that will be used later for automated documentation

TODO:

Do this for all annotations
Create a verify job to check if all annotations has proper validators, otherwise it should not be merged

Types of changes

Bug fix (non-breaking change which fixes an issue)
New feature (non-breaking change which adds functionality)
CVE Report (Scanner found CVE and adding report)
Breaking change (fix or feature that would cause existing functionality to change)
Documentation only

Which issue/s this PR fixes

How Has This Been Tested?

Checklist:

My change requires a change to the documentation.
I have updated the documentation accordingly.
I've read the CONTRIBUTION guide
I have added unit and/or e2e tests to cover my changes.
All new and existing tests passed.
Added Release Notes.

Does my pull request need a release note?

Any user-visible or operator-visible change qualifies for a release note. This could be a:

CLI change
API change
UI change
configuration schema change
behavioral change
change in non-functional attributes such as efficiency or availability, availability of a new platform
a warning about a deprecation
fix of a previous Known Issue
fix of a vulnerability (CVE)

No release notes are required for changes to the following:

Tests
Build infrastructure
Fixes for unreleased bugs

For more tips on writing good release notes, check out the Release Notes Handbook

All annotations has its own validation now and enforces this validations.

k8s-ci-robot · 2023-02-27T00:54:59Z

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

k8s-ci-robot · 2023-02-27T00:55:05Z

This issue is currently awaiting triage.

If Ingress contributors determines this is a relevant issue, they will accept it by applying the triage/accepted label and provide further guidance.

The triage/accepted label can be added by org members by writing /triage accepted in a comment.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

rikatz · 2023-06-12T14:49:53Z

Summarizing 20 Failures:
  [FAIL] [Annotations] proxy-* [It] should build proxy next upstream
  /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:249
  [FAIL] [Annotations] proxy-ssl-* [It] should set valid proxy-ssl-secret, proxy-ssl-ciphers to HIGH:!AES
  /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:249
  [FAIL] [Annotations] cors-* [It] should not match
  /go/src/k8s.io/ingress-nginx/test/e2e/framework/httpexpect/reporter.go:47
  [FAIL] [Annotations] cors-* [It] should allow - single origin for multiple cors values
  /go/src/k8s.io/ingress-nginx/test/e2e/framework/httpexpect/reporter.go:47
  [FAIL] [Annotations] cors-* [It] should allow - matching origin with wildcard origin (2 subdomains)
  /go/src/k8s.io/ingress-nginx/test/e2e/framework/httpexpect/reporter.go:47
  [FAIL] [Setting] [Security] global-auth-url when global external authentication is configured [It] should return status code 200 when request whitelisted (via ingress annotation) service and 401 when request protected service
  /go/src/k8s.io/ingress-nginx/test/e2e/framework/httpexpect/reporter.go:47
  [FAIL] [Annotations] cors-* [It] should not allow - unmatching origin with wildcard origin (2 subdomains)
  /go/src/k8s.io/ingress-nginx/test/e2e/framework/httpexpect/reporter.go:47
  [FAIL] [Annotations] cors-* [It] should not allow - single origin for multiple cors values
  /go/src/k8s.io/ingress-nginx/test/e2e/framework/httpexpect/reporter.go:47
  [FAIL] [Annotations] cors-* [It] should allow - matching origin+port with wildcard origin
  /go/src/k8s.io/ingress-nginx/test/e2e/framework/httpexpect/reporter.go:47
  [FAIL] [Annotations] auth-tls-* [It] should return 200 using auth-tls-match-cn where atleast one of the regex options matches CN from client
  /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:249
  [FAIL] [Annotations] cors-* [It] should allow correct origins - missing subdomain + origin with wildcard origin and correct origin
  /go/src/k8s.io/ingress-nginx/test/e2e/framework/httpexpect/reporter.go:47
  [FAIL] [Annotations] cors-* [It] should allow - single origin with required port
  /go/src/k8s.io/ingress-nginx/test/e2e/framework/httpexpect/reporter.go:47
  [FAIL] [Annotations] cors-* [It] should allow correct origins - single origin for multiple cors values
  /go/src/k8s.io/ingress-nginx/test/e2e/framework/httpexpect/reporter.go:47
  [FAIL] [Annotations] annotation-global-rate-limit [It] generates correct configuration
  /go/src/k8s.io/ingress-nginx/test/e2e/annotations/globalratelimit.go:79
  [FAIL] [Annotations] cors-* [It] should not allow - single origin without port and origin with required port
  /go/src/k8s.io/ingress-nginx/test/e2e/framework/httpexpect/reporter.go:47
  [FAIL] [Annotations] proxy-* [It] should setup proxy cookies
  /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:249
  [FAIL] [Annotations] backend-protocol - GRPC [It] authorization metadata should be overwritten by external auth response headers
  /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:249
  [FAIL] [Annotations] cors-* [It] should not allow - single origin with port and origin without port
  /go/src/k8s.io/ingress-nginx/test/e2e/framework/httpexpect/reporter.go:47
  [FAIL] [Annotations] custom-http-errors [It] configures Nginx correctly
  /go/src/k8s.io/ingress-nginx/test/e2e/framework/framework.go:249
  [FAIL] [Annotations] cors-* [It] should not allow - portless origin with wildcard origin
  /go/src/k8s.io/ingress-nginx/test/e2e/framework/httpexpect/reporter.go:47

Ran 418 of 424 Specs in 2708.255 seconds
FAIL! -- 398 Passed | 20 Failed | 0 Pending | 6 Skipped

Not that bad :D

tao12345666333

I still haven't finished all 😅

internal/ingress/annotations/alias/main_test.go

internal/ingress/annotations/annotations.go

rikatz · 2023-06-12T21:33:14Z

Summarizing 2 Failures:
  [FAIL] [Setting] [Security] global-auth-url when global external authentication is configured [It] should return status code 200 when request whitelisted (via ingress annotation) service and 401 when request protected service
  /go/src/k8s.io/ingress-nginx/test/e2e/framework/httpexpect/reporter.go:47

Ran 418 of 424 Specs in 2669.888 seconds
FAIL! -- 412 Passed | 2 Failed | 0 Pending | 6 Skipped

internal/ingress/annotations/parser/validators.go

tao12345666333

LGTM

internal/ingress/annotations/parser/validators.go

strongjz · 2023-07-20T15:39:06Z

/cherry-pick release-1.9

k8s-infra-cherrypick-robot · 2023-07-20T15:39:08Z

@strongjz: once the present PR merges, I will cherry-pick it on top of release-1.9 in a new PR and assign it to you.

In response to this:

/cherry-pick release-1.9

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

tao12345666333

/ok-to-test
/lgtm

k8s-ci-robot · 2023-07-22T03:30:24Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: rikatz, tao12345666333

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [rikatz,tao12345666333]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

k8s-infra-cherrypick-robot · 2023-07-22T03:32:49Z

@strongjz: new pull request created: #10236

In response to this:

/cherry-pick release-1.9

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

strongjz · 2023-09-12T11:21:22Z

/cherry-pick release-1.9

k8s-infra-cherrypick-robot · 2023-09-12T11:22:21Z

@strongjz: #9673 failed to apply on top of branch "release-1.9":

Applying: Add validation to all annotations
Using index info to reconstruct a base tree...
M	internal/ingress/annotations/alias/main.go
M	internal/ingress/annotations/alias/main_test.go
M	internal/ingress/annotations/annotations.go
M	internal/ingress/annotations/annotations_test.go
M	internal/ingress/annotations/auth/main.go
M	internal/ingress/annotations/auth/main_test.go
M	internal/ingress/annotations/authreq/main.go
M	internal/ingress/annotations/authreq/main_test.go
M	internal/ingress/annotations/authreqglobal/main.go
M	internal/ingress/annotations/authtls/main.go
M	internal/ingress/annotations/authtls/main_test.go
M	internal/ingress/annotations/backendprotocol/main.go
M	internal/ingress/annotations/backendprotocol/main_test.go
M	internal/ingress/annotations/canary/main.go
M	internal/ingress/annotations/clientbodybuffersize/main.go
M	internal/ingress/annotations/clientbodybuffersize/main_test.go
M	internal/ingress/annotations/connection/main.go
M	internal/ingress/annotations/connection/main_test.go
M	internal/ingress/annotations/cors/main.go
M	internal/ingress/annotations/cors/main_test.go
M	internal/ingress/annotations/customhttperrors/main.go
M	internal/ingress/annotations/defaultbackend/main.go
M	internal/ingress/annotations/defaultbackend/main_test.go
M	internal/ingress/annotations/globalratelimit/main.go
M	internal/ingress/annotations/globalratelimit/main_test.go
M	internal/ingress/annotations/http2pushpreload/main.go
M	internal/ingress/annotations/http2pushpreload/main_test.go
M	internal/ingress/annotations/ipdenylist/main.go
M	internal/ingress/annotations/ipdenylist/main_test.go
A	internal/ingress/annotations/ipwhitelist/main.go
A	internal/ingress/annotations/ipwhitelist/main_test.go
M	internal/ingress/annotations/loadbalancing/main.go
M	internal/ingress/annotations/loadbalancing/main_test.go
M	internal/ingress/annotations/log/main.go
M	internal/ingress/annotations/log/main_test.go
M	internal/ingress/annotations/mirror/main.go
M	internal/ingress/annotations/mirror/main_test.go
M	internal/ingress/annotations/modsecurity/main.go
M	internal/ingress/annotations/opentelemetry/main.go
M	internal/ingress/annotations/opentelemetry/main_test.go
M	internal/ingress/annotations/opentracing/main.go
M	internal/ingress/annotations/opentracing/main_test.go
M	internal/ingress/annotations/parser/main.go
M	internal/ingress/annotations/parser/main_test.go
M	internal/ingress/annotations/portinredirect/main.go
M	internal/ingress/annotations/portinredirect/main_test.go
M	internal/ingress/annotations/proxy/main.go
M	internal/ingress/annotations/proxy/main_test.go
M	internal/ingress/annotations/proxyssl/main.go
M	internal/ingress/annotations/proxyssl/main_test.go
M	internal/ingress/annotations/ratelimit/main.go
M	internal/ingress/annotations/ratelimit/main_test.go
M	internal/ingress/annotations/redirect/redirect.go
M	internal/ingress/annotations/redirect/redirect_test.go
M	internal/ingress/annotations/rewrite/main.go
M	internal/ingress/annotations/rewrite/main_test.go
M	internal/ingress/annotations/satisfy/main.go
M	internal/ingress/annotations/satisfy/main_test.go
M	internal/ingress/annotations/serversnippet/main.go
M	internal/ingress/annotations/serversnippet/main_test.go
M	internal/ingress/annotations/serviceupstream/main.go
M	internal/ingress/annotations/serviceupstream/main_test.go
M	internal/ingress/annotations/sessionaffinity/main.go
M	internal/ingress/annotations/snippet/main.go
M	internal/ingress/annotations/snippet/main_test.go
M	internal/ingress/annotations/sslcipher/main.go
M	internal/ingress/annotations/sslcipher/main_test.go
M	internal/ingress/annotations/sslpassthrough/main.go
M	internal/ingress/annotations/sslpassthrough/main_test.go
M	internal/ingress/annotations/streamsnippet/main.go
M	internal/ingress/annotations/streamsnippet/main_test.go
M	internal/ingress/annotations/upstreamhashby/main.go
M	internal/ingress/annotations/upstreamhashby/main_test.go
M	internal/ingress/annotations/upstreamvhost/main.go
M	internal/ingress/annotations/upstreamvhost/main_test.go
M	internal/ingress/annotations/xforwardedprefix/main.go
M	internal/ingress/annotations/xforwardedprefix/main_test.go
M	internal/ingress/controller/controller.go
M	internal/ingress/controller/controller_test.go.git/rebase-apply/patch:117: trailing whitespace.
			Documentation: `this annotation can be used to define additional server 
.git/rebase-apply/patch:732: trailing whitespace.
			Documentation: `This annotation enables setting a cookie returned by auth request. 
.git/rebase-apply/patch:1337: trailing whitespace.
			Documentation: `this annotation can be used to define which protocol should 
.git/rebase-apply/patch:1467: trailing whitespace.
			Documentation: `This annotation defines the header value to match for notifying the Ingress to route the request to the service specified in the Canary Ingress. 
.git/rebase-apply/patch:1468: trailing whitespace.
			When the request header is set to this value, it will be routed to the canary. For any other header value, the header will be ignored and the request compared against the other canary rules by precedence. 
warning: squelched 34 whitespace errors
warning: 39 lines add whitespace errors.

M	internal/ingress/controller/store/store.go
M	internal/ingress/controller/store/store_test.go
M	internal/ingress/errors/errors.go
M	pkg/apis/ingress/types.go
M	pkg/apis/ingress/types_equals.go
M	rootfs/etc/nginx/template/nginx.tmpl
A	test/e2e/annotations/ipwhitelist.go
Falling back to patching base and 3-way merge...
Auto-merging test/e2e/annotations/ipallowlist.go
Auto-merging rootfs/etc/nginx/template/nginx.tmpl
Auto-merging pkg/apis/ingress/types_equals.go
Auto-merging pkg/apis/ingress/types.go
Auto-merging internal/ingress/errors/errors.go
CONFLICT (content): Merge conflict in internal/ingress/errors/errors.go
Auto-merging internal/ingress/controller/store/store_test.go
CONFLICT (content): Merge conflict in internal/ingress/controller/store/store_test.go
Auto-merging internal/ingress/controller/store/store.go
CONFLICT (content): Merge conflict in internal/ingress/controller/store/store.go
Auto-merging internal/ingress/controller/controller_test.go
Auto-merging internal/ingress/controller/controller.go
CONFLICT (content): Merge conflict in internal/ingress/controller/controller.go
Auto-merging internal/ingress/annotations/xforwardedprefix/main_test.go
Auto-merging internal/ingress/annotations/xforwardedprefix/main.go
CONFLICT (content): Merge conflict in internal/ingress/annotations/xforwardedprefix/main.go
Auto-merging internal/ingress/annotations/upstreamvhost/main.go
CONFLICT (content): Merge conflict in internal/ingress/annotations/upstreamvhost/main.go
Auto-merging internal/ingress/annotations/upstreamhashby/main.go
CONFLICT (content): Merge conflict in internal/ingress/annotations/upstreamhashby/main.go
Auto-merging internal/ingress/annotations/streamsnippet/main_test.go
Auto-merging internal/ingress/annotations/streamsnippet/main.go
CONFLICT (content): Merge conflict in internal/ingress/annotations/streamsnippet/main.go
Auto-merging internal/ingress/annotations/sslpassthrough/main.go
CONFLICT (content): Merge conflict in internal/ingress/annotations/sslpassthrough/main.go
Auto-merging internal/ingress/annotations/sslcipher/main_test.go
CONFLICT (content): Merge conflict in internal/ingress/annotations/sslcipher/main_test.go
Auto-merging internal/ingress/annotations/sslcipher/main.go
CONFLICT (content): Merge conflict in internal/ingress/annotations/sslcipher/main.go
Auto-merging internal/ingress/annotations/snippet/main_test.go
Auto-merging internal/ingress/annotations/snippet/main.go
CONFLICT (content): Merge conflict in internal/ingress/annotations/snippet/main.go
Auto-merging internal/ingress/annotations/sessionaffinity/main.go
CONFLICT (content): Merge conflict in internal/ingress/annotations/sessionaffinity/main.go
Auto-merging internal/ingress/annotations/serviceupstream/main_test.go
Auto-merging internal/ingress/annotations/serviceupstream/main.go
CONFLICT (content): Merge conflict in internal/ingress/annotations/serviceupstream/main.go
Auto-merging internal/ingress/annotations/serversnippet/main_test.go
Auto-merging internal/ingress/annotations/serversnippet/main.go
CONFLICT (content): Merge conflict in internal/ingress/annotations/serversnippet/main.go
Auto-merging internal/ingress/annotations/satisfy/main.go
CONFLICT (content): Merge conflict in internal/ingress/annotations/satisfy/main.go
Auto-merging internal/ingress/annotations/rewrite/main_test.go
CONFLICT (content): Merge conflict in internal/ingress/annotations/rewrite/main_test.go
Auto-merging internal/ingress/annotations/rewrite/main.go
CONFLICT (content): Merge conflict in internal/ingress/annotations/rewrite/main.go
Auto-merging internal/ingress/annotations/redirect/redirect_test.go
Auto-merging internal/ingress/annotations/redirect/redirect.go
CONFLICT (content): Merge conflict in internal/ingress/annotations/redirect/redirect.go
Auto-merging internal/ingress/annotations/ratelimit/main.go
Auto-merging internal/ingress/annotations/proxyssl/main_test.go
CONFLICT (content): Merge conflict in internal/ingress/annotations/proxyssl/main_test.go
Auto-merging internal/ingress/annotations/proxyssl/main.go
CONFLICT (content): Merge conflict in internal/ingress/annotations/proxyssl/main.go
Auto-merging internal/ingress/annotations/proxy/main_test.go
Auto-merging internal/ingress/annotations/proxy/main.go
CONFLICT (content): Merge conflict in internal/ingress/annotations/proxy/main.go
Auto-merging internal/ingress/annotations/portinredirect/main.go
CONFLICT (content): Merge conflict in internal/ingress/annotations/portinredirect/main.go
CONFLICT (add/add): Merge conflict in internal/ingress/annotations/parser/validators_test.go
Auto-merging internal/ingress/annotations/parser/validators_test.go
CONFLICT (add/add): Merge conflict in internal/ingress/annotations/parser/validators.go
Auto-merging internal/ingress/annotations/parser/validators.go
Auto-merging internal/ingress/annotations/parser/main_test.go
Auto-merging internal/ingress/annotations/parser/main.go
CONFLICT (content): Merge conflict in internal/ingress/annotations/parser/main.go
Auto-merging internal/ingress/annotations/opentracing/main_test.go
CONFLICT (content): Merge conflict in internal/ingress/annotations/opentracing/main_test.go
Auto-merging internal/ingress/annotations/opentracing/main.go
CONFLICT (content): Merge conflict in internal/ingress/annotations/opentracing/main.go
Auto-merging internal/ingress/annotations/opentelemetry/main_test.go
CONFLICT (content): Merge conflict in internal/ingress/annotations/opentelemetry/main_test.go
Auto-merging internal/ingress/annotations/opentelemetry/main.go
CONFLICT (content): Merge conflict in internal/ingress/annotations/opentelemetry/main.go
Auto-merging internal/ingress/annotations/modsecurity/main.go
CONFLICT (content): Merge conflict in internal/ingress/annotations/modsecurity/main.go
Auto-merging internal/ingress/annotations/mirror/main.go
CONFLICT (content): Merge conflict in internal/ingress/annotations/mirror/main.go
Auto-merging internal/ingress/annotations/log/main_test.go
CONFLICT (content): Merge conflict in internal/ingress/annotations/log/main_test.go
Auto-merging internal/ingress/annotations/log/main.go
CONFLICT (content): Merge conflict in internal/ingress/annotations/log/main.go
Auto-merging internal/ingress/annotations/loadbalancing/main_test.go
Auto-merging internal/ingress/annotations/loadbalancing/main.go
CONFLICT (content): Merge conflict in internal/ingress/annotations/loadbalancing/main.go
Auto-merging internal/ingress/annotations/ipdenylist/main.go
CONFLICT (content): Merge conflict in internal/ingress/annotations/ipdenylist/main.go
Auto-merging internal/ingress/annotations/ipallowlist/main_test.go
Auto-merging internal/ingress/annotations/ipallowlist/main.go
CONFLICT (content): Merge conflict in internal/ingress/annotations/ipallowlist/main.go
Auto-merging internal/ingress/annotations/http2pushpreload/main.go
CONFLICT (content): Merge conflict in internal/ingress/annotations/http2pushpreload/main.go
Auto-merging internal/ingress/annotations/globalratelimit/main_test.go
Auto-merging internal/ingress/annotations/globalratelimit/main.go
CONFLICT (content): Merge conflict in internal/ingress/annotations/globalratelimit/main.go
Auto-merging internal/ingress/annotations/defaultbackend/main.go
CONFLICT (content): Merge conflict in internal/ingress/annotations/defaultbackend/main.go
Auto-merging internal/ingress/annotations/customhttperrors/main.go
CONFLICT (content): Merge conflict in internal/ingress/annotations/customhttperrors/main.go
Auto-merging internal/ingress/annotations/cors/main.go
CONFLICT (content): Merge conflict in internal/ingress/annotations/cors/main.go
Auto-merging internal/ingress/annotations/connection/main_test.go
Auto-merging internal/ingress/annotations/connection/main.go
CONFLICT (content): Merge conflict in internal/ingress/annotations/connection/main.go
Auto-merging internal/ingress/annotations/clientbodybuffersize/main_test.go
Auto-merging internal/ingress/annotations/clientbodybuffersize/main.go
CONFLICT (content): Merge conflict in internal/ingress/annotations/clientbodybuffersize/main.go
Auto-merging internal/ingress/annotations/canary/main.go
CONFLICT (content): Merge conflict in internal/ingress/annotations/canary/main.go
Auto-merging internal/ingress/annotations/backendprotocol/main_test.go
Auto-merging internal/ingress/annotations/backendprotocol/main.go
CONFLICT (content): Merge conflict in internal/ingress/annotations/backendprotocol/main.go
Auto-merging internal/ingress/annotations/authtls/main_test.go
CONFLICT (content): Merge conflict in internal/ingress/annotations/authtls/main_test.go
Auto-merging internal/ingress/annotations/authtls/main.go
CONFLICT (content): Merge conflict in internal/ingress/annotations/authtls/main.go
Auto-merging internal/ingress/annotations/authreqglobal/main.go
CONFLICT (content): Merge conflict in internal/ingress/annotations/authreqglobal/main.go
Auto-merging internal/ingress/annotations/authreq/main_test.go
Auto-merging internal/ingress/annotations/authreq/main.go
CONFLICT (content): Merge conflict in internal/ingress/annotations/authreq/main.go
Auto-merging internal/ingress/annotations/auth/main_test.go
CONFLICT (content): Merge conflict in internal/ingress/annotations/auth/main_test.go
Auto-merging internal/ingress/annotations/auth/main.go
CONFLICT (content): Merge conflict in internal/ingress/annotations/auth/main.go
Auto-merging internal/ingress/annotations/annotations_test.go
Auto-merging internal/ingress/annotations/annotations.go
CONFLICT (content): Merge conflict in internal/ingress/annotations/annotations.go
Auto-merging internal/ingress/annotations/alias/main_test.go
CONFLICT (content): Merge conflict in internal/ingress/annotations/alias/main_test.go
Auto-merging internal/ingress/annotations/alias/main.go
CONFLICT (content): Merge conflict in internal/ingress/annotations/alias/main.go
error: Failed to merge in the changes.
hint: Use 'git am --show-current-patch=diff' to see the failed patch
Patch failed at 0001 Add validation to all annotations
When you have resolved this problem, run "git am --continue".
If you prefer to skip this patch, run "git am --skip" instead.
To restore the original branch and stop patching, run "git am --abort".

In response to this:

/cherry-pick release-1.9

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

k8s-ci-robot added do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. labels Feb 27, 2023

k8s-ci-robot requested review from ElvinEfendi and strongjz February 27, 2023 00:55

k8s-ci-robot added the needs-triage Indicates an issue or PR lacks a `triage/foo` label and requires one. label Feb 27, 2023

rikatz force-pushed the validate-annotations branch from 5585484 to 897ddec Compare April 9, 2023 18:50

rikatz force-pushed the validate-annotations branch from aa16c6a to 3f36559 Compare April 17, 2023 12:06

rikatz force-pushed the validate-annotations branch from d0a854a to 7312a39 Compare May 8, 2023 00:04

rikatz force-pushed the validate-annotations branch 2 times, most recently from 4a36f02 to bbb3203 Compare June 11, 2023 22:08

rikatz marked this pull request as ready for review June 11, 2023 22:09

k8s-ci-robot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Jun 11, 2023

k8s-ci-robot requested review from puerco and tao12345666333 June 11, 2023 22:09

tao12345666333 self-assigned this Jun 12, 2023

rikatz removed request for ElvinEfendi and puerco June 12, 2023 11:08

tao12345666333 reviewed Jun 12, 2023

View reviewed changes

internal/ingress/annotations/alias/main_test.go Outdated Show resolved Hide resolved

internal/ingress/annotations/annotations.go Show resolved Hide resolved

tao12345666333 reviewed Jun 13, 2023

View reviewed changes

internal/ingress/annotations/parser/validators.go Outdated Show resolved Hide resolved

tao12345666333 reviewed Jun 13, 2023

View reviewed changes

internal/ingress/annotations/parser/validators.go Outdated Show resolved Hide resolved

rikatz and others added 12 commits July 20, 2023 14:49

Add annotation validation for fcgi

b435ab1

Fix reviews and fcgi e2e

cdbf699

Add flag to disable cross namespace validation

10b7baa

Add risk, flag for validation, tests

8e8e44e

Add missing formating

8497484

Enable validation by default on tests

30bd452

Test validation flag

35748e9

remove ajp from list

ecfe183

Finalize validation changes

490d0f4

Add validations to CI

68d8d64

Update helm docs

007e18b

Fix code review

65997ac

rikatz force-pushed the validate-annotations branch from 74d60c3 to d4dcf36 Compare July 20, 2023 15:13

Use a better name for annotation risk

7ce93ae

rikatz force-pushed the validate-annotations branch from d4dcf36 to 7ce93ae Compare July 20, 2023 15:46

tao12345666333 approved these changes Jul 22, 2023

View reviewed changes

k8s-ci-robot added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. lgtm "Looks good to me", indicates that a PR is ready to be merged. labels Jul 22, 2023

k8s-ci-robot merged commit c5f348e into kubernetes:main Jul 22, 2023
37 checks passed

k8s-infra-cherrypick-robot mentioned this pull request Jul 22, 2023

[release-1.9] Implement annotation validation #10236

Closed

miklezzzz mentioned this pull request Oct 26, 2023

[ingress-nginx] add controller 1.9 deckhouse/deckhouse#6312

Merged

4 tasks

joshsleeper mentioned this pull request Nov 8, 2023

enabling annotation validation prevents deployment of previously allowed permanent redirect annotations #10634

Closed

longwuyuan mentioned this pull request Nov 15, 2023

Documentation for what --enable-annotation-validation actually does #10636

Open

strongjz mentioned this pull request Jan 18, 2024

AKS load balancer health check fails with ingress-nginx version v1.9.5 (but works with up to and including v1.8.4) #10869

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Implement annotation validation #9673

Implement annotation validation #9673

rikatz commented Feb 27, 2023

k8s-ci-robot commented Feb 27, 2023

k8s-ci-robot commented Feb 27, 2023

rikatz commented Jun 12, 2023

tao12345666333 left a comment

rikatz commented Jun 12, 2023 •

edited

Loading

tao12345666333 left a comment

strongjz commented Jul 20, 2023

k8s-infra-cherrypick-robot commented Jul 20, 2023

tao12345666333 left a comment

k8s-ci-robot commented Jul 22, 2023

k8s-infra-cherrypick-robot commented Jul 22, 2023

strongjz commented Sep 12, 2023

k8s-infra-cherrypick-robot commented Sep 12, 2023

Implement annotation validation #9673

Implement annotation validation #9673

Conversation

rikatz commented Feb 27, 2023

What this PR does / why we need it:

Types of changes

Which issue/s this PR fixes

How Has This Been Tested?

Checklist:

Does my pull request need a release note?

k8s-ci-robot commented Feb 27, 2023

k8s-ci-robot commented Feb 27, 2023

rikatz commented Jun 12, 2023

tao12345666333 left a comment

Choose a reason for hiding this comment

rikatz commented Jun 12, 2023 • edited Loading

tao12345666333 left a comment

Choose a reason for hiding this comment

strongjz commented Jul 20, 2023

k8s-infra-cherrypick-robot commented Jul 20, 2023

tao12345666333 left a comment

Choose a reason for hiding this comment

k8s-ci-robot commented Jul 22, 2023

k8s-infra-cherrypick-robot commented Jul 22, 2023

strongjz commented Sep 12, 2023

k8s-infra-cherrypick-robot commented Sep 12, 2023

rikatz commented Jun 12, 2023 •

edited

Loading