DevFW-CICD/ingress-nginx-helm
6
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat: add annotation to allow to add custom response headers (#9742)

Browse source 
* add custom headers

Signed-off-by: Christian Groschupp <christian@groschupp.org>

* add tests

Signed-off-by: Christian Groschupp <christian@groschupp.org>

* add docs

* update copyright

* change comments

* add e2e test customheaders

* add custom headers validation

* remove escapeLiteralDollar filter

* validate value in custom headers

* add regex for header value

* fix annotation test

* Revert "remove escapeLiteralDollar filter"

This reverts commit ab48392b60dee4ce146a4c17e046849f9633c7fb.

* add annotationConfig

* fix test

* fix golangci-lint findings

* fix: add missung exp module

---------

Signed-off-by: Christian Groschupp <christian@groschupp.org>
This commit is contained in:
Christian Groschupp 2024-04-09 12:25:22 +02:00 • committed by GitHub
parent d56aacdb31
commit 1f4ee0e235
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
15 changed files with 537 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

20
internal/ingress/controller/template/configmap.go
View file

@ -31,6 +31,7 @@ import (
"k8s.io/apimachinery/pkg/util/sets"
"k8s.io/ingress-nginx/internal/ingress/annotations/authreq"
"k8s.io/ingress-nginx/internal/ingress/annotations/customheaders"
"k8s.io/ingress-nginx/internal/ingress/annotations/parser"
"k8s.io/ingress-nginx/internal/ingress/controller/config"
ing_net "k8s.io/ingress-nginx/internal/net"
@ -54,6 +55,7 @@ const (
nginxStatusIpv6Whitelist = "nginx-status-ipv6-whitelist"
proxyHeaderTimeout = "proxy-protocol-header-timeout"
workerProcesses = "worker-processes"
globalAllowedResponseHeaders = "global-allowed-response-headers"
globalAuthURL = "global-auth-url"
globalAuthMethod = "global-auth-method"
globalAuthSignin = "global-auth-signin"
@ -115,6 +117,7 @@ func ReadConfig(src map[string]string) config.Configuration {
blockUserAgentList := make([]string, 0)
blockRefererList := make([]string, 0)
responseHeaders := make([]string, 0)
allowedResponseHeaders := make([]string, 0)
luaSharedDicts := make(map[string]int)
debugConnectionsList := make([]string, 0)
@ -248,6 +251,22 @@ func ReadConfig(src map[string]string) config.Configuration {
}
}
// Verify that the configured global external authorization response headers are valid. if not, set the default value
if val, ok := conf[globalAllowedResponseHeaders]; ok {
delete(conf, globalAllowedResponseHeaders)
if val != "" {
harr := splitAndTrimSpace(val, ",")
for _, header := range harr {
if !customheaders.ValidHeader(header) {
klog.Warningf("Global allowed response headers denied - %s.", header)
} else {
allowedResponseHeaders = append(allowedResponseHeaders, header)
}
}
}
}
// Verify that the configured global external authorization method is a valid HTTP method. if not, set the default value
if val, ok := conf[globalAuthMethod]; ok {
delete(conf, globalAuthMethod)
@ -422,6 +441,7 @@ func ReadConfig(src map[string]string) config.Configuration {
to.ProxyStreamResponses = streamResponses
to.DisableIpv6DNS = !ing_net.IsIPv6Enabled()
to.LuaSharedDicts = luaSharedDicts
to.Backend.AllowedResponseHeaders = allowedResponseHeaders
decoderConfig := &mapstructure.DecoderConfig{
Metadata: nil,