DevFW-CICD/ingress-nginx-helm
6
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

configmap: option to not trust incoming tracing spans (#7045)

Browse source 
* validate the sender of tracing spans

* add location-specific setting
This commit is contained in:
Matthew Silverman 2021-10-24 17:36:21 -04:00 • committed by GitHub
parent e4001df41e
commit 7d5452d00b
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
9 changed files with 124 additions and 34 deletions
Download patch file Download diff file Expand all files Collapse all files

6
internal/ingress/controller/config/config.go
View file

@ -537,6 +537,11 @@ type Configuration struct {
// OpentracingOperationName specifies a custom name for the location span
OpentracingLocationOperationName string `json:"opentracing-location-operation-name"`
// OpentracingTrustIncomingSpan sets whether or not to trust incoming trace spans
// If false, incoming span headers will be rejected
// Default: true
OpentracingTrustIncomingSpan bool `json:"opentracing-trust-incoming-span"`
// ZipkinCollectorHost specifies the host to use when uploading traces
ZipkinCollectorHost string `json:"zipkin-collector-host"`
@ -874,6 +879,7 @@ func NewDefault() Configuration {
LimitConnZoneVariable: defaultLimitConnZoneVariable,
BindAddressIpv4: defBindAddress,
BindAddressIpv6: defBindAddress,
OpentracingTrustIncomingSpan: true,
ZipkinCollectorPort: 9411,
ZipkinServiceName: "nginx",
ZipkinSampleRate: 1.0,

28
internal/ingress/controller/template/template.go
View file

@ -1440,7 +1440,7 @@ func httpsListener(addresses []string, co string, tc config.TemplateConfig) []st
return out
}
func buildOpentracingForLocation(isOTEnabled bool, location *ingress.Location) string {
func buildOpentracingForLocation(isOTEnabled bool, isOTTrustSet bool, location *ingress.Location) string {
isOTEnabledInLoc := location.Opentracing.Enabled
isOTSetInLoc := location.Opentracing.Set
@ -1448,25 +1448,21 @@ func buildOpentracingForLocation(isOTEnabled bool, location *ingress.Location) s
if isOTSetInLoc && !isOTEnabledInLoc {
return "opentracing off;"
}
opc := opentracingPropagateContext(location)
if opc != "" {
opc = fmt.Sprintf("opentracing on;\n%v", opc)
}
return opc
} else if !isOTSetInLoc || !isOTEnabledInLoc {
return ""
}
if isOTSetInLoc && isOTEnabledInLoc {
opc := opentracingPropagateContext(location)
if opc != "" {
opc = fmt.Sprintf("opentracing on;\n%v", opc)
}
return opc
opc := opentracingPropagateContext(location)
if opc != "" {
opc = fmt.Sprintf("opentracing on;\n%v", opc)
}
return ""
if (!isOTTrustSet && !location.Opentracing.TrustSet) ||
(location.Opentracing.TrustSet && !location.Opentracing.TrustEnabled) {
opc = opc + "\nopentracing_trust_incoming_span off;"
}
return opc
}
// shouldLoadOpentracingModule determines whether or not the Opentracing module needs to be loaded.

36
internal/ingress/controller/template/template_test.go
View file

@ -1637,32 +1637,44 @@ func TestShouldLoadModSecurityModule(t *testing.T) {
func TestOpentracingForLocation(t *testing.T) {
trueVal := true
falseVal := false
loadOT := `opentracing on;
opentracing_propagate_context;`
loadOTUntrustedSpan := `opentracing on;
opentracing_propagate_context;
opentracing_trust_incoming_span off;`
testCases := []struct {
description string
globalOT bool
isSetInLoc bool
isOTInLoc *bool
expected string
description string
globalOT bool
isSetInLoc bool
isOTInLoc *bool
globalTrust bool
isTrustSetInLoc bool
isTrustInLoc *bool
expected string
}{
{"globally enabled, without annotation", true, false, nil, loadOT},
{"globally enabled and enabled in location", true, true, &trueVal, loadOT},
{"globally disabled and not enabled in location", false, false, nil, ""},
{"globally disabled but enabled in location", false, true, &trueVal, loadOT},
{"globally disabled, enabled in location but false", false, true, &trueVal, loadOT},
{"globally enabled, without annotation", true, false, nil, true, false, nil, loadOT},
{"globally enabled and enabled in location", true, true, &trueVal, true, false, nil, loadOT},
{"globally disabled and not enabled in location", false, false, nil, true, false, nil, ""},
{"globally disabled but enabled in location", false, true, &trueVal, true, false, nil, loadOT},
{"globally trusted, not trusted in location", true, false, nil, true, true, &falseVal, loadOTUntrustedSpan},
{"not globally trusted, trust set in location", true, false, nil, false, true, &trueVal, loadOT},
{"not globally trusted, trust not set in location", true, false, nil, false, false, nil, loadOTUntrustedSpan},
}
for _, testCase := range testCases {
il := &ingress.Location{
Opentracing: opentracing.Config{Set: testCase.isSetInLoc},
Opentracing: opentracing.Config{Set: testCase.isSetInLoc, TrustSet: testCase.isTrustSetInLoc},
}
if il.Opentracing.Set {
il.Opentracing.Enabled = *testCase.isOTInLoc
}
if il.Opentracing.TrustSet {
il.Opentracing.TrustEnabled = *testCase.isTrustInLoc
}
actual := buildOpentracingForLocation(testCase.globalOT, il)
actual := buildOpentracingForLocation(testCase.globalOT, testCase.globalTrust, il)
if testCase.expected != actual {
t.Errorf("%v: expected '%v' but returned '%v'", testCase.description, testCase.expected, actual)