Implement annotation validation (#9673)

* Add validation to all annotations

* Add annotation validation for fcgi

* Fix reviews and fcgi e2e

* Add flag to disable cross namespace validation

* Add risk, flag for validation, tests

* Add missing formating

* Enable validation by default on tests

* Test validation flag

* remove ajp from list

* Finalize validation changes

* Add validations to CI

* Update helm docs

* Fix code review

* Use a better name for annotation risk

internal/ingress/annotations/clientbodybuffersize/main.go

@@ -23,17 +23,49 @@ import (
 	"k8s.io/ingress-nginx/internal/ingress/resolver"
 )
 
+const (
+	clientBodyBufferSizeAnnotation = "client-body-buffer-size"
+)
+
+var clientBodyBufferSizeConfig = parser.Annotation{
+	Group: "backend",
+	Annotations: parser.AnnotationFields{
+		clientBodyBufferSizeAnnotation: {
+			Validator: parser.ValidateRegex(*parser.SizeRegex, true),
+			Scope:     parser.AnnotationScopeLocation,
+			Risk:      parser.AnnotationRiskLow, // Low, as it allows just a set of options
+			Documentation: `Sets buffer size for reading client request body per location. 
+			In case the request body is larger than the buffer, the whole body or only its part is written to a temporary file. 
+			By default, buffer size is equal to two memory pages. This is 8K on x86, other 32-bit platforms, and x86-64. 
+			It is usually 16K on other 64-bit platforms. This annotation is applied to each location provided in the ingress rule.`,
+		},
+	},
+}
+
 type clientBodyBufferSize struct {
-	r resolver.Resolver
+	r                resolver.Resolver
+	annotationConfig parser.Annotation
 }
 
 // NewParser creates a new clientBodyBufferSize annotation parser
 func NewParser(r resolver.Resolver) parser.IngressAnnotation {
-	return clientBodyBufferSize{r}
+	return clientBodyBufferSize{
+		r:                r,
+		annotationConfig: clientBodyBufferSizeConfig,
+	}
+}
+
+func (cbbs clientBodyBufferSize) GetDocumentation() parser.AnnotationFields {
+	return cbbs.annotationConfig.Annotations
 }
 
 // Parse parses the annotations contained in the ingress rule
 // used to add an client-body-buffer-size to the provided locations
 func (cbbs clientBodyBufferSize) Parse(ing *networking.Ingress) (interface{}, error) {
-	return parser.GetStringAnnotation("client-body-buffer-size", ing)
+	return parser.GetStringAnnotation(clientBodyBufferSizeAnnotation, ing, cbbs.annotationConfig.Annotations)
+}
+
+func (a clientBodyBufferSize) Validate(anns map[string]string) error {
+	maxrisk := parser.StringRiskToRisk(a.r.GetSecurityConfiguration().AnnotationsRiskLevel)
+	return parser.CheckAnnotationRisk(anns, maxrisk, clientBodyBufferSizeConfig.Annotations)
 }

internal/ingress/annotations/clientbodybuffersize/main_test.go

@@ -39,6 +39,9 @@ func TestParse(t *testing.T) {
 	}{
 		{map[string]string{annotation: "8k"}, "8k"},
 		{map[string]string{annotation: "16k"}, "16k"},
+		{map[string]string{annotation: "10000"}, "10000"},
+		{map[string]string{annotation: "16R"}, ""},
+		{map[string]string{annotation: "16kkk"}, ""},
 		{map[string]string{annotation: ""}, ""},
 		{map[string]string{}, ""},
 		{nil, ""},