Implement annotation validation (#9673)

* Add validation to all annotations

* Add annotation validation for fcgi

* Fix reviews and fcgi e2e

* Add flag to disable cross namespace validation

* Add risk, flag for validation, tests

* Add missing formating

* Enable validation by default on tests

* Test validation flag

* remove ajp from list

* Finalize validation changes

* Add validations to CI

* Update helm docs

* Fix code review

* Use a better name for annotation risk

internal/ingress/annotations/connection/main.go

@@ -17,12 +17,34 @@ limitations under the License.
 package connection
 
 import (
+	"regexp"
+
 	networking "k8s.io/api/networking/v1"
 
 	"k8s.io/ingress-nginx/internal/ingress/annotations/parser"
 	"k8s.io/ingress-nginx/internal/ingress/resolver"
 )
 
+const (
+	connectionProxyHeaderAnnotation = "connection-proxy-header"
+)
+
+var (
+	validConnectionHeaderValue = regexp.MustCompile(`^(close|keep-alive)$`)
+)
+
+var connectionHeadersAnnotations = parser.Annotation{
+	Group: "backend",
+	Annotations: parser.AnnotationFields{
+		connectionProxyHeaderAnnotation: {
+			Validator:     parser.ValidateRegex(*validConnectionHeaderValue, true),
+			Scope:         parser.AnnotationScopeLocation,
+			Risk:          parser.AnnotationRiskLow,
+			Documentation: `This annotation allows setting a specific value for "proxy_set_header Connection" directive. Right now it is restricted to "close" or "keep-alive"`,
+		},
+	},
+}
+
 // Config returns the connection header configuration for an Ingress rule
 type Config struct {
 	Header  string `json:"header"`
@@ -30,18 +52,22 @@ type Config struct {
 }
 
 type connection struct {
-	r resolver.Resolver
+	r                resolver.Resolver
+	annotationConfig parser.Annotation
 }
 
 // NewParser creates a new port in redirect annotation parser
 func NewParser(r resolver.Resolver) parser.IngressAnnotation {
-	return connection{r}
+	return connection{
+		r:                r,
+		annotationConfig: connectionHeadersAnnotations,
+	}
 }
 
 // Parse parses the annotations contained in the ingress
 // rule used to indicate if the connection header should be overridden.
 func (a connection) Parse(ing *networking.Ingress) (interface{}, error) {
-	cp, err := parser.GetStringAnnotation("connection-proxy-header", ing)
+	cp, err := parser.GetStringAnnotation(connectionProxyHeaderAnnotation, ing, a.annotationConfig.Annotations)
 	if err != nil {
 		return &Config{
 			Enabled: false,
@@ -70,3 +96,12 @@ func (r1 *Config) Equal(r2 *Config) bool {
 
 	return true
 }
+
+func (a connection) GetDocumentation() parser.AnnotationFields {
+	return a.annotationConfig.Annotations
+}
+
+func (a connection) Validate(anns map[string]string) error {
+	maxrisk := parser.StringRiskToRisk(a.r.GetSecurityConfiguration().AnnotationsRiskLevel)
+	return parser.CheckAnnotationRisk(anns, maxrisk, connectionHeadersAnnotations.Annotations)
+}

internal/ingress/annotations/connection/main_test.go

@@ -37,10 +37,12 @@ func TestParse(t *testing.T) {
 	testCases := []struct {
 		annotations map[string]string
 		expected    *Config
+		expectErr   bool
 	}{
-		{map[string]string{annotation: "keep-alive"}, &Config{Enabled: true, Header: "keep-alive"}},
-		{map[string]string{}, &Config{Enabled: false}},
-		{nil, &Config{Enabled: false}},
+		{map[string]string{annotation: "keep-alive"}, &Config{Enabled: true, Header: "keep-alive"}, false},
+		{map[string]string{annotation: "not-allowed-value"}, &Config{Enabled: false}, true},
+		{map[string]string{}, &Config{Enabled: false}, true},
+		{nil, &Config{Enabled: false}, true},
 	}
 
 	ing := &networking.Ingress{
@@ -53,11 +55,17 @@ func TestParse(t *testing.T) {
 
 	for _, testCase := range testCases {
 		ing.SetAnnotations(testCase.annotations)
-		i, _ := ap.Parse(ing)
-		p, _ := i.(*Config)
-
+		i, err := ap.Parse(ing)
+		if (err != nil) != testCase.expectErr {
+			t.Fatalf("expected error: %t got error: %t err value: %s. %+v", testCase.expectErr, err != nil, err, testCase.annotations)
+		}
+		p, ok := i.(*Config)
+		if !ok {
+			t.Fatalf("expected a Config type")
+		}
 		if !p.Equal(testCase.expected) {
 			t.Errorf("expected %v but returned %v, annotations: %s", testCase.expected, p, testCase.annotations)
 		}
+
 	}
 }