Implement annotation validation (#9673)

* Add validation to all annotations

* Add annotation validation for fcgi

* Fix reviews and fcgi e2e

* Add flag to disable cross namespace validation

* Add risk, flag for validation, tests

* Add missing formating

* Enable validation by default on tests

* Test validation flag

* remove ajp from list

* Finalize validation changes

* Add validations to CI

* Update helm docs

* Fix code review

* Use a better name for annotation risk

internal/ingress/annotations/customhttperrors/main.go

@@ -17,6 +17,7 @@ limitations under the License.
 package customhttperrors
 
 import (
+	"regexp"
 	"strconv"
 	"strings"
 
@@ -26,19 +27,46 @@ import (
 	"k8s.io/ingress-nginx/internal/ingress/resolver"
 )
 
+const (
+	customHTTPErrorsAnnotation = "custom-http-errors"
+)
+
+var (
+	// We accept anything between 400 and 599, on a comma separated.
+	arrayOfHTTPErrors = regexp.MustCompile(`^(?:[4,5][0-9][0-9],?)*$`)
+)
+
+var customHTTPErrorsAnnotations = parser.Annotation{
+	Group: "backend",
+	Annotations: parser.AnnotationFields{
+		customHTTPErrorsAnnotation: {
+			Validator: parser.ValidateRegex(*arrayOfHTTPErrors, true),
+			Scope:     parser.AnnotationScopeLocation,
+			Risk:      parser.AnnotationRiskLow,
+			Documentation: `If a default backend annotation is specified on the ingress, the errors code specified on this annotation 
+			will be routed to that annotation's default backend service. Otherwise they will be routed to the global default backend.
+			A comma-separated list of error codes is accepted (anything between 400 and 599, like 403, 503)`,
+		},
+	},
+}
+
 type customhttperrors struct {
-	r resolver.Resolver
+	r                resolver.Resolver
+	annotationConfig parser.Annotation
 }
 
 // NewParser creates a new custom http errors annotation parser
 func NewParser(r resolver.Resolver) parser.IngressAnnotation {
-	return customhttperrors{r}
+	return customhttperrors{
+		r:                r,
+		annotationConfig: customHTTPErrorsAnnotations,
+	}
 }
 
 // Parse parses the annotations contained in the ingress to use
 // custom http errors
 func (e customhttperrors) Parse(ing *networking.Ingress) (interface{}, error) {
-	c, err := parser.GetStringAnnotation("custom-http-errors", ing)
+	c, err := parser.GetStringAnnotation(customHTTPErrorsAnnotation, ing, e.annotationConfig.Annotations)
 	if err != nil {
 		return nil, err
 	}
@@ -55,3 +83,12 @@ func (e customhttperrors) Parse(ing *networking.Ingress) (interface{}, error) {
 
 	return codes, nil
 }
+
+func (e customhttperrors) GetDocumentation() parser.AnnotationFields {
+	return e.annotationConfig.Annotations
+}
+
+func (a customhttperrors) Validate(anns map[string]string) error {
+	maxrisk := parser.StringRiskToRisk(a.r.GetSecurityConfiguration().AnnotationsRiskLevel)
+	return parser.CheckAnnotationRisk(anns, maxrisk, customHTTPErrorsAnnotations.Annotations)
+}