Implement annotation validation (#9673)

* Add validation to all annotations

* Add annotation validation for fcgi

* Fix reviews and fcgi e2e

* Add flag to disable cross namespace validation

* Add risk, flag for validation, tests

* Add missing formating

* Enable validation by default on tests

* Test validation flag

* remove ajp from list

* Finalize validation changes

* Add validations to CI

* Update helm docs

* Fix code review

* Use a better name for annotation risk

internal/ingress/annotations/http2pushpreload/main.go

@@ -23,17 +23,46 @@ import (
 	"k8s.io/ingress-nginx/internal/ingress/resolver"
 )
 
+const (
+	http2PushPreloadAnnotation = "http2-push-preload"
+)
+
+var http2PushPreloadAnnotations = parser.Annotation{
+	Group: "http2",
+	Annotations: parser.AnnotationFields{
+		http2PushPreloadAnnotation: {
+			Validator:     parser.ValidateBool,
+			Scope:         parser.AnnotationScopeLocation,
+			Risk:          parser.AnnotationRiskLow,
+			Documentation: `Enables automatic conversion of preload links specified in the “Link” response header fields into push requests`,
+		},
+	},
+}
+
 type http2PushPreload struct {
-	r resolver.Resolver
+	r                resolver.Resolver
+	annotationConfig parser.Annotation
 }
 
 // NewParser creates a new http2PushPreload annotation parser
 func NewParser(r resolver.Resolver) parser.IngressAnnotation {
-	return http2PushPreload{r}
+	return http2PushPreload{
+		r:                r,
+		annotationConfig: http2PushPreloadAnnotations,
+	}
 }
 
 // Parse parses the annotations contained in the ingress rule
 // used to add http2 push preload to the server
 func (h2pp http2PushPreload) Parse(ing *networking.Ingress) (interface{}, error) {
-	return parser.GetBoolAnnotation("http2-push-preload", ing)
+	return parser.GetBoolAnnotation(http2PushPreloadAnnotation, ing, h2pp.annotationConfig.Annotations)
+}
+
+func (h2pp http2PushPreload) GetDocumentation() parser.AnnotationFields {
+	return h2pp.annotationConfig.Annotations
+}
+
+func (a http2PushPreload) Validate(anns map[string]string) error {
+	maxrisk := parser.StringRiskToRisk(a.r.GetSecurityConfiguration().AnnotationsRiskLevel)
+	return parser.CheckAnnotationRisk(anns, maxrisk, http2PushPreloadAnnotations.Annotations)
 }

internal/ingress/annotations/http2pushpreload/main_test.go

@@ -23,11 +23,12 @@ import (
 	networking "k8s.io/api/networking/v1"
 	meta_v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/ingress-nginx/internal/ingress/annotations/parser"
+	"k8s.io/ingress-nginx/internal/ingress/errors"
 	"k8s.io/ingress-nginx/internal/ingress/resolver"
 )
 
 func TestParse(t *testing.T) {
-	annotation := parser.GetAnnotationWithPrefix("http2-push-preload")
+	annotation := parser.GetAnnotationWithPrefix(http2PushPreloadAnnotation)
 	ap := NewParser(&resolver.Mock{})
 	if ap == nil {
 		t.Fatalf("expected a parser.IngressAnnotation but returned nil")
@@ -36,12 +37,14 @@ func TestParse(t *testing.T) {
 	testCases := []struct {
 		annotations map[string]string
 		expected    bool
+		expectErr   bool
 	}{
-		{map[string]string{annotation: "true"}, true},
-		{map[string]string{annotation: "1"}, true},
-		{map[string]string{annotation: ""}, false},
-		{map[string]string{}, false},
-		{nil, false},
+		{map[string]string{annotation: "true"}, true, false},
+		{map[string]string{annotation: "1"}, true, false},
+		{map[string]string{annotation: "xpto"}, false, true},
+		{map[string]string{annotation: ""}, false, false},
+		{map[string]string{}, false, false},
+		{nil, false, false},
 	}
 
 	ing := &networking.Ingress{
@@ -54,7 +57,10 @@ func TestParse(t *testing.T) {
 
 	for _, testCase := range testCases {
 		ing.SetAnnotations(testCase.annotations)
-		result, _ := ap.Parse(ing)
+		result, err := ap.Parse(ing)
+		if ((err != nil) != testCase.expectErr) && !errors.IsInvalidContent(err) && !errors.IsMissingAnnotations(err) {
+			t.Fatalf("expected error: %t got error: %t err value: %s. %+v", testCase.expectErr, err != nil, err, testCase.annotations)
+		}
 		if result != testCase.expected {
 			t.Errorf("expected %v but returned %v, annotations: %s", testCase.expected, result, testCase.annotations)
 		}