Implement annotation validation (#9673)

* Add validation to all annotations

* Add annotation validation for fcgi

* Fix reviews and fcgi e2e

* Add flag to disable cross namespace validation

* Add risk, flag for validation, tests

* Add missing formating

* Enable validation by default on tests

* Test validation flag

* remove ajp from list

* Finalize validation changes

* Add validations to CI

* Update helm docs

* Fix code review

* Use a better name for annotation risk

internal/ingress/annotations/loadbalancing/main.go

@@ -23,18 +23,52 @@ import (
 	"k8s.io/ingress-nginx/internal/ingress/resolver"
 )
 
-type loadbalancing struct {
-	r resolver.Resolver
+// LB Alghorithms are defined in https://github.com/kubernetes/ingress-nginx/blob/d3e75b056f77be54e01bdb18675f1bb46caece31/rootfs/etc/nginx/lua/balancer.lua#L28
+
+const (
+	loadBalanceAlghoritmAnnotation = "load-balance"
+)
+
+var loadBalanceAlghoritms = []string{"round_robin", "chash", "chashsubset", "sticky_balanced", "sticky_persistent", "ewma"}
+
+var loadBalanceAnnotations = parser.Annotation{
+	Group: "backend",
+	Annotations: parser.AnnotationFields{
+		loadBalanceAlghoritmAnnotation: {
+			Validator: parser.ValidateOptions(loadBalanceAlghoritms, true, true),
+			Scope:     parser.AnnotationScopeLocation,
+			Risk:      parser.AnnotationRiskLow,
+			Documentation: `This annotation allows setting the load balancing alghorithm that should be used. If none is specified, defaults to 
+			the default configured by Ingress admin, otherwise to round_robin`,
+		},
+	},
 }
 
-// NewParser creates a new CORS annotation parser
+type loadbalancing struct {
+	r                resolver.Resolver
+	annotationConfig parser.Annotation
+}
+
+// NewParser creates a new Load Balancer annotation parser
 func NewParser(r resolver.Resolver) parser.IngressAnnotation {
-	return loadbalancing{r}
+	return loadbalancing{
+		r:                r,
+		annotationConfig: loadBalanceAnnotations,
+	}
 }
 
 // Parse parses the annotations contained in the ingress rule
 // used to indicate if the location/s contains a fragment of
 // configuration to be included inside the paths of the rules
 func (a loadbalancing) Parse(ing *networking.Ingress) (interface{}, error) {
-	return parser.GetStringAnnotation("load-balance", ing)
+	return parser.GetStringAnnotation(loadBalanceAlghoritmAnnotation, ing, a.annotationConfig.Annotations)
+}
+
+func (a loadbalancing) GetDocumentation() parser.AnnotationFields {
+	return a.annotationConfig.Annotations
+}
+
+func (a loadbalancing) Validate(anns map[string]string) error {
+	maxrisk := parser.StringRiskToRisk(a.r.GetSecurityConfiguration().AnnotationsRiskLevel)
+	return parser.CheckAnnotationRisk(anns, maxrisk, loadBalanceAnnotations.Annotations)
 }

internal/ingress/annotations/loadbalancing/main_test.go

@@ -38,7 +38,8 @@ func TestParse(t *testing.T) {
 		annotations map[string]string
 		expected    string
 	}{
-		{map[string]string{annotation: "ip_hash"}, "ip_hash"},
+		{map[string]string{annotation: "ewma"}, "ewma"},
+		{map[string]string{annotation: "ip_hash"}, ""}, // This is invalid and should not return anything
 		{map[string]string{}, ""},
 		{nil, ""},
 	}