Implement annotation validation (#9673)

* Add validation to all annotations

* Add annotation validation for fcgi

* Fix reviews and fcgi e2e

* Add flag to disable cross namespace validation

* Add risk, flag for validation, tests

* Add missing formating

* Enable validation by default on tests

* Test validation flag

* remove ajp from list

* Finalize validation changes

* Add validations to CI

* Update helm docs

* Fix code review

* Use a better name for annotation risk

internal/ingress/annotations/opentelemetry/main.go

@@ -17,14 +17,51 @@ limitations under the License.
 package opentelemetry
 
 import (
+	"regexp"
+
 	networking "k8s.io/api/networking/v1"
 
 	"k8s.io/ingress-nginx/internal/ingress/annotations/parser"
+	"k8s.io/ingress-nginx/internal/ingress/errors"
 	"k8s.io/ingress-nginx/internal/ingress/resolver"
 )
 
+const (
+	enableOpenTelemetryAnnotation = "enable-opentelemetry"
+	otelTrustSpanAnnotation       = "opentelemetry-trust-incoming-span"
+	otelOperationNameAnnotation   = "opentelemetry-operation-name"
+)
+
+var regexOperationName = regexp.MustCompile(`^[A-Za-z0-9_\-]*$`)
+
+var otelAnnotations = parser.Annotation{
+	Group: "opentelemetry",
+	Annotations: parser.AnnotationFields{
+		enableOpenTelemetryAnnotation: {
+			Validator: parser.ValidateBool,
+			Scope:     parser.AnnotationScopeLocation,
+			Risk:      parser.AnnotationRiskLow,
+			Documentation: `This annotation defines if Open Telemetry collector should be enable for this location. OpenTelemetry should 
+			already be configured by Ingress administrator`,
+		},
+		otelTrustSpanAnnotation: {
+			Validator:     parser.ValidateBool,
+			Scope:         parser.AnnotationScopeLocation,
+			Risk:          parser.AnnotationRiskLow,
+			Documentation: `This annotation enables or disables using spans from incoming requests as parent for created ones`,
+		},
+		otelOperationNameAnnotation: {
+			Validator:     parser.ValidateRegex(*regexOperationName, true),
+			Scope:         parser.AnnotationScopeLocation,
+			Risk:          parser.AnnotationRiskMedium,
+			Documentation: `This annotation defines what operation name should be added to the span`,
+		},
+	},
+}
+
 type opentelemetry struct {
-	r resolver.Resolver
+	r                resolver.Resolver
+	annotationConfig parser.Annotation
 }
 
 // Config contains the configuration to be used in the Ingress
@@ -64,13 +101,16 @@ func (bd1 *Config) Equal(bd2 *Config) bool {
 
 // NewParser creates a new serviceUpstream annotation parser
 func NewParser(r resolver.Resolver) parser.IngressAnnotation {
-	return opentelemetry{r}
+	return opentelemetry{
+		r:                r,
+		annotationConfig: otelAnnotations,
+	}
 }
 
 // Parse parses the annotations to look for opentelemetry configurations
 func (c opentelemetry) Parse(ing *networking.Ingress) (interface{}, error) {
 	cfg := Config{}
-	enabled, err := parser.GetBoolAnnotation("enable-opentelemetry", ing)
+	enabled, err := parser.GetBoolAnnotation(enableOpenTelemetryAnnotation, ing, c.annotationConfig.Annotations)
 	if err != nil {
 		return &cfg, nil
 	}
@@ -80,10 +120,13 @@ func (c opentelemetry) Parse(ing *networking.Ingress) (interface{}, error) {
 		return &cfg, nil
 	}
 
-	trustEnabled, err := parser.GetBoolAnnotation("opentelemetry-trust-incoming-span", ing)
+	trustEnabled, err := parser.GetBoolAnnotation(otelTrustSpanAnnotation, ing, c.annotationConfig.Annotations)
 	if err != nil {
-		operationName, err := parser.GetStringAnnotation("opentelemetry-operation-name", ing)
+		operationName, err := parser.GetStringAnnotation(otelOperationNameAnnotation, ing, c.annotationConfig.Annotations)
 		if err != nil {
+			if errors.IsValidationError(err) {
+				return nil, err
+			}
 			return &cfg, nil
 		}
 		cfg.OperationName = operationName
@@ -92,10 +135,22 @@ func (c opentelemetry) Parse(ing *networking.Ingress) (interface{}, error) {
 
 	cfg.TrustSet = true
 	cfg.TrustEnabled = trustEnabled
-	operationName, err := parser.GetStringAnnotation("opentelemetry-operation-name", ing)
+	operationName, err := parser.GetStringAnnotation(otelOperationNameAnnotation, ing, c.annotationConfig.Annotations)
 	if err != nil {
+		if errors.IsValidationError(err) {
+			return nil, err
+		}
 		return &cfg, nil
 	}
 	cfg.OperationName = operationName
 	return &cfg, nil
 }
+
+func (c opentelemetry) GetDocumentation() parser.AnnotationFields {
+	return c.annotationConfig.Annotations
+}
+
+func (a opentelemetry) Validate(anns map[string]string) error {
+	maxrisk := parser.StringRiskToRisk(a.r.GetSecurityConfiguration().AnnotationsRiskLevel)
+	return parser.CheckAnnotationRisk(anns, maxrisk, otelAnnotations.Annotations)
+}