Fix minor typos (#11940)
Co-authored-by: Nathan Baulch <nathan.baulch@gmail.com>
This commit is contained in:
Marco Ebert
GitHub
parent
47b86617c1
commit
d06029e3c5
46 changed files with 124 additions and 124 deletions
|
|
@ -286,7 +286,7 @@ Do not try to edit it manually.
|
|||
### [[Shutdown] Grace period shutdown](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/gracefulshutdown/grace_period.go#L32)
|
||||
- [/healthz should return status code 500 during shutdown grace period](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/gracefulshutdown/grace_period.go#L35)
|
||||
### [[Shutdown] ingress controller](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/gracefulshutdown/shutdown.go#L30)
|
||||
- [should shutdown in less than 60 secons without pending connections](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/gracefulshutdown/shutdown.go#L40)
|
||||
- [should shutdown in less than 60 seconds without pending connections](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/gracefulshutdown/shutdown.go#L40)
|
||||
### [[Shutdown] Graceful shutdown with pending request](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/gracefulshutdown/slow_requests.go#L25)
|
||||
- [should let slow requests finish before shutting down](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/gracefulshutdown/slow_requests.go#L33)
|
||||
### [[Ingress] DeepInspection](https://github.com/kubernetes/ingress-nginx/tree/main//test/e2e/ingress/deep_inspection.go#L27)
|
||||
|
|
|
|||
|
|
@ -23,7 +23,7 @@ Customization | [External authentication with response header propagation](custo
|
|||
Customization | [Sysctl tuning](customization/sysctl/README.md) | TODO | TODO
|
||||
Features | [Rewrite](rewrite/README.md) | TODO | TODO
|
||||
Features | [Session stickiness](affinity/cookie/README.md) | route requests consistently to the same endpoint | Advanced
|
||||
Features | [Canary Deployments](canary/README.md) | weighted canary routing to a seperate deployment | Intermediate
|
||||
Features | [Canary Deployments](canary/README.md) | weighted canary routing to a separate deployment | Intermediate
|
||||
Scaling | [Static IP](static-ip/README.md) | a single ingress gets a single static IP | Intermediate
|
||||
TLS | [Multi TLS certificate termination](multi-tls/README.md) | TODO | TODO
|
||||
TLS | [TLS termination](tls-termination/README.md) | TODO | TODO
|
||||
|
|
|
|||
|
|
@ -1,25 +1,25 @@
|
|||
# OpenPolicyAgent and pathType enforcing
|
||||
|
||||
Ingress API allows users to specify different [pathType](https://kubernetes.io/docs/concepts/services-networking/ingress/#path-types)
|
||||
on Ingress object.
|
||||
Ingress API allows users to specify different [pathType](https://kubernetes.io/docs/concepts/services-networking/ingress/#path-types)
|
||||
on Ingress object.
|
||||
|
||||
While pathType `Exact` and `Prefix` should allow only a small set of characters, pathType `ImplementationSpecific`
|
||||
allows any characters, as it may contain regexes, variables and other features that may be specific of the Ingress
|
||||
allows any characters, as it may contain regexes, variables and other features that may be specific of the Ingress
|
||||
Controller being used.
|
||||
|
||||
This means that the Ingress Admins (the persona who deployed the Ingress Controller) should trust the users
|
||||
allowed to use `pathType: ImplementationSpecific`, as this may allow arbitrary configuration, and this
|
||||
This means that the Ingress Admins (the persona who deployed the Ingress Controller) should trust the users
|
||||
allowed to use `pathType: ImplementationSpecific`, as this may allow arbitrary configuration, and this
|
||||
configuration may end on the proxy (aka Nginx) configuration.
|
||||
|
||||
## Example
|
||||
The example in this repo uses [Gatekeeper](https://open-policy-agent.github.io/gatekeeper/website/) to block the usage of `pathType: ImplementationSpecific`,
|
||||
The example in this repo uses [Gatekeeper](https://open-policy-agent.github.io/gatekeeper/website/) to block the usage of `pathType: ImplementationSpecific`,
|
||||
allowing just a specific list of namespaces to use it.
|
||||
|
||||
It is recommended that the admin modifies this rules to enforce a specific set of characters when the usage of ImplementationSpecific
|
||||
is allowed, or in ways that best suits their needs.
|
||||
|
||||
First, the `ConstraintTemplate` from [template.yaml](template.yaml) will define a rule that validates if the Ingress object
|
||||
is being created on an excempted namespace, and case not, will validate its pathType.
|
||||
First, the `ConstraintTemplate` from [template.yaml](template.yaml) will define a rule that validates if the Ingress object
|
||||
is being created on an exempted namespace, and case not, will validate its pathType.
|
||||
|
||||
Then, the rule `K8sBlockIngressPathType` contained in [rule.yaml](rule.yaml) will define the parameters: what kind of
|
||||
object should be verified (Ingress), what are the excempted namespaces, and what kinds of pathType are blocked.
|
||||
Then, the rule `K8sBlockIngressPathType` contained in [rule.yaml](rule.yaml) will define the parameters: what kind of
|
||||
object should be verified (Ingress), what are the exempted namespaces, and what kinds of pathType are blocked.
|
||||
|
|
|
|||
|
|
@ -17,11 +17,11 @@ spec:
|
|||
properties:
|
||||
blockedTypes:
|
||||
type: array
|
||||
items:
|
||||
type: string
|
||||
items:
|
||||
type: string
|
||||
namespacesExceptions:
|
||||
type: array
|
||||
items:
|
||||
items:
|
||||
type: string
|
||||
targets:
|
||||
- target: admission.k8s.gatekeeper.sh
|
||||
|
|
@ -31,8 +31,8 @@ spec:
|
|||
violation[{"msg": msg}] {
|
||||
input.review.kind.kind == "Ingress"
|
||||
ns := input.review.object.metadata.namespace
|
||||
excemptNS := [good | excempts = input.parameters.namespacesExceptions[_] ; good = excempts == ns]
|
||||
not any(excemptNS)
|
||||
exemptNS := [good | exempts = input.parameters.namespacesExceptions[_] ; good = exempts == ns]
|
||||
not any(exemptNS)
|
||||
pathType := object.get(input.review.object.spec.rules[_].http.paths[_], "pathType", "")
|
||||
blockedPath := [blocked | blockedTypes = input.parameters.blockedTypes[_] ; blocked = blockedTypes == pathType]
|
||||
any(blockedPath)
|
||||
|
|
|
|||
|
|
@ -65,7 +65,7 @@ otel-max-queuesize
|
|||
|
||||
# The delay interval in milliseconds between two consecutive exports.
|
||||
otel-schedule-delay-millis
|
||||
|
||||
|
||||
# How long the export can run before it is cancelled.
|
||||
otel-schedule-delay-millis
|
||||
|
||||
|
|
@ -112,7 +112,7 @@ graph TB
|
|||
end
|
||||
|
||||
subgraph otel
|
||||
otc["Otel Collector"]
|
||||
otc["Otel Collector"]
|
||||
end
|
||||
|
||||
subgraph observability
|
||||
|
|
@ -190,7 +190,7 @@ To install the example and collectors run:
|
|||
helm repo add open-telemetry https://open-telemetry.github.io/opentelemetry-helm-charts
|
||||
helm repo add grafana https://grafana.github.io/helm-charts
|
||||
helm repo update
|
||||
# deply cert-manager needed for OpenTelemetry collector operator
|
||||
# deploy cert-manager needed for OpenTelemetry collector operator
|
||||
kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.9.1/cert-manager.yaml
|
||||
# create observability namespace
|
||||
kubectl apply -f https://raw.githubusercontent.com/esigo/nginx-example/main/observability/namespace.yaml
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue