DevFW-CICD/ingress-nginx-helm
6
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fix minor typos (#11940)

Browse source 
Co-authored-by: Nathan Baulch <nathan.baulch@gmail.com>
This commit is contained in:
Marco Ebert 2024-09-06 23:19:46 +02:00 • committed by GitHub
parent 47b86617c1
commit d06029e3c5
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
46 changed files with 124 additions and 124 deletions
Download patch file Download diff file Expand all files Collapse all files

2
docs/examples/index.md
View file

@ -23,7 +23,7 @@ Customization | [External authentication with response header propagation](custo
Customization | [Sysctl tuning](customization/sysctl/README.md) | TODO | TODO
Features | [Rewrite](rewrite/README.md) | TODO | TODO
Features | [Session stickiness](affinity/cookie/README.md) | route requests consistently to the same endpoint | Advanced
Features | [Canary Deployments](canary/README.md) | weighted canary routing to a seperate deployment | Intermediate
Features | [Canary Deployments](canary/README.md) | weighted canary routing to a separate deployment | Intermediate
Scaling | [Static IP](static-ip/README.md) | a single ingress gets a single static IP | Intermediate
TLS | [Multi TLS certificate termination](multi-tls/README.md) | TODO | TODO
TLS | [TLS termination](tls-termination/README.md) | TODO | TODO

20
docs/examples/openpolicyagent/README.md
View file

@ -1,25 +1,25 @@
# OpenPolicyAgent and pathType enforcing
Ingress API allows users to specify different [pathType](https://kubernetes.io/docs/concepts/services-networking/ingress/#path-types)
on Ingress object.
Ingress API allows users to specify different [pathType](https://kubernetes.io/docs/concepts/services-networking/ingress/#path-types)
on Ingress object.
While pathType `Exact` and `Prefix` should allow only a small set of characters, pathType `ImplementationSpecific`
allows any characters, as it may contain regexes, variables and other features that may be specific of the Ingress
allows any characters, as it may contain regexes, variables and other features that may be specific of the Ingress
Controller being used.
This means that the Ingress Admins (the persona who deployed the Ingress Controller) should trust the users
allowed to use `pathType: ImplementationSpecific`, as this may allow arbitrary configuration, and this
This means that the Ingress Admins (the persona who deployed the Ingress Controller) should trust the users
allowed to use `pathType: ImplementationSpecific`, as this may allow arbitrary configuration, and this
configuration may end on the proxy (aka Nginx) configuration.
## Example
The example in this repo uses [Gatekeeper](https://open-policy-agent.github.io/gatekeeper/website/) to block the usage of `pathType: ImplementationSpecific`,
The example in this repo uses [Gatekeeper](https://open-policy-agent.github.io/gatekeeper/website/) to block the usage of `pathType: ImplementationSpecific`,
allowing just a specific list of namespaces to use it.
It is recommended that the admin modifies this rules to enforce a specific set of characters when the usage of ImplementationSpecific
is allowed, or in ways that best suits their needs.
First, the `ConstraintTemplate` from [template.yaml](template.yaml) will define a rule that validates if the Ingress object
is being created on an excempted namespace, and case not, will validate its pathType.
First, the `ConstraintTemplate` from [template.yaml](template.yaml) will define a rule that validates if the Ingress object
is being created on an exempted namespace, and case not, will validate its pathType.
Then, the rule `K8sBlockIngressPathType` contained in [rule.yaml](rule.yaml) will define the parameters: what kind of
object should be verified (Ingress), what are the excempted namespaces, and what kinds of pathType are blocked.
Then, the rule `K8sBlockIngressPathType` contained in [rule.yaml](rule.yaml) will define the parameters: what kind of
object should be verified (Ingress), what are the exempted namespaces, and what kinds of pathType are blocked.

10
docs/examples/openpolicyagent/template.yaml
View file

@ -17,11 +17,11 @@ spec:
properties:
blockedTypes:
type: array
items:
type: string
items:
type: string
namespacesExceptions:
type: array
items:
items:
type: string
targets:
- target: admission.k8s.gatekeeper.sh
@ -31,8 +31,8 @@ spec:
violation[{"msg": msg}] {
input.review.kind.kind == "Ingress"
ns := input.review.object.metadata.namespace
excemptNS := [good | excempts = input.parameters.namespacesExceptions[_] ; good = excempts == ns]
not any(excemptNS)
exemptNS := [good | exempts = input.parameters.namespacesExceptions[_] ; good = exempts == ns]
not any(exemptNS)
pathType := object.get(input.review.object.spec.rules[_].http.paths[_], "pathType", "")
blockedPath := [blocked | blockedTypes = input.parameters.blockedTypes[_] ; blocked = blockedTypes == pathType]
any(blockedPath)