Skip to content

Commit 3cdcd47

Browse files
FseroFsero
committed
Add disable path overlap validation flag
 ## What this PR does / why we need it: In #5651 there was a request to throw an error when there are two ingresses defining the same host and path, which was implemented as part of the validation webhook. Despite of this there are clear rules on the ingress controller that describes what the controller would do in [such situation (the oldest rule wins)](https://github.com/kubernetes/ingress-nginx/blob/main/docs/how-it-works.md?plain=1#L27) Some users are relying on this validation behaviour to prevent misconfigurations, but there are use cases where allowing it, maybe temporarily, is helpful. Those use cases includes: - Splitting large ingresses objects in smaller ones #10820 - Moving ingress objects between namespaces without downtime (like when you transfer an ingress from team A that owns namespace A to team B that owns namespace B) #10090 <!--- What types of changes does your code introduce? Put an `x` in all the boxes that apply: --> ## Types of changes - [ ] Bug fix (non-breaking change which fixes an issue) - [X] New feature (non-breaking change which adds functionality) - [ ] CVE Report (Scanner found CVE and adding report) - [ ] Breaking change (fix or feature that would cause existing functionality to change) - [ ] Documentation only ## Which issue/s this PR fixes fixes #10820 fixes #10090 <!--- Please describe in detail how you tested your changes. --> <!--- Include details of your testing environment, and the tests you ran to --> <!--- see how your change affects other areas of the code, etc. --> ## How Has This Been Tested? building an image and testing it in a local cluster, will update later with some real life scenarios <!--- Go over all the following points, and put an `x` in all the boxes that apply. --> <!--- If you're unsure about any of these, don't hesitate to ask. We're here to help! --> ## Checklist: - [X] My change requires a change to the documentation. - [ ] I have updated the documentation accordingly. - [X] I've read the [CONTRIBUTION](https://github.com/kubernetes/ingress-nginx/blob/main/CONTRIBUTING.md) guide - [X] I have added unit and/or e2e tests to cover my changes. - [X] All new and existing tests passed. Change-Id: I9d4124d1c36876b06d63100cd10988eaf2f41db9
1 parent e00b45b commit 3cdcd47

File tree

3 files changed

+127
-39
lines changed

3 files changed

+127
-39
lines changed

‎internal/ingress/controller/controller.go

Lines changed: 11 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -116,10 +116,11 @@ type Configuration struct {
116116

117117
IngressClassConfiguration *ingressclass.Configuration
118118

119-
ValidationWebhook string
120-
ValidationWebhookCertPath string
121-
ValidationWebhookKeyPath string
122-
DisableFullValidationTest bool
119+
ValidationWebhook string
120+
ValidationWebhookCertPath string
121+
ValidationWebhookKeyPath string
122+
DisableFullValidationTest bool
123+
DisablePathOverlapValidation bool
123124

124125
GlobalExternalAuth *ngx_config.GlobalExternalAuth
125126
MaxmindEditionFiles *[]string
@@ -402,7 +403,7 @@ func (n *NGINXController) CheckIngress(ing *networking.Ingress) error {
402403
startTest := time.Now().UnixNano() / 1000000
403404
_, servers, pcfg := n.getConfiguration(ings)
404405

405-
err = checkOverlap(ing, servers)
406+
err = checkOverlap(ing, servers, n.cfg.DisablePathOverlapValidation)
406407
if err != nil {
407408
n.metricCollector.IncCheckErrorCount(ing.ObjectMeta.Namespace, ing.Name)
408409
return err
@@ -1779,7 +1780,7 @@ func externalNamePorts(name string, svc *apiv1.Service) *apiv1.ServicePort {
17791780
}
17801781
}
17811782

1782-
func checkOverlap(ing *networking.Ingress, servers []*ingress.Server) error {
1783+
func checkOverlap(ing *networking.Ingress, servers []*ingress.Server, disablePathOverlapValidation bool) error {
17831784
for _, rule := range ing.Spec.Rules {
17841785
if rule.HTTP == nil {
17851786
continue
@@ -1814,6 +1815,10 @@ func checkOverlap(ing *networking.Ingress, servers []*ingress.Server) error {
18141815
}
18151816
}
18161817

1818+
if disablePathOverlapValidation {
1819+
return nil
1820+
}
1821+
18171822
// path overlap. Check if one of the ingresses has a canary annotation
18181823
isCanaryEnabled, annotationErr := parser.GetBoolAnnotation("canary", ing, canary.CanaryAnnotations.Annotations)
18191824
for _, existing := range existingIngresses {

‎internal/ingress/controller/controller_test.go

Lines changed: 77 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -357,6 +357,83 @@ func TestCheckIngress(t *testing.T) {
357357
t.Errorf("with a new ingress without error, no error should be returned")
358358
}
359359
})
360+
361+
t.Run("When there is a duplicated ingress with same host and path it should error", func(t *testing.T) {
362+
ing := &networking.Ingress{
363+
ObjectMeta: metav1.ObjectMeta{
364+
Name: "test-ingress",
365+
Namespace: "test-namespace",
366+
Annotations: map[string]string{
367+
"kubernetes.io/ingress.class": "nginx",
368+
},
369+
},
370+
Spec: networking.IngressSpec{
371+
Rules: []networking.IngressRule{
372+
{
373+
Host: "example.com",
374+
IngressRuleValue: networking.IngressRuleValue{
375+
HTTP: &networking.HTTPIngressRuleValue{
376+
Paths: []networking.HTTPIngressPath{
377+
{
378+
Path: "/",
379+
PathType: &pathTypePrefix,
380+
Backend: networking.IngressBackend{
381+
Service: &networking.IngressServiceBackend{
382+
Name: "http-svc",
383+
Port: networking.ServiceBackendPort{
384+
Number: 80,
385+
Name: "http",
386+
},
387+
},
388+
},
389+
},
390+
},
391+
},
392+
},
393+
},
394+
},
395+
},
396+
}
397+
398+
nginx.store = &fakeIngressStore{
399+
ingresses: []*ingress.Ingress{
400+
{
401+
Ingress: *ing,
402+
ParsedAnnotations: &annotations.Ingress{},
403+
},
404+
},
405+
}
406+
duplicatedIngress := ing.DeepCopy()
407+
duplicatedIngress.ObjectMeta.Name = "duplicated-ingress"
408+
409+
nginx.cfg.DisablePathOverlapValidation = false
410+
nginx.command = testNginxTestCommand{
411+
t: t,
412+
err: nil,
413+
expected: "_,example.com",
414+
}
415+
416+
err = nginx.CheckIngress(duplicatedIngress)
417+
if err == nil {
418+
t.Errorf("expected errors but noone occurred")
419+
}
420+
t.Run("if disablePathOverlap is enabled should not throw any error", func(t *testing.T) {
421+
duplicatedIngress := ing.DeepCopy()
422+
duplicatedIngress.ObjectMeta.Name = "duplicated-ingress"
423+
424+
nginx.cfg.DisablePathOverlapValidation = true
425+
nginx.command = testNginxTestCommand{
426+
t: t,
427+
err: nil,
428+
expected: "_,example.com",
429+
}
430+
431+
err = nginx.CheckIngress(duplicatedIngress)
432+
if err != nil {
433+
t.Errorf("expected no errors but one %+v occurred", err)
434+
}
435+
})
436+
})
360437
})
361438

362439
t.Run("When the ingress is marked as deleted", func(t *testing.T) {

‎pkg/flags/flags.go

Lines changed: 39 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -198,6 +198,11 @@ Takes the form "<host>:port". If not provided, no admission controller is starte
198198
`The path of the validating webhook certificate PEM.`)
199199
validationWebhookKey = flags.String("validating-webhook-key", "",
200200
`The path of the validating webhook key PEM.`)
201+
disablePathOverlapValidation = flags.Bool("disable-path-overlap-validation", false,
202+
`Disable path overlap validation. Validation webhook blocks creating ingresses with the same hostname and path in the same ingressClass.
203+
These flags turn off this validation as it helps split ingresses or move them between namespaces as it relies on the existing model rules:
204+
'If the same path for the same host is defined in more than one Ingress, the oldest rule wins'`)
205+
201206
disableFullValidationTest = flags.Bool("disable-full-test", false,
202207
`Disable full test of all merged ingresses at the admission stage and tests the template of the ingress being created or updated (full test of all ingresses is enabled by default).`)
203208

@@ -320,39 +325,40 @@ https://blog.maxmind.com/2019/12/18/significant-changes-to-accessing-and-using-g
320325
ngx_config.EnableSSLChainCompletion = *enableSSLChainCompletion
321326

322327
config := &controller.Configuration{
323-
APIServerHost: *apiserverHost,
324-
KubeConfigFile: *kubeConfigFile,
325-
UpdateStatus: *updateStatus,
326-
ElectionID: *electionID,
327-
EnableProfiling: *profiling,
328-
EnableMetrics: *enableMetrics,
329-
MetricsPerHost: *metricsPerHost,
330-
MetricsBuckets: histogramBuckets,
331-
ReportStatusClasses: *reportStatusClasses,
332-
ExcludeSocketMetrics: *excludeSocketMetrics,
333-
MonitorMaxBatchSize: *monitorMaxBatchSize,
334-
DisableServiceExternalName: *disableServiceExternalName,
335-
EnableSSLPassthrough: *enableSSLPassthrough,
336-
ResyncPeriod: *resyncPeriod,
337-
DefaultService: *defaultSvc,
338-
Namespace: *watchNamespace,
339-
WatchNamespaceSelector: namespaceSelector,
340-
ConfigMapName: *configMap,
341-
TCPConfigMapName: *tcpConfigMapName,
342-
UDPConfigMapName: *udpConfigMapName,
343-
DisableFullValidationTest: *disableFullValidationTest,
344-
DefaultSSLCertificate: *defSSLCertificate,
345-
DeepInspector: *deepInspector,
346-
PublishService: *publishSvc,
347-
PublishStatusAddress: *publishStatusAddress,
348-
UpdateStatusOnShutdown: *updateStatusOnShutdown,
349-
ShutdownGracePeriod: *shutdownGracePeriod,
350-
PostShutdownGracePeriod: *postShutdownGracePeriod,
351-
UseNodeInternalIP: *useNodeInternalIP,
352-
SyncRateLimit: *syncRateLimit,
353-
HealthCheckHost: *healthzHost,
354-
DynamicConfigurationRetries: *dynamicConfigurationRetries,
355-
EnableTopologyAwareRouting: *enableTopologyAwareRouting,
328+
APIServerHost: *apiserverHost,
329+
KubeConfigFile: *kubeConfigFile,
330+
UpdateStatus: *updateStatus,
331+
ElectionID: *electionID,
332+
EnableProfiling: *profiling,
333+
EnableMetrics: *enableMetrics,
334+
MetricsPerHost: *metricsPerHost,
335+
MetricsBuckets: histogramBuckets,
336+
ReportStatusClasses: *reportStatusClasses,
337+
ExcludeSocketMetrics: *excludeSocketMetrics,
338+
MonitorMaxBatchSize: *monitorMaxBatchSize,
339+
DisableServiceExternalName: *disableServiceExternalName,
340+
EnableSSLPassthrough: *enableSSLPassthrough,
341+
ResyncPeriod: *resyncPeriod,
342+
DefaultService: *defaultSvc,
343+
Namespace: *watchNamespace,
344+
WatchNamespaceSelector: namespaceSelector,
345+
ConfigMapName: *configMap,
346+
TCPConfigMapName: *tcpConfigMapName,
347+
UDPConfigMapName: *udpConfigMapName,
348+
DisableFullValidationTest: *disableFullValidationTest,
349+
DisablePathOverlapValidation: *disablePathOverlapValidation,
350+
DefaultSSLCertificate: *defSSLCertificate,
351+
DeepInspector: *deepInspector,
352+
PublishService: *publishSvc,
353+
PublishStatusAddress: *publishStatusAddress,
354+
UpdateStatusOnShutdown: *updateStatusOnShutdown,
355+
ShutdownGracePeriod: *shutdownGracePeriod,
356+
PostShutdownGracePeriod: *postShutdownGracePeriod,
357+
UseNodeInternalIP: *useNodeInternalIP,
358+
SyncRateLimit: *syncRateLimit,
359+
HealthCheckHost: *healthzHost,
360+
DynamicConfigurationRetries: *dynamicConfigurationRetries,
361+
EnableTopologyAwareRouting: *enableTopologyAwareRouting,
356362
ListenPorts: &ngx_config.ListenPorts{
357363
Default: *defServerPort,
358364
Health: *healthzPort,

0 commit comments

Comments
 (0)