Skip to content

Commit

Permalink
squashing
Browse files Browse the repository at this point in the history 
set x-forwarded-scheme like x-forwarded-proto

Add support for custom probes (kubernetes#7137)

* Add support for custom probes

* Fix lint issue with comment

* Bump chart version

* Fix lint issue

Allowing mod-security to be enabled from the controller

formatting

formatting

Allowing mod-security to be enabled from the controller

formatting

formatting

formatting
  • Loading branch information
@gabatwork
Matthew Silverman authored and gabatwork committed May 21, 2021
1 parent 1b1f7d3 commit 8765d11
Show file tree
Hide file tree
Showing 7 changed files with 127 additions and 52 deletions.
2 changes: 1 addition & 1 deletion charts/ingress-nginx/Chart.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@ apiVersion: v2
name: ingress-nginx
# When the version is modified, make sure the artifacthub.io/changes list is updated
# Also update CHANGELOG.md
version: 3.30.0
version: 3.31.0
appVersion: 0.46.0
home: https://github.com/kubernetes/ingress-nginx
description: Ingress controller for Kubernetes using NGINX as a reverse proxy and load balancer
Expand Down
25 changes: 5 additions & 20 deletions charts/ingress-nginx/templates/controller-daemonset.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -139,26 +139,11 @@ spec:
{{- if .Values.controller.extraEnvs }}
{{- toYaml .Values.controller.extraEnvs | nindent 12 }}
{{- end }}
livenessProbe:
httpGet:
path: {{ .Values.controller.healthCheckPath }}
port: {{ .Values.controller.livenessProbe.port }}
scheme: HTTP
initialDelaySeconds: {{ .Values.controller.livenessProbe.initialDelaySeconds }}
periodSeconds: {{ .Values.controller.livenessProbe.periodSeconds }}
timeoutSeconds: {{ .Values.controller.livenessProbe.timeoutSeconds }}
successThreshold: {{ .Values.controller.livenessProbe.successThreshold }}
failureThreshold: {{ .Values.controller.livenessProbe.failureThreshold }}
readinessProbe:
httpGet:
path: {{ .Values.controller.healthCheckPath }}
port: {{ .Values.controller.readinessProbe.port }}
scheme: HTTP
initialDelaySeconds: {{ .Values.controller.readinessProbe.initialDelaySeconds }}
periodSeconds: {{ .Values.controller.readinessProbe.periodSeconds }}
timeoutSeconds: {{ .Values.controller.readinessProbe.timeoutSeconds }}
successThreshold: {{ .Values.controller.readinessProbe.successThreshold }}
failureThreshold: {{ .Values.controller.readinessProbe.failureThreshold }}
{{- if .Values.controller.startupProbe }}
startupProbe: {{ toYaml .Values.controller.startupProbe | nindent 12 }}
{{- end }}
livenessProbe: {{ toYaml .Values.controller.livenessProbe | nindent 12 }}
readinessProbe: {{ toYaml .Values.controller.readinessProbe | nindent 12 }}
ports:
{{- range $key, $value := .Values.controller.containerPort }}
- name: {{ $key }}
Expand Down
25 changes: 5 additions & 20 deletions charts/ingress-nginx/templates/controller-deployment.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -139,27 +139,12 @@ spec:
{{- end }}
{{- if .Values.controller.extraEnvs }}
{{- toYaml .Values.controller.extraEnvs | nindent 12 }}
{{- end }}
{{- if .Values.controller.startupProbe }}
startupProbe: {{ toYaml .Values.controller.startupProbe | nindent 12 }}
{{- end }}
livenessProbe:
httpGet:
path: {{ .Values.controller.healthCheckPath }}
port: {{ .Values.controller.livenessProbe.port }}
scheme: HTTP
initialDelaySeconds: {{ .Values.controller.livenessProbe.initialDelaySeconds }}
periodSeconds: {{ .Values.controller.livenessProbe.periodSeconds }}
timeoutSeconds: {{ .Values.controller.livenessProbe.timeoutSeconds }}
successThreshold: {{ .Values.controller.livenessProbe.successThreshold }}
failureThreshold: {{ .Values.controller.livenessProbe.failureThreshold }}
readinessProbe:
httpGet:
path: {{ .Values.controller.healthCheckPath }}
port: {{ .Values.controller.readinessProbe.port }}
scheme: HTTP
initialDelaySeconds: {{ .Values.controller.readinessProbe.initialDelaySeconds }}
periodSeconds: {{ .Values.controller.readinessProbe.periodSeconds }}
timeoutSeconds: {{ .Values.controller.readinessProbe.timeoutSeconds }}
successThreshold: {{ .Values.controller.readinessProbe.successThreshold }}
failureThreshold: {{ .Values.controller.readinessProbe.failureThreshold }}
livenessProbe: {{ toYaml .Values.controller.livenessProbe | nindent 12 }}
readinessProbe: {{ toYaml .Values.controller.readinessProbe | nindent 12 }}
ports:
{{- range $key, $value := .Values.controller.containerPort }}
- name: {{ $key }}
Expand Down
32 changes: 26 additions & 6 deletions charts/ingress-nginx/values.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -251,20 +251,40 @@ controller:
## Liveness and readiness probe values
## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes
##
# startupProbe:
# httpGet:
# # should match container.healthCheckPath
# path: "/healthz"
# port: 10254
# scheme: HTTP
# initialDelaySeconds: 5
# periodSeconds: 5
# timeoutSeconds: 2
# successThreshold: 1
# failureThreshold: 5
livenessProbe:
failureThreshold: 5
httpGet:
# should match container.healthCheckPath
path: "/healthz"
port: 10254
scheme: HTTP
initialDelaySeconds: 10
periodSeconds: 10
successThreshold: 1
timeoutSeconds: 1
port: 10254
successThreshold: 1
failureThreshold: 5
readinessProbe:
failureThreshold: 3
httpGet:
# should match container.healthCheckPath
path: "/healthz"
port: 10254
scheme: HTTP
initialDelaySeconds: 10
periodSeconds: 10
successThreshold: 1
timeoutSeconds: 1
port: 10254
successThreshold: 1
failureThreshold: 3


# Path of the health check endpoint. All requests received on the port defined by
# the healthz-port parameter are forwarded internally to this path.
Expand Down
11 changes: 6 additions & 5 deletions rootfs/etc/nginx/template/nginx.tmpl
View file
Original file line number Diff line number Diff line change
Expand Up @@ -149,16 +149,16 @@ http {
{{ if $all.Cfg.EnableModsecurity }}
modsecurity on;

modsecurity_rules_file /etc/nginx/modsecurity/modsecurity.conf;

{{ if $all.Cfg.EnableOWASPCoreRules }}
modsecurity_rules_file /etc/nginx/owasp-modsecurity-crs/nginx-modsecurity.conf;
{{ else if (not (empty $all.Cfg.ModsecuritySnippet)) }}
{{ if (not (empty $all.Cfg.ModsecuritySnippet)) }}
modsecurity_rules '
{{ $all.Cfg.ModsecuritySnippet }}
';
{{ end }}
modsecurity_rules_file /etc/nginx/modsecurity/modsecurity.conf;

{{ if $all.Cfg.EnableOWASPCoreRules }}
modsecurity_rules_file /etc/nginx/owasp-modsecurity-crs/nginx-modsecurity.conf;
{{ end }}
{{ end }}

{{ if $cfg.UseGeoIP }}
Expand Down Expand Up @@ -1253,6 +1253,7 @@ stream {
{{ $proxySetHeader }} X-Forwarded-Host $best_http_host;
{{ $proxySetHeader }} X-Forwarded-Port $pass_port;
{{ $proxySetHeader }} X-Forwarded-Proto $pass_access_scheme;
{{ $proxySetHeader }} X-Forwarded-Scheme $pass_access_scheme;
{{ if $all.Cfg.ProxyAddOriginalURIHeader }}
{{ $proxySetHeader }} X-Original-URI $request_uri;
{{ end }}
Expand Down
79 changes: 79 additions & 0 deletions test/e2e/annotations/modsecurity.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -216,4 +216,83 @@ var _ = framework.DescribeAnnotation("modsecurity owasp", func() {
Expect().
Status(http.StatusForbidden)
})

ginkgo.It("should enable modsecurity when enable-owasp-modsecurity-crs is set to true", func() {
host := "modsecurity.foo.com"
nameSpace := f.Namespace

snippet := `SecRuleEngine On
SecRequestBodyAccess On
SecAuditEngine RelevantOnly
SecAuditLogParts ABIJDEFHZ
SecAuditLog /dev/stdout
SecAuditLogType Serial
SecRule REQUEST_HEADERS:User-Agent \"block-ua\" \"log,deny,id:107,status:403,msg:\'UA blocked\'\"`

annotations := map[string]string{
"nginx.ingress.kubernetes.io/modsecurity-snippet": snippet,
}

ing := framework.NewSingleIngress(host, "/", host, nameSpace, framework.EchoService, 80, annotations)
f.EnsureIngress(ing)

f.SetNginxConfigMapData(map[string]string{
"enable-modsecurity": "true",
"enable-owasp-modsecurity-crs": "true",
})


f.WaitForNginxServer(host,
func(server string) bool {
return strings.Contains(server, "SecRuleEngine On")
})

f.HTTPTestClient().
GET("/").
WithHeader("Host", host).
WithHeader("User-Agent", "block-ua").
Expect().
Status(http.StatusForbidden)
})

ginkgo.It("should enable modsecurity through the config map", func() {
host := "modsecurity.foo.com"
nameSpace := f.Namespace

snippet := `SecRequestBodyAccess On
SecAuditEngine RelevantOnly
SecAuditLogParts ABIJDEFHZ
SecAuditLog /dev/stdout
SecAuditLogType Serial
SecRule REQUEST_HEADERS:User-Agent \"block-ua\" \"log,deny,id:107,status:403,msg:\'UA blocked\'\"`

annotations := map[string]string{
"nginx.ingress.kubernetes.io/modsecurity-snippet": snippet,
}

ing := framework.NewSingleIngress(host, "/", host, nameSpace, framework.EchoService, 80, annotations)
f.EnsureIngress(ing)

expectedComment := "SecRuleEngine On"

f.SetNginxConfigMapData(map[string]string{
"enable-modsecurity": "true",
"enable-owasp-modsecurity-crs": "true",
"modsecurity-snippet": expectedComment,
})

f.WaitForNginxServer(host,
func(server string) bool {
return true
})

f.HTTPTestClient().
GET("/").
WithHeader("Host", host).
WithHeader("User-Agent", "block-ua").
Expect().
Status(http.StatusForbidden)
})


})
5 changes: 5 additions & 0 deletions test/e2e/settings/forwarded_headers.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -57,6 +57,7 @@ var _ = framework.DescribeSetting("use-forwarded-headers", func() {
WithHeader("Host", host).
WithHeader("X-Forwarded-Port", "1234").
WithHeader("X-Forwarded-Proto", "myproto").
WithHeader("X-Forwarded-Scheme", "myproto").
WithHeader("X-Forwarded-For", "1.2.3.4").
WithHeader("X-Forwarded-Host", "myhost").
Expect().
Expand All @@ -67,6 +68,7 @@ var _ = framework.DescribeSetting("use-forwarded-headers", func() {
assert.Contains(ginkgo.GinkgoT(), body, fmt.Sprintf("host=myhost"))
assert.Contains(ginkgo.GinkgoT(), body, fmt.Sprintf("x-forwarded-host=myhost"))
assert.Contains(ginkgo.GinkgoT(), body, fmt.Sprintf("x-forwarded-proto=myproto"))
assert.Contains(ginkgo.GinkgoT(), body, fmt.Sprintf("x-forwarded-scheme=myproto"))
assert.Contains(ginkgo.GinkgoT(), body, fmt.Sprintf("x-forwarded-port=1234"))
assert.Contains(ginkgo.GinkgoT(), body, fmt.Sprintf("x-forwarded-for=1.2.3.4"))

Expand Down Expand Up @@ -105,6 +107,7 @@ var _ = framework.DescribeSetting("use-forwarded-headers", func() {
WithHeader("Host", host).
WithHeader("X-Forwarded-Port", "1234").
WithHeader("X-Forwarded-Proto", "myproto").
WithHeader("X-Forwarded-Scheme", "myproto").
WithHeader("X-Forwarded-For", "1.2.3.4").
WithHeader("X-Forwarded-Host", "myhost").
Expect().
Expand All @@ -115,10 +118,12 @@ var _ = framework.DescribeSetting("use-forwarded-headers", func() {
assert.Contains(ginkgo.GinkgoT(), body, fmt.Sprintf("host=forwarded-headers"))
assert.Contains(ginkgo.GinkgoT(), body, fmt.Sprintf("x-forwarded-port=80"))
assert.Contains(ginkgo.GinkgoT(), body, fmt.Sprintf("x-forwarded-proto=http"))
assert.Contains(ginkgo.GinkgoT(), body, fmt.Sprintf("x-forwarded-scheme=http"))
assert.Contains(ginkgo.GinkgoT(), body, fmt.Sprintf("x-original-forwarded-for=1.2.3.4"))
assert.NotContains(ginkgo.GinkgoT(), body, fmt.Sprintf("host=myhost"))
assert.NotContains(ginkgo.GinkgoT(), body, fmt.Sprintf("x-forwarded-host=myhost"))
assert.NotContains(ginkgo.GinkgoT(), body, fmt.Sprintf("x-forwarded-proto=myproto"))
assert.NotContains(ginkgo.GinkgoT(), body, fmt.Sprintf("x-forwarded-scheme=myproto"))
assert.NotContains(ginkgo.GinkgoT(), body, fmt.Sprintf("x-forwarded-port=1234"))
assert.NotContains(ginkgo.GinkgoT(), body, fmt.Sprintf("x-forwarded-for=1.2.3.4"))
})
Expand Down

0 comments on commit 8765d11

Please sign in to comment.