disable path overlap validation flag

[Fsero]

What this PR does / why we need it:

In #5651 there was a
request to throw an error when there are two ingresses defining the same
host and path, which was implemented as part of the validation webhook.

Despite of this there are clear rules on the ingress controller that
describes what the controller would do in such situation (the oldest
rule wins)

Some users are relying on this validation behaviour to prevent
misconfigurations, but there are use cases where allowing it, maybe
temporarily, is helpful. Those use cases includes:

• Splitting large ingresses objects in smaller ones Impossible to change hostname<->ingress mapping without downtime due to admission webhook #10820
• Moving ingress objects between namespaces without downtime (like when you transfer an ingress from team A that owns namespace A to team B that owns namespace B) support disabling admission-webhook for creating duplicates #10090

Types of changes

• Bug fix (non-breaking change which fixes an issue)

• New feature (non-breaking change which adds functionality)

• CVE Report (Scanner found CVE and adding report)

• Breaking change (fix or feature that would cause existing functionality to change)

• Documentation only

  Which issue/s this PR fixes

fixes #10820
fixes #10090

How Has This Been Tested?

building an image and testing it in a local cluster, will update later
with some real life scenarios

Checklist:

• My change requires a change to the documentation.
• I have updated the documentation accordingly.
• I've read the CONTRIBUTION guide
• I have added unit and/or e2e tests to cover my changes.
• All new and existing tests passed.

Change-Id: I9d4124d1c36876b06d63100cd10988eaf2f41db9

[netlify]

✅ Deploy Preview for kubernetes-ingress-nginx canceled.

Name	Link
🔨 Latest commit	e9664c2
🔍 Latest deploy log	https://app.netlify.com/sites/kubernetes-ingress-nginx/deploys/6745e21e433cde0008b63a70

[k8s-ci-robot]

Welcome @Fsero!

It looks like this is your first PR to kubernetes/ingress-nginx 🎉. Please refer to our pull request process documentation to help your PR have a smooth ride to approval.

You will be prompted by a bot to use commands during the review process. Do not be afraid to follow the prompts! It is okay to experiment. Here is the bot commands documentation.

You can also check if kubernetes/ingress-nginx has its own contribution guidelines.

You may want to refer to our testing guide if you run into trouble with your tests not passing.

If you are having difficulty getting your pull request seen, please follow the recommended escalation practices. Also, for tips and tricks in the contribution process you may want to read the Kubernetes contributor cheat sheet. We want to make sure your contribution gets all the attention it needs!

Thank you, and welcome to Kubernetes. 😃

[k8s-ci-robot]

Hi @Fsero. Thanks for your PR.

I'm waiting for a kubernetes member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[longwuyuan]

From the K8S official resources, it will be useful to add a link here that covers the specs and KEP for any ingress-controller, to deal with duplicate routing rule factors like identical hostname and identical path.

[strongjz]

I'm not sure about adding footguns like this to the configuration.

With that said, we can add it but disable it as default, so the cluster admin has to choose to allow it consciously.

It may be in the check overlap function, but can you ensure this dumps out a warning in the admission logs?

Can you add an e2e test about this with it enabled and disabled?

[strongjz]

/kind feature

[Fsero]

@strongjz @cpanato @rikatz just rebased in top of main this PR, waiting for approvals.

Is there something else I can do to merge this one?

Thanks a lot

[sarahkadar]

Hi, is there an update on this? We're running into this exact issue and merging this PR would solve it.

[tao12345666333]

Moving ingress objects between namespaces without downtime

I believe that this use case has practical significance.

Please resolve the conflicts.

[Fsero]

done @tao12345666333

[Fsero]

@strongjz @rikatz @cpanato is there something else I can do to merge this one?

Thanks a lot

[cpanato]

lets wait a bit more on this, i will discuss that with @rikatz when we both have a time

[tao12345666333]

We can add it to the list for our next community meeting. @strongjz

[Fsero]

We can add it to the list for our next community meeting. @strongjz

hey! any news on this?

thanks so much

[airhorns]

What's the hesitation on this? It seems super valuable to me -- happy to provide more feedback about why if that'd be helpful!

[Fsero]

@strongjz @rikatz @cpanato sometime has passed and this one it's still open, do you need something else that I can do?

Thanks!

[Fsero]

resurfacing this again @strongjz @rikatz @cpanato do you need me to do something else? do you want me to join the community meeting to explain I think this is useful (we are using this internally in our fork)

Thanks a lot

[tao12345666333]

Sorry for the long delay.

As I replied before, I think this case has practical significance.
#10943 (comment)

@Fsero @airhorns You can join the community meeting next time or post details here.
We want to know more about the background and the value of this use case.

[airhorns]

My use case is described here: #10820 -- in order to make that change, we needed to manually remove the validating webhook in k8s which felt quite risky, make the change, then add it back after removing the duplicates. I can confirm the actual controller was fine with the duplicate resources.

I had an ingress resource that had multiple host names, which locked me in to using the same set of ingress-nginx annotations for each. I wanted to start customizing some annotations for various hostnames, like turning on consistent hashing for a subset of customer domains, or adjusting the rate limit for big tenants up, but I couldn't split the ingress into one ingress resource per hostname without this flag. Can I provide any more info?

[sarahkadar]

This would be so incredibly useful.

[Fsero]

let's see if i can explain an use case, imagine you have a company with several teams deploying microservices, there is a good amount of traffic in the service and in the ingress, and due to an internal change you want to transfer the service from team foo to team bar.

Original microservice offered two endpoints /apple and /banana and team bar will get ownership of /banana while /apple will remain managed by foo.

you can setup this scenario in a local kind (I actually created one with make dev-env) and try to apply the following manifest

apiVersion: v1
kind: Namespace
metadata:
  labels:
    kubernetes.io/metadata.name: foo
  name: foo
spec:
  finalizers:
  - kubernetes
---
apiVersion: v1
kind: Namespace
metadata:
  labels:
    kubernetes.io/metadata.name: bar
  name: bar
spec:
  finalizers:
  - kubernetes
---
kind: Pod
apiVersion: v1
metadata:
  name: banana-app
  namespace: foo
  labels:
    app: banana
spec:
  containers:
    - name: banana-app
      image: hashicorp/http-echo
      args:
        - "-text=banana"
---
kind: Service
apiVersion: v1
metadata:
  name: banana-service
  namespace: foo
spec:
  selector:
    app: banana
  ports:
    - port: 5678 # Default port for image
---
kind: Pod
apiVersion: v1
metadata:
  name: apple-app
  namespace: bar
  labels:
    app: apple
spec:
  containers:
    - name: apple-app
      image: hashicorp/http-echo
      args:
        - "-text=apple"
---

kind: Service
apiVersion: v1
metadata:
  name: apple-service
  namespace: bar
spec:
  selector:
    app: apple
  ports:
    - port: 5678 # Default port for image
    
---


apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: one-ingress
  namespace: foo
  annotations:
    ingress.kubernetes.io/rewrite-target: /
spec:
  ingressClassName: nginx
  rules:
  - host: foo.bar.io
    http:
      paths:
        - path: /apple
          pathType: Prefix
          backend:
            service:
               name: apple-service
               port: 
                 number: 5678
        - path: /banana
          pathType: Prefix
          backend:
            service:
                name: banana-service
                port:
                  number: 5678
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: another-ingress
  namespace: bar
  annotations:
    ingress.kubernetes.io/rewrite-target: /
spec:
  ingressClassName: nginx
  rules:
  - host: foo.bar.io
    http:
      paths:
        - path: /banana
          pathType: Prefix
          backend:
            service:
                name: banana-service
                port:
                  number: 5678

bar team members have read this part of the documentation of ingress nginx and thought that would be very neat to create an ingress and deploy the service for some local test and allow the original service to handle the traffic so when everything is ready foo team just need to edit one-ingress object and remove the /banana path and team bar will start receiving traffic with 0 downtime.

but when someone in bar tries to apply the manifest it finds the following error

ingress.networking.k8s.io/one-ingress unchanged
Error from server (BadRequest): error when creating "manifest.yaml": admission webhook "validate.nginx.ingress.kubernetes.io" denied the request: host "foo.bar.io" and path "/banana" is already defined in ingress foo/one-ingress

for most cases that might be a valid protection but when you want to achieve zero downtime traffic migrations between ingress objects is counterproductive.

This is the purpose of this PR give an opt-in flag that allows maintainers to bypass this and only this validation without disabling the rest of admission validations that are still useful.

cc @tao12345666333 @strongjz @rikatz