feat: add a _before hook for plugins

[guilhem]

Current plugin implementation prevents executing before ingress logic.
For example, can be used to correctly set X-Forwarded-Proto before redirect logic.

[k8s-ci-robot]

Welcome @guilhem!

It looks like this is your first PR to kubernetes/ingress-nginx 🎉. Please refer to our pull request process documentation to help your PR have a smooth ride to approval.

You will be prompted by a bot to use commands during the review process. Do not be afraid to follow the prompts! It is okay to experiment. Here is the bot commands documentation.

You can also check if kubernetes/ingress-nginx has its own contribution guidelines.

You may want to refer to our testing guide if you run into trouble with your tests not passing.

If you are having difficulty getting your pull request seen, please follow the recommended escalation practices. Also, for tips and tricks in the contribution process you may want to read the Kubernetes contributor cheat sheet. We want to make sure your contribution gets all the attention it needs!

Thank you, and welcome to Kubernetes. 😃

[k8s-ci-robot]

Hi @guilhem. Thanks for your PR.

I'm waiting for a kubernetes member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[rikatz]

Hi @guilhem and thanks for your PR.

Can you please clarify me when this hook would be required? I can see you adding it into the code but couldn't see why/the use case.

Thanks

[guilhem]

Hi @guilhem and thanks for your PR.

Can you please clarify me when this hook would be required? I can see you adding it into the code but couldn't see why/the use case.

Thanks

Hi @rikatz,
In my case, cloudflare forward request without a X-Forwarded-Proto set. Making backend url rewrite failing.
Some may set it for all sites, but I can't in my case and I have to identify exactly.
I created a Lua cloudflare plugin to set X-Forwarded-Proto correctly but this plugin can't work without this change.

Problem is because, in rewrite_by_lua_block, balancer.rewrite() is before plugins.run()

[guilhem]

Current implementation is a custom template with plugin.run() set before balancer.rewrite(). It works in my case, but it can change current behavior in numerous instances.
Having a before hook looks better.

https://gist.github.com/guilhem/52a2722eceffcd7a29b3b5687deedcd6#file-main-lua

[rikatz]

@tao12345666333 @ElvinEfendi thoughts on this?

@guilhem you use those with custom-snippets or something like that? Just curious :)

[guilhem]

@guilhem you use those with custom-snippets or something like that? Just curious :)

Nope, it's a plugin installed on all ingress-nginx instances.

[tao12345666333]

Adding a hook does mean that we can do some things more flexibly.
But I would like to know if there are other usage scenarios?

[guilhem]

Adding a hook does mean that we can do some things more flexibly.
But I would like to know if there are other usage scenarios?

Main reason for me:
before hook for rewrite is mandatory.
It would be very strange and prone to error if only some steps have one and not others.

Other common usage of "before" hook can be to execute before all other plugins. Ordering can be important.

[rikatz]

Gotta say I'm still just worried about if this can be used for the evil :D

We've had some problems in past with us not sanitizing properly things in Lua side, so can this be, somehow used by a malicious user to run something just appending the _before suffix in some crafted annotation value?

Sorry for the dumb question :)

[guilhem]

You are questioning far beyond my skills ^^
I hope someone can answer it.

[rikatz]

No problem @guilhem :)

I will try to think a bit more as well. I'm not opposed to the feature, just don't wanna add something more that can turn into a future concern :)

[rikatz]

As per @theunrealgeek mention in Slack:

"Following up on #7542 which adds the before hook to Lua plugins. At least in my opinion getting the Lua plugin installed needs quite elevated privileges, and any CVE like possibility is perhaps already present with what support exists and adding the before doesn't make it any worse.".

I can take that, so this is approved.

/approve
/lgtm
Thanks, and thanks @theunrealgeek for the review!

[rikatz]

/hold

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: guilhem, rikatz

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [rikatz]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[rikatz]

/ok-to-test
Let's just leave the e2e tests run first ;)

[iamNoah1]

/kind bug
/triage accepted
/priority important-longterm

#6358

[iamNoah1]

/lifecycle frozen

[k8s-ci-robot]

@iamNoah1: The lifecycle/frozen label cannot be applied to Pull Requests.

In response to this:

/lifecycle frozen

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[iamNoah1]

/remove-lifecycle rotten

[guilhem]

Gentle Ping

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue or PR as fresh with /remove-lifecycle stale
• Mark this issue or PR as rotten with /lifecycle rotten
• Close this issue or PR with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[k8s-triage-robot]

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue or PR as fresh with /remove-lifecycle rotten
• Close this issue or PR with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle rotten

[k8s-triage-robot]

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.

This bot triages PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the PR is closed

You can:

• Reopen this PR with /reopen
• Mark this PR as fresh with /remove-lifecycle rotten
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/close

[k8s-ci-robot]

@k8s-triage-robot: Closed this PR.

In response to this:

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.

This bot triages PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the PR is closed

You can:

• Reopen this PR with /reopen
• Mark this PR as fresh with /remove-lifecycle rotten
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.