fix: deny locations with invalid auth-url annotation #8256

nabokihms · 2022-02-17T21:58:31Z

Signed-off-by: m.nabokikh maksim.nabokikh@flant.com

What this PR does / why we need it:

There is a problem, that when you set an invalid URL as a value for the nginx.ingress.kubernetes.io/auth-url annotation, the ingress controller allows accessing upstreams without authentication.

Thus, this is considered a security hole. Users can accidentally set an invalid URL by hand or because of an error in helm templates.

For example, the following template nginx.ingress.kubernetes.io/auth-url: "https://auth.{{ .Value.namespace }}.cluster.local" in case if the .Value.namespace variable is empty, will generate the invalid domain - https://auth..cluster.local.

It may lead to the disclosure of sensitive data protected by the https://auth.{{ .Value.namespace }}.cluster.local. Instead of allowing access if auth-url is invalid, let's deny the server location completely.

Types of changes

Bug fix (non-breaking change which fixes an issue)
New feature (non-breaking change which adds functionality)
Breaking change (fix or feature that would cause existing functionality to change)
Documentation only

Which issue/s this PR fixes

No issues. I decided to go with PR because it is easier to present my idea.

How Has This Been Tested?

I added an integration test. Without changes from this PR, I see the following log:

Error:          
  expected status equal to:
  "503 Service Unavailable"
                                                
  but got:
  "200 OK"

Test: [Annotations] auth-* with invalid auth-url should deny the whole location should return 503 (location was denied)

This means, that location is not protected, and everyone can access it without authentication.

Checklist:

My change requires a change to the documentation.
I have updated the documentation accordingly.
I've read the CONTRIBUTION guide
I have added tests to cover my changes.
All new and existing tests passed.

Signed-off-by: m.nabokikh <maksim.nabokikh@flant.com>

k8s-ci-robot · 2022-02-17T21:58:39Z

Hi @nabokihms. Thanks for your PR.

I'm waiting for a kubernetes member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

strongjz · 2022-02-21T19:21:05Z

/triage accepted
/kind bug
/priority important-longterm
/lgtm

Signed-off-by: m.nabokikh <maksim.nabokikh@flant.com>

nabokihms · 2022-02-22T13:26:16Z

I've deleted the failed test because it is duplicated by another test (I overlooked it working on the fix). Everything should be fine now.

nabokihms · 2022-02-22T13:27:01Z

/test pull-ingress-nginx-test

k8s-ci-robot · 2022-02-22T13:27:15Z

@nabokihms: Cannot trigger testing until a trusted user reviews the PR and leaves an /ok-to-test message.

In response to this:

/test pull-ingress-nginx-test

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

strongjz · 2022-02-24T15:08:30Z

/ok-to-test

nabokihms · 2022-02-25T12:16:57Z

/test pull-ingress-nginx-test

strongjz · 2022-02-25T15:18:12Z

/approve

iamNoah1 · 2022-03-01T10:09:01Z

/lgtm

k8s-ci-robot · 2022-03-01T10:09:45Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: iamNoah1, nabokihms, strongjz

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [strongjz]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

remove 0.46.0 from supported versions table (kubernetes#8258) Minor fix for missing pathType property (kubernetes#8244) Updated confusing error (kubernetes#8262) Add a certificate info metric (kubernetes#8253) When the ingress controller loads certificates (new ones or following a secret update), it performs a series of check to ensure its validity. In our systems, we detected a case where, when the secret object is compromised, for example when the certificate does not match the secret key, different pods of the ingress controller are serving a different version of the certificate. This behaviour is due to the cache mechanism of the ingress controller, keeping the last known certificate in case of corruption. When this happens, old ingress-controller pods will keep serving the old one, while new pods, by failing to load the corrupted certificates, would use the default certificate, causing invalid certificates for its clients. This generates a random error on the client side, depending on the actual pod instance it reaches. In order to allow detecting occurences of those situations, add a metric to expose, for all ingress controlller pods, detailed informations of the currently loaded certificate. This will, for example, allow setting an alert when there is a certificate discrepency across all ingress controller pods using a query similar to `sum(nginx_ingress_controller_ssl_certificate_info{host="name.tld"})by(serial_number)` This also allows to catch other exceptions loading certificates (failing to load the certificate from the k8s API, ... Co-authored-by: Daniel Ricart <danielricart@users.noreply.github.com> Co-authored-by: Daniel Ricart <danielricart@users.noreply.github.com> Issue#8241 (kubernetes#8273) * replace daemon set for deployment manifest * nit Start Release process for v1.1.2 (kubernetes#8275) Signed-off-by: Jintao Zhang <zhangjintao9020@gmail.com> Add fsGroup value to admission-webhooks/job-patch charts (kubernetes#8267) * added fsGroup to admission createSecret and patchWebhook job * added fsGroup to admission createSecret and patchWebhook job * modified helm/README.md to add value for fsGroup * fixed patch job values ordering * remove manually edited README for replacement with helm-docs generated version * re-adding charts/README.md generated by helm-docs Add OpenSSF Best practices badge (kubernetes#8277) fix: deny locations with invalid auth-url annotation (kubernetes#8256) * fix: deny locations with invalid auth-url annotation Signed-off-by: m.nabokikh <maksim.nabokikh@flant.com> * Delete duplicate test Signed-off-by: m.nabokikh <maksim.nabokikh@flant.com> force prow job by changing something in images/ot dir (kubernetes#8281) Images dir was merged in before the test-infra prow job, so the image was never built. kubernetes#8013 Jan 16 https://github.com/kubernetes/test-infra/pull/25344/files Prow job 4 days ago. Fix OpenTelemetry sidecar image build (kubernetes#8286) * fix wrong checksum for nginx image * fix wrong platform. Arm64 has grpc, when arm doesn't update tag for image (kubernetes#8290) remove git tag env from cloud build the latest git tag is from helm, so force the make file use of TAG ?=v$(shell date +%m%d%Y)-$(shell git rev-parse --short HEAD) release-v1.1.2-continued (kubernetes#8294) * v1.1.2 release Signed-off-by: Jintao Zhang <zhangjintao9020@gmail.com> * release-v1.1.2-continued Co-authored-by: Jintao Zhang <zhangjintao9020@gmail.com> docs: fix changelog formatting (kubernetes#8302) leaving it the git tag (kubernetes#8311) fixing the git tag for the image version, it is what it is . Missing annotations (kubernetes#8288) Not quite sure but It seems that `nginx.ingress.kubernetes.io/canary-by-header` is missing. Names cannot contain _ (underscore)! So I changed it to -. (kubernetes#8300) * The name can't use _(underscore)! So fix it! The name can't use _(underscore)! So fix it! * Fix configMap name can't use _(underscore) Fix configMap name can't use _(underscore) Pinned GitHub workflows by SHA (kubernetes#8334) - Pinned actions by SHA https://github.com/ossf/scorecard/blob/main/docs/checks.md#pinned-dependencies - Included permissions for some of the actions. https://github.com/ossf/scorecard/blob/main/docs/checks.md#token-permissions Dependabot can upgrade pinned version of actions. Update monitoring.md (kubernetes#8324) Added missing repo on "helm upgrade" command Add the shareProcessNamespace as a configurable setting. (kubernetes#8287) Nginx v1.19.10 (kubernetes#8307) kubectl code overview info

* fix: deny locations with invalid auth-url annotation Signed-off-by: m.nabokikh <maksim.nabokikh@flant.com> * Delete duplicate test Signed-off-by: m.nabokikh <maksim.nabokikh@flant.com>

fix: deny locations with invalid auth-url annotation

b033369

Signed-off-by: m.nabokikh <maksim.nabokikh@flant.com>

k8s-ci-robot added cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. needs-triage Indicates an issue or PR lacks a `triage/foo` label and requires one. needs-kind Indicates a PR lacks a `kind/foo` label and requires one. labels Feb 17, 2022

k8s-ci-robot added needs-priority needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. size/M Denotes a PR that changes 30-99 lines, ignoring generated files. labels Feb 17, 2022

k8s-ci-robot requested review from ElvinEfendi and rikatz February 17, 2022 21:59

k8s-ci-robot assigned strongjz Feb 21, 2022

k8s-ci-robot added lgtm "Looks good to me", indicates that a PR is ready to be merged. approved Indicates a PR has been approved by an approver from all required OWNERS files. labels Feb 21, 2022

Delete duplicate test

19a50e5

Signed-off-by: m.nabokikh <maksim.nabokikh@flant.com>

k8s-ci-robot removed the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Feb 22, 2022

k8s-ci-robot added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Feb 24, 2022

k8s-ci-robot assigned iamNoah1 Mar 1, 2022

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Mar 1, 2022

k8s-ci-robot merged commit 1e2ce80 into kubernetes:main Mar 1, 2022

nabokihms mentioned this pull request Oct 10, 2022

REQUEST: New membership for nabokihms kubernetes/org#3756

Closed

9 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix: deny locations with invalid auth-url annotation #8256

fix: deny locations with invalid auth-url annotation #8256

nabokihms commented Feb 17, 2022 •

edited

Loading

k8s-ci-robot commented Feb 17, 2022

strongjz commented Feb 21, 2022

nabokihms commented Feb 22, 2022

nabokihms commented Feb 22, 2022

k8s-ci-robot commented Feb 22, 2022

strongjz commented Feb 24, 2022

nabokihms commented Feb 25, 2022

strongjz commented Feb 25, 2022

iamNoah1 commented Mar 1, 2022

k8s-ci-robot commented Mar 1, 2022

fix: deny locations with invalid auth-url annotation #8256

fix: deny locations with invalid auth-url annotation #8256

Conversation

nabokihms commented Feb 17, 2022 • edited Loading

What this PR does / why we need it:

Types of changes

Which issue/s this PR fixes

How Has This Been Tested?

Checklist:

k8s-ci-robot commented Feb 17, 2022

strongjz commented Feb 21, 2022

nabokihms commented Feb 22, 2022

nabokihms commented Feb 22, 2022

k8s-ci-robot commented Feb 22, 2022

strongjz commented Feb 24, 2022

nabokihms commented Feb 25, 2022

strongjz commented Feb 25, 2022

iamNoah1 commented Mar 1, 2022

k8s-ci-robot commented Mar 1, 2022

nabokihms commented Feb 17, 2022 •

edited

Loading