[Feedback] web-app-routing annotations blocklist too strict
- Dominant language
- TypeScript
- Stars
- 2.1k
- Forks
- 395
- Avg merge
- 2d 22h
- Merged PRs (30d)
- 13
Description
**Describe your scenario**
I am deploying AKS with the `web-app-routing` plugin enabled.
One ingress of the deployment I am managing on AKS contains the following annotation snippet:
```yaml
nginx.ingress.kubernetes.io/configuration-snippet: |
Content-Security-Policy: frame-ancestors 'self' https://www.example.org;
```
Which, however, results in the nginx-ingress controller to ignore the ingress with the following warning:
```
skipping ingress default/echo-server-ingress: nginx.ingress.kubernetes.io/configuration-snippet annotation contains invalid word '
```
This happens because the nginx-ingress configuration contains an annotation blocklist that includes the `'` character:
```yaml
annotation-value-word-blocklist: load_module,lua_package,_by_lua,location,root,proxy_pass,serviceaccount,{,},'
```
Patching the configuration to remove the `'` character results in the ingress working as expected.
**Feedback**
When defining the source for the frame-ancestor in a Content-Secuirty-Policy directive the single quotes `'` are [mandatory](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Content-Security-Policy/frame-ancestors#syntax), therefore it seems to me that the blocklist deployed by default is too strict and can cause hard to debug ingress issues to AKS users.
I would thus suggest to remove `'` from the blocklist of the nginx-ingress controller configuration.
Contributor guide
Assessment
This issue has not been assessed yet.