Azure / Azure/AKS

[Feedback] web-app-routing annotations blocklist too strict

Open
#5,111 3 comments 0 reactions 2 assignees Claimed by @jack4it View on GitHub
addon/app-routing Feedback
Dominant language
TypeScript
Stars
2.1k
Forks
395
Avg merge
2d 22h
Merged PRs (30d)
13

Description

**Describe your scenario**

I am deploying AKS with the `web-app-routing` plugin enabled.
One ingress of the deployment I am managing on AKS contains the following annotation snippet:

```yaml
nginx.ingress.kubernetes.io/configuration-snippet: |
Content-Security-Policy: frame-ancestors 'self' https://www.example.org;
```

Which, however, results in the nginx-ingress controller to ignore the ingress with the following warning:

```
skipping ingress default/echo-server-ingress: nginx.ingress.kubernetes.io/configuration-snippet annotation contains invalid word '
```

This happens because the nginx-ingress configuration contains an annotation blocklist that includes the `'` character:

```yaml
annotation-value-word-blocklist: load_module,lua_package,_by_lua,location,root,proxy_pass,serviceaccount,{,},'
```

Patching the configuration to remove the `'` character results in the ingress working as expected.

**Feedback**

When defining the source for the frame-ancestor in a Content-Secuirty-Policy directive the single quotes `'` are [mandatory](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Content-Security-Policy/frame-ancestors#syntax), therefore it seems to me that the blocklist deployed by default is too strict and can cause hard to debug ingress issues to AKS users.

I would thus suggest to remove `'` from the blocklist of the nginx-ingress controller configuration.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.