Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Deprecate and remove snippet annotations #11667

Open
rikatz opened this issue Jul 21, 2024 · 2 comments
Open

Deprecate and remove snippet annotations #11667

rikatz opened this issue Jul 21, 2024 · 2 comments
Labels
kind/deprecation Categorizes issue or PR as related to a feature/enhancement marked for deprecation. needs-priority needs-triage Indicates an issue or PR lacks a `triage/foo` label and requires one.

Comments

@rikatz
Copy link
Contributor

rikatz commented Jul 21, 2024

Ingress NGINX has 130 annotations, and still some of the required features are not implemented.

The workaround to expose more of the NGINX functionality to users was to allow snippet annotations, which in fact allows users to add their own configuration to nginx.conf.

The problem is that these kind of annotation allow users to add random and dangerous configurations and present a security risk for the project.

This way, I propose that we deprecate and remove snippet annotations and configuration from Ingress NGINX and future features should be analyzed and implemented via proper annotations or only if supported on the Gateway API annotations

/kind deprecation
@k8s-ci-robot k8s-ci-robot added kind/deprecation Categorizes issue or PR as related to a feature/enhancement marked for deprecation. needs-triage Indicates an issue or PR lacks a `triage/foo` label and requires one. labels Jul 21, 2024
@k8s-ci-robot
Copy link
Contributor

This issue is currently awaiting triage.

If Ingress contributors determines this is a relevant issue, they will accept it by applying the triage/accepted label and provide further guidance.

The triage/accepted label can be added by org members by writing /triage accepted in a comment.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@zeeZ
Copy link
Contributor

zeeZ commented Jul 22, 2024

The ability to add custom configuration to nginx is a feature for me, and I cannot realistically see it replaced by annotations or even the gateway API. We're making extensive use of maps, custom rate limits and rewrites, for example.

The potential for a "security risk" lies entirely with the operator running the controller, with snippet annotations already being turned off by default now. There is no risk to the project itself and I'm not happy to just hand wave a "you have been warned" feature away because someone could potentially misconfigure something.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
kind/deprecation Categorizes issue or PR as related to a feature/enhancement marked for deprecation. needs-priority needs-triage Indicates an issue or PR lacks a `triage/foo` label and requires one.
Projects
[sig-network] Ingress-Nginx
Status: No status
Milestone
No milestone
Development

No branches or pull requests
3 participants
@zeeZ @rikatz @k8s-ci-robot