search

dirsigler / uptime-kuma-helm

This Helm Chart installs Uptime-Kuma from @louislam to your Kubernetes Cluster.
https://helm.irsigler.cloud
GNU General Public License v3.0
152 stars 53 forks source link

Admission Webhook denies request #7

Closed dirsigler closed 2 years ago

dirsigler commented 2 years ago

If you use the newest ingress-nginx (/ community nginx ingress) Version 1.0.5 you may see following error: Error: UPGRADE FAILED: failed to create resource: admission webhook "validate.nginx.ingress.kubernetes.io" denied the request: nginx.ingress.kubernetes.io/server-snippets annotation contains invalid word location

This is due to a change in the ingress-nginx configuration which was introduced in https://github.com/kubernetes/ingress-nginx/pull/7874. This change solves a security vulnerability which was found in https://github.com/kubernetes/kubernetes/issues/126811.

dirsigler commented 2 years ago

To fix this issue you have to do following:

PLEASE BE AWARE, THIS CHANGE IS GLOBAL AND DEACTIVATES SOME OF THE SECURITY MEASUREMENTS!

# Edit the ingress-nginx-controller ConfigMap in your Ingress namespace
kubectl -n ingress-nginx edit configmap ingress-nginx-controller

# You will find something like:
apiVersion: v1
data:
  allow-snippet-annotations: "true"
kind: ConfigMap

# Add following line into the data map:
annotation-value-word-blocklist: load_module,lua_package,_by_lua,root,serviceaccount,',\

# It should look now like:
apiVersion: v1
data:
  allow-snippet-annotations: "true"
  annotation-value-word-blocklist: load_module,lua_package,_by_lua,root,serviceaccount,',\
kind: ConfigMap

This change overrides the default annotation-value-word-blocklist to allow certain symbols and charakters in a snippet.

strongjz commented 2 years ago

We have fixed the issue with location and other snippets by making it an empty list by default in v1.1.0

We leave the security configuration of the block list to the user.

We are continuing to look into other remediations as well.

/close

dirsigler commented 2 years ago

@strongjz Thank you very much for responding, even tho I just had this here open for myself and others as a simple note 😄

strongjz commented 2 years ago

It was linked from another ingress-nginx issue so I assumed this was one as well, lol. Sorry for stomping on your issue.

dirsigler commented 2 years ago

No worries, really appreciate that I somehow have proper solution here :D Thanks for all your and the Teams efforts!