sassoftware / viya4-deployment

This project contains Ansible code that creates a baseline in an existing Kubernetes environment for use with the SAS Viya Platform, generates the manifest for an order, and then can also deploy that order into the Kubernetes environment specified.
Apache License 2.0
71 stars 64 forks source link

(IAC-483) Conditionally Patch ingress-nginx Config #202

Closed jarpat closed 2 years ago

jarpat commented 2 years ago

Changes

The mitigation will be applied by default for K8s clusters whose version is >=1.22.x and whose ingress-ngnix version is >=1.1.0 or (>=0.50.0 and <1.0.0, for the updated legacy versions of nginx that support this CVE).

Tests

Performed deployments in AKS on both 1.22.6 & 1.21.9 clusters to see the CVE mitigation patch behavior. All deployments in this table resulted in a healthy Viya deployment.

Cadence K8s Version Ingress-Nginx Version Was CVE Mitigation Applied by Default
2021.2.5 1.22.6 1.1.0 Yes
2021.2.4 1.22.6 1.1.0 Yes
2021.2.5 1.22.6 1.1.1 (Custom INGRESS_NGINX_CHART_VERSION) Yes
Fast R/S 1.22.6 1.1.0 Yes
2021.2.4 1.21.9 0.50.0 No
2021.2.2 1.21.9 0.50.0 No
2021.2 1.21.9 0.50.0 No