Merge branch 'kubernetes:main' into pie

.github/workflows/helm.yaml

@@ -25,6 +25,18 @@ jobs:
       - name: Checkout
         uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b # v3.2.0
 
+      - name: Run Artifact Hub lint
+        run: |
+          wget https://github.com/artifacthub/hub/releases/download/v1.5.0/ah_1.5.0_linux_amd64.tar.gz
+          echo 'ad0e44c6ea058ab6b85dbf582e88bad9fdbc64ded0d1dd4edbac65133e5c87da *ah_1.5.0_linux_amd64.tar.gz' | shasum -c
+          tar -xzvf ah_1.5.0_linux_amd64.tar.gz ah
+          ./ah lint -p charts/ingress-nginx || exit 1
+          rm -f ./ah ./ah_1.5.0_linux_amd64.tar.gz
+
+      - name: Lint
+        run: |
+          ./build/run-in-docker.sh ./hack/verify-chart-lint.sh
+
       - uses: dorny/paths-filter@4512585405083f25c027a35db413c2b3b9006d50 # v2.11.1
         id: filter
         with:

.github/workflows/vulnerability-scans.yaml

@@ -42,7 +42,7 @@ jobs:
           echo "${SHORT_TAGS[0]},${SHORT_TAGS[1]},${SHORT_TAGS[2]}"
           TAGS_JSON="[\"${SHORT_TAGS[0]}\",\"${SHORT_TAGS[1]}\",\"${SHORT_TAGS[2]}\"]"
           echo "${TAGS_JSON}"
-          echo "::set-output name=TAGS::${TAGS_JSON}"
+          echo "TAGS=${TAGS_JSON}" >> $GITHUB_OUTPUT
 
   scan:
     runs-on: ubuntu-latest

TAG

@@ -1 +1 @@
-v1.6.1
+v1.6.2

pkg/util/ingress/ingress.go

@@ -282,10 +282,12 @@ func checkPath(paths []networkingv1.HTTPIngressPath, enablePathTypeValidation bo
 
 		switch pathType := *path.PathType; pathType {
 		case networkingv1.PathTypeImplementationSpecific:
+			if enablePathTypeValidation {
 				//only match on regex chars per Ingress spec when path is implementation specific
 				if !regexSpecificChars.MatchString(path.Path) {
 					return fmt.Errorf("path %s of type %s contains invalid characters", path.Path, *path.PathType)
 				}
+			}
 
 		case networkingv1.PathTypeExact, networkingv1.PathTypePrefix:
 			//enforce path type validation

pkg/util/ingress/ingress_test.go

@@ -272,7 +272,7 @@ func TestValidateIngressPath(t *testing.T) {
 			name:                     "should reject path when the allowed additional set does not match",
 			wantErr:                  true,
 			additionalChars:          "().?",
-			EnablePathTypeValidation: false,
+			EnablePathTypeValidation: true,
 			copyIng:                  generateDumbIngressforPathTest(&pathTypeImplSpecific, "/foo/bar/(.+)"),
 		},
 		{
@@ -291,7 +291,7 @@ func TestValidateIngressPath(t *testing.T) {
 		{
 			name:                     "should block if at least one path is bad",
 			wantErr:                  true,
-			EnablePathTypeValidation: false,
+			EnablePathTypeValidation: true,
 			copyIng:                  generateComplexIngress(generateDumbIngressforPathTest(&pathTypeImplSpecific, "/foo/bar/(.?)")),
 		},
 	}