CORS annotations improvements
This commit is contained in:
Ricardo Pchevuzinske Katz
parent
3e2b36adc4
commit
79edb1f9d1
7 changed files with 200 additions and 53 deletions
|
|
@ -52,12 +52,20 @@ Key:
|
|||
| `base-url-scheme` | Specify the scheme of the `<base>` tags. | | nginx
|
||||
| `preserve-host` | Whether to pass the client request host (`true`) or the origin hostname (`false`) in the HTTP Host field. | | trafficserver
|
||||
|
||||
## CORS Related
|
||||
| Name | Meaning | Default | Controller
|
||||
| --- | --- | --- | --- |
|
||||
| `enable-cors` | Enable CORS headers in response. | false | nginx, voyager
|
||||
| `cors-allow-origin` | Specifies the Origin allowed in CORS (Access-Control-Allow-Origin) | * | nginx
|
||||
| `cors-allow-headers` | Specifies the Headers allowed in CORS (Access-Control-Allow-Headers) | DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization | nginx
|
||||
| `cors-allow-methods` | Specifies the Methods allowed in CORS (Access-Control-Allow-Methods) | GET, PUT, POST, DELETE, PATCH, OPTIONS | nginx
|
||||
| `cors-allow-credentials` | Specifies the Access-Control-Allow-Credentials | true | nginx
|
||||
|
||||
## Miscellaneous
|
||||
|
||||
| Name | Meaning | Default | Controller
|
||||
| --- | --- | --- | --- |
|
||||
| `configuration-snippet` | Arbitrary text to put in the generated configuration file. | | nginx
|
||||
| `enable-cors` | Enable CORS headers in response. | | nginx, voyager
|
||||
| `limit-connections` | Limit concurrent connections per IP address[1]. | | nginx, voyager
|
||||
| `limit-rps` | Limit requests per second per IP address[1]. | | nginx, voyager
|
||||
| `limit-rpm` | Limit requests per minute per IP address. | | nginx, voyager
|
||||
|
|
|
|||
|
|
@ -20,6 +20,10 @@ The following annotations are supported:
|
|||
|[ingress.kubernetes.io/configuration-snippet](#configuration-snippet)|string|
|
||||
|[ingress.kubernetes.io/default-backend](#default-backend)|string|
|
||||
|[ingress.kubernetes.io/enable-cors](#enable-cors)|true or false|
|
||||
|[ingress.kubernetes.io/cors-allow-origin](#enable-cors)|string|
|
||||
|[ingress.kubernetes.io/cors-allow-methods](#enable-cors)|string|
|
||||
|[ingress.kubernetes.io/cors-allow-headers](#enable-cors)|string|
|
||||
|[ingress.kubernetes.io/cors-allow-credentials](#enable-cors)|true or false|
|
||||
|[ingress.kubernetes.io/force-ssl-redirect](#server-side-https-enforcement-through-redirect)|true or false|
|
||||
|[ingress.kubernetes.io/from-to-www-redirect](#redirect-from-to-www)|true or false|
|
||||
|[ingress.kubernetes.io/limit-connections](#rate-limiting)|number|
|
||||
|
|
@ -162,6 +166,26 @@ This is a global configuration for the ingress controller. In some cases could b
|
|||
### Enable CORS
|
||||
|
||||
To enable Cross-Origin Resource Sharing (CORS) in an Ingress rule add the annotation `ingress.kubernetes.io/enable-cors: "true"`. This will add a section in the server location enabling this functionality.
|
||||
|
||||
CORS can be controlled with the following annotations:
|
||||
|
||||
* `ingress.kubernetes.io/cors-allow-methods` controls which methods are accepted. This is a multi-valued field, separated by ',' and accepts only letters (upper and lower case).
|
||||
|
||||
Example: `ingress.kubernetes.io/cors-allow-methods: "PUT, GET, POST, OPTIONS"`
|
||||
|
||||
* `ingress.kubernetes.io/cors-allow-headers` controls which headers are accepted. This is a multi-valued field, separated by ',' and accepts letters, numbers, _ and -.
|
||||
|
||||
Example: `ingress.kubernetes.io/cors-allow-methods: "X-Forwarded-For, X-app123-XPTO"`
|
||||
|
||||
* `ingress.kubernetes.io/cors-allow-origin` controls what's the accepted Origin for CORS and defaults to '*'. This is a single field value, with the following format: http(s)://origin-site.com or http(s)://origin-site.com:port
|
||||
|
||||
Example: `ingress.kubernetes.io/cors-allow-origin: "https://origin-site.com:4443"`
|
||||
|
||||
* `ingress.kubernetes.io/cors-allow-credentials` controls if credentials can be passed during CORS operations.
|
||||
|
||||
Example: `ingress.kubernetes.io/cors-allow-credentials: "true"`
|
||||
|
||||
|
||||
For more information please check https://enable-cors.org/server_nginx.html
|
||||
|
||||
### Server Alias
|
||||
|
|
|
|||
|
|
@ -17,6 +17,8 @@ limitations under the License.
|
|||
package cors
|
||||
|
||||
import (
|
||||
"regexp"
|
||||
|
||||
extensions "k8s.io/api/extensions/v1beta1"
|
||||
|
||||
"k8s.io/ingress-nginx/pkg/ingress/annotations/parser"
|
||||
|
|
@ -28,6 +30,22 @@ const (
|
|||
annotationCorsAllowMethods = "ingress.kubernetes.io/cors-allow-methods"
|
||||
annotationCorsAllowHeaders = "ingress.kubernetes.io/cors-allow-headers"
|
||||
annotationCorsAllowCredentials = "ingress.kubernetes.io/cors-allow-credentials"
|
||||
// Default values
|
||||
defaultCorsMethods = "GET, PUT, POST, DELETE, PATCH, OPTIONS"
|
||||
defaultCorsHeaders = "DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization"
|
||||
)
|
||||
|
||||
var (
|
||||
// Regex are defined here to prevent information leak, if user tries to set anything not valid
|
||||
// that could cause the Response to contain some internal value/variable (like returning $pid, $upstream_addr, etc)
|
||||
// Origin must contain a http/s Origin (including or not the port) or the value '*'
|
||||
corsOriginRegex = regexp.MustCompile(`^(https?://[A-Za-z0-9\-\.]*(:[0-9]+)?|\*)?$`)
|
||||
// Method must contain valid methods list (PUT, GET, POST, BLA)
|
||||
// May contain or not spaces between each verb
|
||||
corsMethodsRegex = regexp.MustCompile(`^([A-Za-z]+,?\s?)+$`)
|
||||
// Headers must contain valid values only (X-HEADER12, X-ABC)
|
||||
// May contain or not spaces between each Header
|
||||
corsHeadersRegex = regexp.MustCompile(`^([A-Za-z0-9\-\_]+,?\s?)+$`)
|
||||
)
|
||||
|
||||
type cors struct {
|
||||
|
|
@ -56,18 +74,18 @@ func (a cors) Parse(ing *extensions.Ingress) (interface{}, error) {
|
|||
}
|
||||
|
||||
corsalloworigin, err := parser.GetStringAnnotation(annotationCorsAllowOrigin, ing)
|
||||
if err != nil || corsalloworigin == "" {
|
||||
if err != nil || corsalloworigin == "" || !corsOriginRegex.MatchString(corsalloworigin) {
|
||||
corsalloworigin = "*"
|
||||
}
|
||||
|
||||
corsallowheaders, err := parser.GetStringAnnotation(annotationCorsAllowHeaders, ing)
|
||||
if err != nil || corsallowheaders == "" {
|
||||
corsallowheaders = "'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization"
|
||||
if err != nil || corsallowheaders == "" || !corsHeadersRegex.MatchString(corsallowheaders) {
|
||||
corsallowheaders = defaultCorsHeaders
|
||||
}
|
||||
|
||||
corsallowmethods, err := parser.GetStringAnnotation(annotationCorsAllowMethods, ing)
|
||||
if err != nil || corsallowmethods == "" {
|
||||
corsallowheaders = "GET, PUT, POST, DELETE, PATCH, OPTIONS"
|
||||
if err != nil || corsallowmethods == "" || !corsMethodsRegex.MatchString(corsallowmethods) {
|
||||
corsallowmethods = defaultCorsMethods
|
||||
}
|
||||
|
||||
corsallowcredentials, err := parser.GetBoolAnnotation(annotationCorsAllowCredentials, ing)
|
||||
|
|
|
|||
|
|
@ -22,42 +22,75 @@ import (
|
|||
api "k8s.io/api/core/v1"
|
||||
extensions "k8s.io/api/extensions/v1beta1"
|
||||
meta_v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
||||
"k8s.io/apimachinery/pkg/util/intstr"
|
||||
)
|
||||
|
||||
const (
|
||||
notCorsAnnotation = "ingress.kubernetes.io/enable-not-cors"
|
||||
)
|
||||
|
||||
func TestParse(t *testing.T) {
|
||||
ap := NewParser()
|
||||
if ap == nil {
|
||||
t.Fatalf("expected a parser.IngressAnnotation but returned nil")
|
||||
func buildIngress() *extensions.Ingress {
|
||||
defaultBackend := extensions.IngressBackend{
|
||||
ServiceName: "default-backend",
|
||||
ServicePort: intstr.FromInt(80),
|
||||
}
|
||||
|
||||
testCases := []struct {
|
||||
annotations map[string]string
|
||||
expected bool
|
||||
}{
|
||||
{map[string]string{annotation: "true"}, true},
|
||||
{map[string]string{annotation: "false"}, false},
|
||||
{map[string]string{notCorsAnnotation: "true"}, false},
|
||||
{map[string]string{}, false},
|
||||
{nil, false},
|
||||
}
|
||||
|
||||
ing := &extensions.Ingress{
|
||||
return &extensions.Ingress{
|
||||
ObjectMeta: meta_v1.ObjectMeta{
|
||||
Name: "foo",
|
||||
Namespace: api.NamespaceDefault,
|
||||
},
|
||||
Spec: extensions.IngressSpec{},
|
||||
}
|
||||
|
||||
for _, testCase := range testCases {
|
||||
ing.SetAnnotations(testCase.annotations)
|
||||
result, _ := ap.Parse(ing)
|
||||
if result != testCase.expected {
|
||||
t.Errorf("expected %t but returned %t, annotations: %s", testCase.expected, result, testCase.annotations)
|
||||
}
|
||||
Spec: extensions.IngressSpec{
|
||||
Backend: &extensions.IngressBackend{
|
||||
ServiceName: "default-backend",
|
||||
ServicePort: intstr.FromInt(80),
|
||||
},
|
||||
Rules: []extensions.IngressRule{
|
||||
{
|
||||
Host: "foo.bar.com",
|
||||
IngressRuleValue: extensions.IngressRuleValue{
|
||||
HTTP: &extensions.HTTPIngressRuleValue{
|
||||
Paths: []extensions.HTTPIngressPath{
|
||||
{
|
||||
Path: "/foo",
|
||||
Backend: defaultBackend,
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
}
|
||||
}
|
||||
|
||||
func TestIngressCorsConfig(t *testing.T) {
|
||||
ing := buildIngress()
|
||||
|
||||
data := map[string]string{}
|
||||
data[annotationCorsEnabled] = "true"
|
||||
data[annotationCorsAllowHeaders] = "DNT,X-CustomHeader, Keep-Alive,User-Agent"
|
||||
data[annotationCorsAllowCredentials] = "false"
|
||||
data[annotationCorsAllowMethods] = "PUT, GET,OPTIONS, PATCH, $nginx_version"
|
||||
data[annotationCorsAllowOrigin] = "https://origin123.test.com:4443"
|
||||
ing.SetAnnotations(data)
|
||||
|
||||
corst, _ := NewParser().Parse(ing)
|
||||
nginxCors, ok := corst.(*CorsConfig)
|
||||
if !ok {
|
||||
t.Errorf("expected a Config type")
|
||||
}
|
||||
|
||||
if nginxCors.CorsEnabled != true {
|
||||
t.Errorf("expected cors enabled but returned %v", nginxCors.CorsEnabled)
|
||||
}
|
||||
|
||||
if nginxCors.CorsAllowHeaders != "DNT,X-CustomHeader, Keep-Alive,User-Agent" {
|
||||
t.Errorf("expected headers not found. Found %v", nginxCors.CorsAllowHeaders)
|
||||
}
|
||||
|
||||
if nginxCors.CorsAllowMethods != "GET, PUT, POST, DELETE, PATCH, OPTIONS" {
|
||||
t.Errorf("expected default methods, but got %v", nginxCors.CorsAllowMethods)
|
||||
}
|
||||
|
||||
if nginxCors.CorsAllowOrigin != "https://origin123.test.com:4443" {
|
||||
t.Errorf("expected origin https://origin123.test.com:4443, but got %v", nginxCors.CorsAllowOrigin)
|
||||
}
|
||||
|
||||
}
|
||||
|
|
|
|||
|
|
@ -130,6 +130,7 @@ const (
|
|||
sessionAffinity = "SessionAffinity"
|
||||
serviceUpstream = "ServiceUpstream"
|
||||
serverAlias = "Alias"
|
||||
enableCors = "EnableCORS"
|
||||
clientBodyBufferSize = "ClientBodyBufferSize"
|
||||
certificateAuth = "CertificateAuth"
|
||||
serverSnippet = "ServerSnippet"
|
||||
|
|
@ -175,6 +176,11 @@ func (e *annotationExtractor) SessionAffinity(ing *extensions.Ingress) *sessiona
|
|||
return val.(*sessionaffinity.AffinityConfig)
|
||||
}
|
||||
|
||||
func (e *annotationExtractor) Cors(ing *extensions.Ingress) *cors.CorsConfig {
|
||||
val, _ := e.annotations[enableCors].Parse(ing)
|
||||
return val.(*cors.CorsConfig)
|
||||
}
|
||||
|
||||
func (e *annotationExtractor) CertificateAuth(ing *extensions.Ingress) *authtls.AuthSSLConfig {
|
||||
val, err := e.annotations[certificateAuth].Parse(ing)
|
||||
if errors.IsMissingAnnotations(err) {
|
||||
|
|
|
|||
|
|
@ -29,15 +29,22 @@ import (
|
|||
)
|
||||
|
||||
const (
|
||||
annotationSecureUpstream = "ingress.kubernetes.io/secure-backends"
|
||||
annotationSecureVerifyCACert = "ingress.kubernetes.io/secure-verify-ca-secret"
|
||||
annotationUpsMaxFails = "ingress.kubernetes.io/upstream-max-fails"
|
||||
annotationUpsFailTimeout = "ingress.kubernetes.io/upstream-fail-timeout"
|
||||
annotationPassthrough = "ingress.kubernetes.io/ssl-passthrough"
|
||||
annotationAffinityType = "ingress.kubernetes.io/affinity"
|
||||
annotationAffinityCookieName = "ingress.kubernetes.io/session-cookie-name"
|
||||
annotationAffinityCookieHash = "ingress.kubernetes.io/session-cookie-hash"
|
||||
annotationUpstreamHashBy = "ingress.kubernetes.io/upstream-hash-by"
|
||||
annotationSecureUpstream = "ingress.kubernetes.io/secure-backends"
|
||||
annotationSecureVerifyCACert = "ingress.kubernetes.io/secure-verify-ca-secret"
|
||||
annotationUpsMaxFails = "ingress.kubernetes.io/upstream-max-fails"
|
||||
annotationUpsFailTimeout = "ingress.kubernetes.io/upstream-fail-timeout"
|
||||
annotationPassthrough = "ingress.kubernetes.io/ssl-passthrough"
|
||||
annotationAffinityType = "ingress.kubernetes.io/affinity"
|
||||
annotationCorsEnabled = "ingress.kubernetes.io/enable-cors"
|
||||
annotationCorsAllowOrigin = "ingress.kubernetes.io/cors-allow-origin"
|
||||
annotationCorsAllowMethods = "ingress.kubernetes.io/cors-allow-methods"
|
||||
annotationCorsAllowHeaders = "ingress.kubernetes.io/cors-allow-headers"
|
||||
annotationCorsAllowCredentials = "ingress.kubernetes.io/cors-allow-credentials"
|
||||
defaultCorsMethods = "GET, PUT, POST, DELETE, PATCH, OPTIONS"
|
||||
defaultCorsHeaders = "DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization"
|
||||
annotationAffinityCookieName = "ingress.kubernetes.io/session-cookie-name"
|
||||
annotationAffinityCookieHash = "ingress.kubernetes.io/session-cookie-hash"
|
||||
annotationUpstreamHashBy = "ingress.kubernetes.io/upstream-hash-by"
|
||||
)
|
||||
|
||||
type mockCfg struct {
|
||||
|
|
@ -293,3 +300,54 @@ func TestAffinitySession(t *testing.T) {
|
|||
}
|
||||
}
|
||||
}
|
||||
|
||||
func TestCors(t *testing.T) {
|
||||
ec := newAnnotationExtractor(mockCfg{})
|
||||
ing := buildIngress()
|
||||
|
||||
fooAnns := []struct {
|
||||
annotations map[string]string
|
||||
corsenabled bool
|
||||
methods string
|
||||
headers string
|
||||
origin string
|
||||
credentials bool
|
||||
}{
|
||||
{map[string]string{annotationCorsEnabled: "true"}, true, defaultCorsMethods, defaultCorsHeaders, "*", true},
|
||||
{map[string]string{annotationCorsEnabled: "true", annotationCorsAllowMethods: "POST, GET, OPTIONS", annotationCorsAllowHeaders: "$nginx_version", annotationCorsAllowCredentials: "false"}, true, "POST, GET, OPTIONS", defaultCorsHeaders, "*", false},
|
||||
{map[string]string{annotationCorsEnabled: "true", annotationCorsAllowCredentials: "false"}, true, defaultCorsMethods, defaultCorsHeaders, "*", false},
|
||||
{map[string]string{}, false, defaultCorsMethods, defaultCorsHeaders, "*", true},
|
||||
{nil, false, defaultCorsMethods, defaultCorsHeaders, "*", true},
|
||||
}
|
||||
|
||||
for _, foo := range fooAnns {
|
||||
ing.SetAnnotations(foo.annotations)
|
||||
r := ec.Cors(ing)
|
||||
t.Logf("Testing pass %v %v %v %v %v", foo.corsenabled, foo.methods, foo.headers, foo.origin, foo.credentials)
|
||||
if r == nil {
|
||||
t.Errorf("Returned nil but expected a Cors.CorsConfig")
|
||||
continue
|
||||
}
|
||||
|
||||
if r.CorsEnabled != foo.corsenabled {
|
||||
t.Errorf("Returned %v but expected %v for Cors Enabled", r.CorsEnabled, foo.corsenabled)
|
||||
}
|
||||
|
||||
if r.CorsAllowHeaders != foo.headers {
|
||||
t.Errorf("Returned %v but expected %v for Cors Headers", r.CorsAllowHeaders, foo.headers)
|
||||
}
|
||||
|
||||
if r.CorsAllowMethods != foo.methods {
|
||||
t.Errorf("Returned %v but expected %v for Cors Methods", r.CorsAllowMethods, foo.methods)
|
||||
}
|
||||
|
||||
if r.CorsAllowOrigin != foo.origin {
|
||||
t.Errorf("Returned %v but expected %v for Cors Methods", r.CorsAllowOrigin, foo.origin)
|
||||
}
|
||||
|
||||
if r.CorsAllowCredentials != foo.credentials {
|
||||
t.Errorf("Returned %v but expected %v for Cors Methods", r.CorsAllowCredentials, foo.credentials)
|
||||
}
|
||||
|
||||
}
|
||||
}
|
||||
|
|
|
|||
|
|
@ -506,16 +506,16 @@ stream {
|
|||
{{/* CORS support from https://michielkalkman.com/snippets/nginx-cors-open-configuration.html */}}
|
||||
{{ define "CORS" }}
|
||||
if ($request_method = 'OPTIONS') {
|
||||
add_header 'Access-Control-Allow-Origin' '*';
|
||||
add_header 'Access-Control-Allow-Origin' '{{ $location.CorsConfig.CorsAllowOrigin }}';
|
||||
#
|
||||
# Om nom nom cookies
|
||||
#
|
||||
add_header 'Access-Control-Allow-Credentials' 'true';
|
||||
add_header 'Access-Control-Allow-Methods' 'GET, PUT, POST, DELETE, PATCH, OPTIONS';
|
||||
add_header 'Access-Control-Allow-Credentials' '{{ $location.CorsConfig.CorsAllowCredentials }}';
|
||||
add_header 'Access-Control-Allow-Methods' '{{ $location.CorsConfig.CorsAllowMethods }}';
|
||||
#
|
||||
# Custom headers and headers various browsers *should* be OK with but aren't
|
||||
#
|
||||
add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization';
|
||||
add_header 'Access-Control-Allow-Headers' '{{ $location.CorsConfig.CorsAllowHeaders }}';
|
||||
#
|
||||
# Tell client that this pre-flight info is valid for 20 days
|
||||
#
|
||||
|
|
@ -542,10 +542,10 @@ stream {
|
|||
}
|
||||
|
||||
if ($cors_method = 1) {
|
||||
add_header 'Access-Control-Allow-Origin' '*' always;
|
||||
add_header 'Access-Control-Allow-Credentials' 'true';
|
||||
add_header 'Access-Control-Allow-Methods' 'GET, PUT, POST, DELETE, PATCH, OPTIONS';
|
||||
add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization';
|
||||
add_header 'Access-Control-Allow-Origin' '{{ $location.CorsConfig.CorsAllowOrigin }} ' always;
|
||||
add_header 'Access-Control-Allow-Credentials' '{{ $location.CorsConfig.CorsAllowCredentials }}';
|
||||
add_header 'Access-Control-Allow-Methods' '{{ $location.CorsConfig.CorsAllowMethods }}';
|
||||
add_header 'Access-Control-Allow-Headers' '{{ $location.CorsConfig.CorsAllowHeaders }}';
|
||||
}
|
||||
{{ end }}
|
||||
|
||||
|
|
@ -719,7 +719,7 @@ stream {
|
|||
proxy_set_header Authorization "";
|
||||
{{ end }}
|
||||
|
||||
{{ if $location.EnableCORS }}
|
||||
{{ if $location.CorsConfig.CorsEnabled }}
|
||||
{{ template "CORS" }}
|
||||
{{ end }}
|
||||
|
||||
|
|
|
|||
Loading…
Reference in a new issue