DevFW-CICD/ingress-nginx-helm
16
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Deploy GitHub Pages

Browse source
This commit is contained in:
k8s-ci-robot 2020-12-15 22:07:23 +00:00
parent 2d35024ab8
commit b6a46bdf86
9 changed files with 14 additions and 14 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
deploy/hardening-guide/index.html
View file

@ -1385,7 +1385,7 @@ lead to have specific clients unable to reach your site or similar consequences.
<tr>
<td align="left">2.4.2 Ensure requests for unknown host names are rejected (Not Scored)</td>
<td align="left">OK</td>
<td align="left">They are not rejected but send to the "default backend" delivering approriate errors (mostly 404)</td>
<td align="left">They are not rejected but send to the "default backend" delivering appropriate errors (mostly 404)</td>
<td align="left"></td>
</tr>
<tr>
@ -1475,7 +1475,7 @@ lead to have specific clients unable to reach your site or similar consequences.
<tr>
<td align="left">3.4 Ensure log files are rotated (Scored)</td>
<td align="left">OBSOLETE</td>
<td align="left">Log file handling is not part of the nginx ingress and should be handled separatly</td>
<td align="left">Log file handling is not part of the nginx ingress and should be handled separately</td>
<td align="left"></td>
</tr>
<tr>
@ -1577,13 +1577,13 @@ lead to have specific clients unable to reach your site or similar consequences.
<tr>
<td align="left">4.1.10 Ensure upstream server traffic is authenticated with a client certificate (Scored)</td>
<td align="left">DEPENDS ON BACKEND</td>
<td align="left">Highly dependend on backends, not every backend allows configuring this, can also be mitigated via a service mesh</td>
<td align="left">Highly dependent on backends, not every backend allows configuring this, can also be mitigated via a service mesh</td>
<td align="left">If backend allows it, <a href="https://kubernetes.github.io/ingress-nginx/examples/auth/client-certs/">manual is here</a></td>
</tr>
<tr>
<td align="left">4.1.11 Ensure the upstream traffic server certificate is trusted (Not Scored)</td>
<td align="left">DEPENDS ON BACKEND</td>
<td align="left">Highly dependend on backends, not every backend allows configuring this, can also be mitigated via a service mesh</td>
<td align="left">Highly dependent on backends, not every backend allows configuring this, can also be mitigated via a service mesh</td>
<td align="left">If backend allows it, <a href="https://github.com/kubernetes/ingress-nginx/blob/master/docs/user-guide/nginx-configuration/annotations.md#backend-certificate-authentication">see configuration here</a></td>
</tr>
<tr>
@ -1656,7 +1656,7 @@ lead to have specific clients unable to reach your site or similar consequences.
<td align="left">5.2.1 Ensure timeout values for reading the client header and body are set correctly (Scored)</td>
<td align="left">ACTION NEEDED</td>
<td align="left">Default timeout is 60s</td>
<td align="left">Set via <a href="https://github.com/kubernetes/ingress-nginx/blob/master/docs/user-guide/nginx-configuration/configmap.md#client-header-timeout">this configuration parameter</a> and respective body aequivalent</td>
<td align="left">Set via <a href="https://github.com/kubernetes/ingress-nginx/blob/master/docs/user-guide/nginx-configuration/configmap.md#client-header-timeout">this configuration parameter</a> and respective body equivalent</td>
</tr>
<tr>
<td align="left">5.2.2 Ensure the maximum request body size is set correctly (Scored)</td>

2
e2e-tests/index.html
View file

@ -2267,7 +2267,7 @@
</ul>
<h3 id="service-type-externalname"><a href="https://github.com/kubernetes/ingress-nginx/tree/master/test/e2e/servicebackend/service_externalname.go#L37">[Service] Type ExternalName</a><a class="headerlink" href="#service-type-externalname" title="Permanent link"></a></h3>
<ul>
<li><a href="https://github.com/kubernetes/ingress-nginx/tree/master/test/e2e/servicebackend/service_externalname.go#L40">works with external name set to incomplete fdqn</a></li>
<li><a href="https://github.com/kubernetes/ingress-nginx/tree/master/test/e2e/servicebackend/service_externalname.go#L40">works with external name set to incomplete fqdn</a></li>
<li><a href="https://github.com/kubernetes/ingress-nginx/tree/master/test/e2e/servicebackend/service_externalname.go#L73">should return 200 for service type=ExternalName without a port defined</a></li>
<li><a href="https://github.com/kubernetes/ingress-nginx/tree/master/test/e2e/servicebackend/service_externalname.go#L107">should return 200 for service type=ExternalName with a port defined</a></li>
<li><a href="https://github.com/kubernetes/ingress-nginx/tree/master/test/e2e/servicebackend/service_externalname.go#L148">should return status 502 for service type=ExternalName with an invalid host</a></li>

4
enhancements/YYYYMMDD-kep-template/index.html
View file

@ -1313,7 +1313,7 @@ See the KEP process for details on each of these items.</p>
</ul>
<h2 id="summary">Summary<a class="headerlink" href="#summary" title="Permanent link"></a></h2>
<p>The <code>Summary</code> section is incredibly important for producing high quality user-focused documentation such as release notes or a development roadmap.
It should be possible to collect this information before implementation begins in order to avoid requiring implementors to split their attention between writing release notes and implementing the feature itself.</p>
It should be possible to collect this information before implementation begins in order to avoid requiring implementers to split their attention between writing release notes and implementing the feature itself.</p>
<p>A good summary is probably at least a paragraph in length.</p>
<h2 id="motivation">Motivation<a class="headerlink" href="#motivation" title="Permanent link"></a></h2>
<p>This section is for explicitly listing the motivation, goals and non-goals of this KEP.
@ -1337,7 +1337,7 @@ The goal here is to make this feel real for users without getting bogged down.</
<p>What are the caveats to the implementation?
What are some important details that didn't come across above.
Go in to as much detail as necessary here.
This might be a good place to talk about core concepts and how they releate.</p>
This might be a good place to talk about core concepts and how they relate.</p>
<h3 id="risks-and-mitigations">Risks and Mitigations<a class="headerlink" href="#risks-and-mitigations" title="Permanent link"></a></h3>
<p>What are the risks of this proposal and how do we mitigate.
Think broadly.

2
examples/affinity/cookie/index.html
View file

@ -1190,7 +1190,7 @@
</tr>
<tr>
<td>nginx.ingress.kubernetes.io/affinity-mode</td>
<td>The affinity mode defines how sticky a session is. Use <code>balanced</code> to redistribute some sessions when scaling pods or <code>persistent</code> for maximum stickyness.</td>
<td>The affinity mode defines how sticky a session is. Use <code>balanced</code> to redistribute some sessions when scaling pods or <code>persistent</code> for maximum stickiness.</td>
<td><code>balanced</code> (default) or <code>persistent</code></td>
</tr>
<tr>

2
search/search_index.json
View file

File diff suppressed because one or more lines are too long

BIN
sitemap.xml.gz
View file

Binary file not shown.

2
user-guide/cli-arguments/index.html
View file

@ -1249,7 +1249,7 @@
</tr>
<tr>
<td><code>--publish-service</code></td>
<td>Service fronting the Ingress controller. Takes the form "namespace/name". When used together with update-status, the controller mirrors the address of this service's endpoints to the load-balancer status of all Ingress objects it atisfies.</td>
<td>Service fronting the Ingress controller. Takes the form "namespace/name". When used together with update-status, the controller mirrors the address of this service's endpoints to the load-balancer status of all Ingress objects it satisfies.</td>
</tr>
<tr>
<td><code>--publish-status-address</code></td>

4
user-guide/nginx-configuration/annotations/index.html
View file

@ -2380,7 +2380,7 @@ Set the annotation <code>nginx.ingress.kubernetes.io/rewrite-target</code> to th
<h3 id="session-affinity">Session Affinity<a class="headerlink" href="#session-affinity" title="Permanent link"></a></h3>
<p>The annotation <code>nginx.ingress.kubernetes.io/affinity</code> enables and sets the affinity type in all Upstreams of an Ingress. This way, a request will always be directed to the same upstream server.
The only affinity type available for NGINX is <code>cookie</code>.</p>
<p>The annotation <code>nginx.ingress.kubernetes.io/affinity-mode</code> defines the stickyness of a session. Setting this to <code>balanced</code> (default) will redistribute some sessions if a deployment gets scaled up, therefore rebalancing the load on the servers. Setting this to <code>persistent</code> will not rebalance sessions to new servers, therefore providing maximum stickyness.</p>
<p>The annotation <code>nginx.ingress.kubernetes.io/affinity-mode</code> defines the stickiness of a session. Setting this to <code>balanced</code> (default) will redistribute some sessions if a deployment gets scaled up, therefore rebalancing the load on the servers. Setting this to <code>persistent</code> will not rebalance sessions to new servers, therefore providing maximum stickiness.</p>
<div class="admonition attention">
<p class="admonition-title">Attention</p>
<p>If more than one Ingress is defined for a host and at least one Ingress uses <code>nginx.ingress.kubernetes.io/affinity: cookie</code>, then only paths on the Ingress using <code>nginx.ingress.kubernetes.io/affinity</code> will use session cookie affinity. All paths defined on other Ingresses for the host will be load balanced through the random selection of a backend server.</p>
@ -2448,7 +2448,7 @@ This annotation also accepts the alternative form "namespace/secretName", in whi
<li><code>off</code>: Don't request client certificates and don't do client certificate verification. (default)</li>
<li><code>on</code>: Request a client certificate that must be signed by a certificate that is included in the secret key <code>ca.crt</code> of the secret specified by <code>nginx.ingress.kubernetes.io/auth-tls-secret: secretName</code>. Failed certificate verification will result in a status code 400 (Bad Request).</li>
<li><code>optional</code>: Do optional client certificate validation against the CAs from <code>auth-tls-secret</code>. The request fails with status code 400 (Bad Request) when a certificate is provided that is not signed by the CA. When no or an otherwise invalid certificate is provided, the request does not fail, but instead the verification result is sent to the upstream service.</li>
<li><code>optional_no_ca</code>: Do optional client certificate validation, but do not fail the request when the client certificate is not signed by the CAs from <code>auth-tls-secret</code>. Certificate verification result is sent to the usptream service.</li>
<li><code>optional_no_ca</code>: Do optional client certificate validation, but do not fail the request when the client certificate is not signed by the CAs from <code>auth-tls-secret</code>. Certificate verification result is sent to the upstream service.</li>
<li><code>nginx.ingress.kubernetes.io/auth-tls-error-page</code>:
The URL/Page that user should be redirected in case of a Certificate Authentication Error</li>
<li><code>nginx.ingress.kubernetes.io/auth-tls-pass-certificate-to-upstream</code>:

2
user-guide/nginx-configuration/configmap/index.html
View file

@ -4360,7 +4360,7 @@ Same for numbers, like "100".</p>
<h2 id="enable-owasp-modsecurity-crs">enable-owasp-modsecurity-crs<a class="headerlink" href="#enable-owasp-modsecurity-crs" title="Permanent link"></a></h2>
<p>Enables the OWASP ModSecurity Core Rule Set (CRS). <em><strong>default:</strong></em> is disabled</p>
<h2 id="modsecurity-snippet">modsecurity-snippet<a class="headerlink" href="#modsecurity-snippet" title="Permanent link"></a></h2>
<p>Adds custom rules to modsecurity section of nginx configration</p>
<p>Adds custom rules to modsecurity section of nginx configuration</p>
<h2 id="client-header-buffer-size">client-header-buffer-size<a class="headerlink" href="#client-header-buffer-size" title="Permanent link"></a></h2>
<p>Allows to configure a custom buffer size for reading client request header.</p>
<p><em>References:</em>