3

I am running into a very strange issue, I cannot set single quotes that are required by Content-Security-Policy. I assume I was running an older version of ingress which only got updated after I disabled and re-enabled it (microk8s).

    nginx.ingress.kubernetes.io/configuration-snippet: |
      add_header Access-Control-Allow-Origin "https://myhost";
      more_set_headers "X-FRAME-OPTIONS: SAMEORIGIN";
      more_set_headers "Content-Security-Policy: default-src 'self' blob:;";

Result:

skipping ingress ...: nginx.ingress.kubernetes.io/configuration-snippet annotation contains invalid word '

I've tried using x2, escaping with \, wrapping everything with single quotes and escaping, nothing worked. I'm grateful if anyone can tell me how to add single quotes to the headers or if I can avoid them and still send the CSP.

EDIT: just to be clear, this configuration used to work on older versions, right now the ingress version is v1.0.5. There is nothing wrong with the syntax or other settings.

Wytrzymały Wiktor
  • 11,492
  • 5
  • 29
  • 37
brainwash
  • 690
  • 5
  • 19

1 Answers1

2

Changes has been appeared exactly in 1.0.5 related to sanitizing annotation inputs.

You may want to check CVE-2021-25742: Ingress-nginx custom snippets. I put in bold interested for you part.

annotation-value-word-blocklist defaults are "load_module,lua_package,_by_lua,location,root,proxy_pass,serviceaccount,{,},',"

Users from mod_security and other features should be aware that some blocked values may be used by those features and must be manually unblocked by the Ingress Administrator.

It seems to me your issue related to mod_security + above blocklist, that contains ' symbol.

For more details please check https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#annotation-value-word-blocklist

In order to fix your issue you should either

  • set the value of annotation-value-word-blocklist to an empty string ""

or

  • change the value of annotation-value-word-blocklist and remove ' from its list.
Vit
  • 7,740
  • 15
  • 40
  • 1
    Thank you! The documentation was a bit confusing since it shows the default as "", but 1.0.5 had the default set to the longer (breaking) string. I also looked at this change but the error message did not contain something like "blocked". Looking at their source code, that is indeed the error message shown when a blocked keyword is detected. – brainwash Jan 21 '22 at 10:38
  • I have (maybe) the same issue. If i add single quotes ingress does not startup. But I dont see an error message where did you get that message @brainwash ? And how/where did you modify the annotation-value-word-blocklist ? – simplesystems Jun 30 '22 at 15:19
  • You need to add a ConfigMap which has "annotation-value-word-blocklist" inside the "data" definition. As "metadata", set name:ingress-nginx-controller or name: nginx-load-balancer-microk8s-conf, and the namespace of your ingress (by default I think it's "ingress"). – brainwash Jul 02 '22 at 21:46