Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

7.2.0 - January 17, 2025 #589

Merged
merged 7 commits into from
Jan 17, 2025
Prev Previous commit
Next Next commit
feat: (PSKD-957) ingress-nginx configmap changes for v1.12+ (#586)
dhoucgitter authored Dec 17, 2024

Verified

This commit was created on GitHub.com and signed with GitHub’s verified signature.
commit 18575d2ddd4398158d07a4f0333a607ff665990b
12 changes: 12 additions & 0 deletions roles/baseline/defaults/main.yml
Original file line number Diff line number Diff line change
@@ -98,6 +98,18 @@ INGRESS_NGINX_CVE_2021_25742_PATCH:
large-client-header-buffers: 4 32k
annotation-value-word-blocklist: load_module,lua_package,_by_lua,location,root,proxy_pass,serviceaccount,{,},\

# Ingress-nginx - Required for <= 2024.11 with v1.12+
INGRESS_NGINX_STRICT_VALIDATE_PATH_TYPE:
controller:
config:
strict-validate-path-type: "false"

# Ingress-nginx - Required for ingress-nginx v1.12+
INGRESS_NGINX_ANNOTATIONS_RISK_LEVEL:
controller:
config:
annotations-risk-level: "Critical"

## Nfs-subdir-external-provisioner
NFS_CLIENT_NAME: nfs-subdir-external-provisioner-sas
NFS_CLIENT_NAMESPACE: nfs-client
16 changes: 16 additions & 0 deletions roles/baseline/tasks/ingress-nginx.yaml
Original file line number Diff line number Diff line change
@@ -82,6 +82,22 @@
- INGRESS_NGINX_CHART_VERSION is version('4.0.10', ">=") or (INGRESS_NGINX_CHART_VERSION is version('3.40.0', ">=") and INGRESS_NGINX_CHART_VERSION is version('4.0.0',
"<"))

- name: Disable strict_validate_path_type in INGRESS_NGINX_CONFIG
set_fact:
INGRESS_NGINX_CONFIG: "{{ INGRESS_NGINX_CONFIG | combine(INGRESS_NGINX_STRICT_VALIDATE_PATH_TYPE, recursive=True) }}"
when: (V4_CFG_CADENCE_VERSION is version('2024.11', "<=") and V4_CFG_CADENCE_NAME|lower != "fast") and INGRESS_NGINX_CHART_VERSION is version('4.12.0', ">=")
tags:
- install
- update

- name: Add annotations_risk_level to INGRESS_NGINX_CONFIG
set_fact:
INGRESS_NGINX_CONFIG: "{{ INGRESS_NGINX_CONFIG | combine(INGRESS_NGINX_ANNOTATIONS_RISK_LEVEL, recursive=True) }}"
when: INGRESS_NGINX_CHART_VERSION is version('4.12.0', ">=")
tags:
- install
- update

- name: Deploy ingress-nginx
kubernetes.core.helm:
name: "{{ INGRESS_NGINX_NAME }}"