Remove annotation "kubernetes.io/ingress.allow-http" check in k8shttpsonly policy about gatekeeper-library HOT 11 CLOSED

Thank you for opening this issue @ivanthelad.

As you have pointed out, from kubernetes/ingress-nginx#6590 (comment)
The kubernetes.io/ingress.allow-http annotation is supported only by ingress-gce, would you like to open a PR to make ingress.metadata.annotations["kubernetes.io/ingress.allow-http"] == "false" check conditional only when the annotation is provided?

from gatekeeper-library.

Does making the check conditional break the intention of this constraint? If the default is allow-http = true when the annotation is undefined, then the constraint would be mooted.

This raises the question of what to do when constraints have platform-specific implications.

One possibility would be to add a parameter that enables (or disables) this particular check.

from gatekeeper-library.

For backwards compatibility, the parameter would have to disable this check.

from gatekeeper-library.

add a parameter that enables (or disables) this particular check.

+1

what to do when constraints have platform-specific implications.

If these ConstraintTemplates and constraints are supposed to be generic, then we should not include any platform-specific things. We can make sure to check for this when we review PRs in the future, but not sure how we should handle this one since it's already in.

For backwards compatibility, the parameter would have to disable this check.

+1

from gatekeeper-library.

TBH I don't think this is actually platform-specific, as the annotation is kubernetes.io/ingress.allow-http. The annotation looks to be defined by Kubernetes (per the prefix). As to which platforms choose to consume it, I guess that's undefined?

from gatekeeper-library.

VMWare uses it as well:

https://docs.vmware.com/en/VMware-NSX-T-Data-Center/3.1/ncp-kubernetes/GUID-E03D6EE5-9C6C-457F-AD81-25CF2056F4D8.html

from gatekeeper-library.

As does Azure:

https://docs.microsoft.com/en-us/azure/architecture/reference-architectures/containers/aks/secure-baseline-aks

from gatekeeper-library.

Though Azure's docs imply this may be via Traefik

from gatekeeper-library.

Definitely seems to be a bit unregulated who uses what annotation. That has interesting implication for a policy like k8shttpsonly.

In general, extensions like annotations are a confounding factor, as there is no way to reliably cover the surface of all possible extensions.

from gatekeeper-library.

add a parameter that enables (or disables) this particular check.

As mentioned on the community call, another option for backward compatibility is to create a v2 version of the constraint template.

Do you have any thoughts around these options @ivanthelad?

from gatekeeper-library.

This issue/PR has been automatically marked as stale because it has not had recent activity. It will be closed in 14 days if no further activity occurs. Thank you for your contributions.

from gatekeeper-library.