Add and test single filter action per header restriction #1497

rainest · 2022-10-31T23:48:50Z

What type of PR is this?
/kind documentation

What this PR does / why we need it:

Documents restrictions on header filters and how implementations should handle invalid filters. Header filters cannot modify the same header twice. When users require multiple values for the same header, they must specify the comma-separated values in configuration.

~~Adds a conformance test confirming that invalid headers result in a false Accepted Condition with reason RouteReasonUnsupportedValue.~~

Adds a webhook rule that rejects header filters that violate the single action per header rule.

Which issue(s) this PR fixes:

Fix #480. Order of operations is a moot point if there is only one action for a given header, and there are no outcomes that actually require multiple actions.

Does this PR introduce a user-facing change?:

HTTPRequestHeaderFilter and HTTPResponseHeaderFilter forbid configuring multiple actions for the same header.

k8s-ci-robot · 2022-10-31T23:48:59Z

Hi @rainest. Thanks for your PR.

I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

rainest · 2022-10-31T23:54:38Z

Kong/kubernetes-ingress-controller#3119 demonstrates a draft implementation in Kong's implementation. Not quite sure what the expected chicken-before-egg order is for demonstrating changes that aren't actually in the spec yet.

https://github.com/Kong/kubernetes-ingress-controller/actions/runs/3365550934/jobs/5581123044 is a simplified conformance run that runs this test only.

I originally included a test for multiple of the same action, but it turns out this is already forbidden by the schema. Something like:

    - type: RequestHeaderModifier
      requestHeaderModifier:
        set:
        - name: X-Header-Set
          value: one
        - name: X-Header-Set
          value: two

is rejected by the API server with

The HTTPRoute "invalid-request-header-modifier-same-action" is invalid: spec.rules[0].filters[0].requestHeaderModifier.set[1]: Duplicate value: map[string]interface {}{"name":"X-Header-Set"}

robscott

Thanks for catching this @rainest!

apis/v1beta1/httproute_types.go

conformance/tests/httproute-request-header-modifier.go

robscott · 2022-11-01T00:51:09Z

conformance/tests/httproute-request-header-modifier.go

+					Reason: string(v1beta1.RouteReasonUnsupportedValue),
+				}
+
+				kubernetes.HTTPRouteMustHaveCondition(t, suite.Client, suite.TimeoutConfig, route, gwNN, headerConflictCond)


If we do solve this with webhook validation, we either may not need this conformance test, or we should explicitly require that conformance tests are run without the validating webhook present so we can ensure that controllers still behave well in its absence. I tend to think we should just start with webhook validation, but open to other opinions here.

/cc @youngnick

I agree that we probably only want the webhook--we may as well avoid the additional implementation burden. I've updated the docstring to remove references to the condition as such, since these should never reach implementations.

robscott · 2022-11-01T00:51:52Z

/ok-to-test

Add documentation for HTTPHeaderFilter establishing a single action per header limit, with explanation and examples showing the expected CSV format for multiple-value headers.

Add an HTTPRoute webhook validation rule for RequestHeaderModifier and ResponseHeaderModifier filters. The rule rejects filters that contain multiple actions for the same header name.

robscott

Thanks @rainest!

apis/v1beta1/httproute_types.go

apis/v1beta1/validation/httproute_test.go

Ignore case when checking to see if a header has multiple actions defined. Add tests for case insensitivity, valid header filters, and multiple of the same action for the same header.

youngnick · 2022-11-08T03:43:27Z

Aside from the minor change @robscott asked for, and the followups about clarifying the webhook's position, this LGTM.

youngnick · 2022-11-08T03:43:58Z

Oops, I meant to approve, so I can leave the final LGTM to someone else.

/approve

robscott · 2022-11-09T01:09:42Z

Thanks @rainest!

/lgtm
/approve

k8s-ci-robot · 2022-11-09T01:09:48Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: rainest, robscott, youngnick

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [robscott,youngnick]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

k8s-ci-robot added kind/documentation Categorizes issue or PR as related to documentation. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. labels Oct 31, 2022

k8s-ci-robot requested review from keithmattix and mikemorris October 31, 2022 23:48

k8s-ci-robot added needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. size/M Denotes a PR that changes 30-99 lines, ignoring generated files. labels Oct 31, 2022

robscott reviewed Nov 1, 2022

View reviewed changes

k8s-ci-robot requested a review from youngnick November 1, 2022 00:51

k8s-ci-robot added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Nov 1, 2022

rainest force-pushed the doc/header-filter-single branch from 6dd4354 to ff8b759 Compare November 2, 2022 21:48

k8s-ci-robot added size/L Denotes a PR that changes 100-499 lines, ignoring generated files. and removed size/M Denotes a PR that changes 30-99 lines, ignoring generated files. labels Nov 2, 2022

rainest force-pushed the doc/header-filter-single branch from ff8b759 to 2625c49 Compare November 2, 2022 21:49

rainest added 2 commits November 2, 2022 14:56

Add actions limit to HTTPHeaderFilter

1c1e0d7

Add documentation for HTTPHeaderFilter establishing a single action per header limit, with explanation and examples showing the expected CSV format for multiple-value headers.

Add webhook limitation on header actions

f7343c5

Add an HTTPRoute webhook validation rule for RequestHeaderModifier and ResponseHeaderModifier filters. The rule rejects filters that contain multiple actions for the same header name.

rainest force-pushed the doc/header-filter-single branch from 2625c49 to f7343c5 Compare November 2, 2022 21:57

rainest requested review from robscott and removed request for mikemorris, keithmattix and youngnick November 2, 2022 22:17

robscott reviewed Nov 3, 2022

View reviewed changes

apis/v1beta1/httproute_types.go Outdated Show resolved Hide resolved

apis/v1beta1/validation/httproute_test.go Show resolved Hide resolved

apis/v1beta1/validation/httproute_test.go Show resolved Hide resolved

Handle case-inconsistent duplicate header filters

6bef1d5

Ignore case when checking to see if a header has multiple actions defined. Add tests for case insensitivity, valid header filters, and multiple of the same action for the same header.

youngnick mentioned this pull request Nov 8, 2022

conformance: Test that webhook validations are performed #1514

Closed

k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Nov 8, 2022

shaneutt requested a review from robscott November 8, 2022 14:03

Reword header filter limitations documentation

c96074b

k8s-ci-robot assigned robscott Nov 9, 2022

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Nov 9, 2022

k8s-ci-robot merged commit fa2063e into kubernetes-sigs:main Nov 9, 2022

sunjayBhatia mentioned this pull request Nov 9, 2022

webhook/conformance: Handle incompatible HTTP Filters on a rule #1521

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add and test single filter action per header restriction #1497

Add and test single filter action per header restriction #1497

rainest commented Oct 31, 2022 •

edited

k8s-ci-robot commented Oct 31, 2022

rainest commented Oct 31, 2022

robscott left a comment

robscott Nov 1, 2022

rainest Nov 2, 2022

robscott commented Nov 1, 2022

robscott left a comment

youngnick commented Nov 8, 2022

youngnick commented Nov 8, 2022

robscott commented Nov 9, 2022

k8s-ci-robot commented Nov 9, 2022

Add and test single filter action per header restriction #1497

Add and test single filter action per header restriction #1497

Conversation

rainest commented Oct 31, 2022 • edited

k8s-ci-robot commented Oct 31, 2022

rainest commented Oct 31, 2022

robscott left a comment

Choose a reason for hiding this comment

robscott Nov 1, 2022

Choose a reason for hiding this comment

rainest Nov 2, 2022

Choose a reason for hiding this comment

robscott commented Nov 1, 2022

robscott left a comment

Choose a reason for hiding this comment

youngnick commented Nov 8, 2022

youngnick commented Nov 8, 2022

robscott commented Nov 9, 2022

k8s-ci-robot commented Nov 9, 2022

rainest commented Oct 31, 2022 •

edited