Wrong validation for permanent-redirect and temporal-redirect annotation values

[N4SoftwareNinja]

Hi everyone,

I think in this file there is a wrong validator for the values of permanent-redirect and temporal-redirect annotation used.

Reasoning: It should be possible to use variables like "$request_uri" for redirecting to the same path as in the original request for example, but this is blocked by the validation because the $ is not allowed.
If I use a configuration-snippet with the following content, it works fine:

return 301 https://wheelscompany.com/$request_uri;

So for me it looks like if URLWithNginxVariableRegex should be the correct Regex to be used at this point.

[k8s-ci-robot]

This issue is currently awaiting triage.

If Ingress contributors determines this is a relevant issue, they will accept it by applying the triage/accepted label and provide further guidance.

The triage/accepted label can be added by org members by writing /triage accepted in a comment.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[samtoxie]

I can notice the same behaviour when performing the minor update. Ingress objects using the annotation as such will break and get rejected by the controller:

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: my-domain-redirect
  namespace: dev
  annotations:
    cert-manager.io/cluster-issuer: "letsencrypt-prod-http"
    kubernetes.io/ingress.class: "nginx"
    nginx.ingress.kubernetes.io/permanent-redirect: "https://my.new.domain$request_uri"
spec:
  ingressClassName: nginx
  rules:
  - host: my.domain
  - host: www.my.domain
  tls:
  - hosts:
    - my.domain
    - www.my.domain
    secretName: my-domain-tls

Removing the $ allows it to be accepted again, however I need the request_uri to be preserved on redirects.

[MiGrandjean]

Can confirm, updating from v1.11.3 to v1.12.0 breaks this:

W0127 16:18:19.319229       8 validators.go:237] validation error on ingress foo/portal-redirect: annotation permanent-redirect contains invalid value $scheme://portal.example.org$request_uri
E0127 16:18:19.319254       8 annotations.go:193] "ingress contains invalid annotation value" err="annotation nginx.ingress.kubernetes.io/permanent-redirect contains invalid value"
E0127 16:18:19.319266       8 store.go:938] annotation nginx.ingress.kubernetes.io/permanent-redirect contains invalid value

[jasday]

Just to add on, auth-sign in validation appears broken when updating from v1.11.3 to v1.12.0 as well:

W0128 09:25:51.467367       7 validators.go:237] validation error on ingress foo/bar: annotation auth-signin contains invalid value https://auth.example.com/oauth2/start?rd=https%3A%2F%2F$host$request_uri

EDIT:
Looking a bit deeper, auth-signin already uses URLWithNginxVariableRegex, so this error this is likely due to the URL encoded characters in the address. This is working on v1.11.3, so not sure what has changed since that release, however potentially not related to this issue.

[morsik]

Just hit this issue today when I started debugging why my redirect (which I was pretty sure worked) doesn't work anymore.

I can confirm it's problem with v1.12. Rolling back to Helm Chart 4.11.4 (which is latest chart before 1.12, and installs 1.11.4) resolved issue.

[jon-larsen]

Same problem here after upgrading from helm chart 4.11.4 to 4.12.0
http://nginx.ingress.kubernetes.io/permanent-redirect: https://www.domain.com/$redirect_uri

[dominic-p]

I'm running into this as well but with a slightly different redirect format. I have something like:

nginx.ingress.kubernetes.io/permanent-redirect: https://www.example.com/?key=value%20space

I need to redirect to a URL with a space in the query string, but the current regex is blocking any URL with spaces (URL encoded or not).

[kostyachum]

confirm the same issue with $redirect_uri on 4.12.1

[eyenx]

Have you tried setting:

controller:
  enableAnnotationValidations: false

ATTENTION tthis does not validate the annotaation anymore and let's sth like $redirect_uri in there through, but it could potentially brake your nginx configuration being reloaded

Relference: https://github.com/kubernetes/ingress-nginx/releases/tag/controller-v1.12.1

Unfortunately, to fix GHSA-mgvx-rpfc-9mpv it was necessary to disable the validation of the generated NGINX configuration during the validation of Ingress resources.

The resulting NGINX configuration is still checked before the actual loading, so that there are no failures of the underlying NGINX. However, invalid Ingress resources can lead to the NGINX configuration no longer being able to be updated.

To reduce such situations as far as possible, we therefore recommend enabling annotation validation and disabling snippet annotations. In case of doubt, such states can be determined from the logs of the Ingress NGINX Controller. Watch out for a line of dashes followed by "Error:" telling you what went wrong.

[lindhe]

Pretty sure this is a duplicate of #11175?

Also somewhat similar to #10114 but not exactly the same, I think.