Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat(helm): remove nginx configuration-snippet by default #10646

Conversation

passionne
Copy link
Contributor

@passionne passionne commented Feb 13, 2025

Issue

https://gravitee.atlassian.net/browse/APIM-8630
https://gravitee.atlassian.net/browse/TT-6449

Description

By default, the console, portal and the management ingress
define this nginx configuration:

nginx.ingress.kubernetes.io/configuration-snippet: "etag on;\nproxy_pass_header ETag;\n"

However this configuration implies security issue
as mentioned in official documentation (CVE-2021-25742).
https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/#configuration-snippet

Also, this Etag configuration is not needed
for Console and Portal as the Etag are already
covered by the nginx in their respective container
to serve static files.

Finally, for the management-api it may not be needed.
So we keep it in comment to mention that it is still an option.

So the goal here is to remove the
nginx.ingress.kubernetes.io/configuration-snippet in helm/values.yaml.

For testing, deploy you APIM and then curl console and portal:

With Etag provided by nginx ingress:

curl -I -u 'admin:admin' 'https://your.management-api.url.gravitee.dev/management/v2/environments/DEFAULT/apis/f415bb33-9282-4f7f-95bb-3392821f7f97'
HTTP/2 200
etag: "1739439486097"

curl -I 'https://your.console.url.gravitee.dev/webcomponents/webcomponents-loader.js'
HTTP/2 200
etag: "67adbfd2-1e5d"

curl -I 'https://your.portal.url.gravitee.dev/webcomponents/webcomponents-loader.js'
HTTP/2 200
etag: "67adbfd0-1911"

Without Etag from nginx but Etag from management, console or portal
itself:

curl -I -u 'admin:admin' 'https://your.management-api.url.gravitee.dev/management/v2/environments/DEFAULT/apis/f415bb33-9282-4f7f-95bb-3392821f7f97'
HTTP/2 200
etag: "1739439486097"

curl -I 'https://your.console.url.gravitee.dev/webcomponents/webcomponents-loader.js'
HTTP/2 200
etag: "67ad234b-1911"

curl -I 'https://your.portal.url.gravitee.dev/webcomponents/webcomponents-loader.js'
HTTP/2 200
etag: "67ad2357-1e5d"

With both kind of nginx configuration to see ETag headers.

@passionne passionne requested a review from a team as a code owner February 13, 2025 08:42
@passionne passionne requested a review from a team as a code owner February 13, 2025 08:42
@passionne passionne force-pushed the fix/APIM-8630_helm_default_values_remove_nginx_etag_configuration-snippet branch 3 times, most recently from f2e7068 to a83a12c Compare February 13, 2025 13:19
By default, the console, portal and the management ingress
define this nginx configuration:

----
nginx.ingress.kubernetes.io/configuration-snippet: "etag on;\nproxy_pass_header ETag;\n"
----

However this configuration implies security issue
as mentioned in official documentation (CVE-2021-25742).
https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/#configuration-snippet

Also, this Etag configuration is not needed
for Console and Portal as the Etag are already
covered by the nginx in their respective container
to serve static files.

Finally, for the management-api it may not be needed.
So we keep it in comment to mention that it is still an option.

So the goal here is to remove the
`nginx.ingress.kubernetes.io/configuration-snippet` in `helm/values.yaml`.

For testing, deploy you APIM and then curl console and portal:

With Etag provided by nginx ingress:
----
curl -I -u 'admin:admin' 'https://your.management-api.url.gravitee.dev/management/v2/environments/DEFAULT/apis/f415bb33-9282-4f7f-95bb-3392821f7f97'
HTTP/2 200
etag: "1739439486097"

curl -I 'https://your.console.url.gravitee.dev/webcomponents/webcomponents-loader.js'
HTTP/2 200
etag: "67adbfd2-1e5d"

curl -I 'https://your.portal.url.gravitee.dev/webcomponents/webcomponents-loader.js'
HTTP/2 200
etag: "67adbfd0-1911"
----

Without Etag from nginx but Etag from management, console or portal
itself:
----
curl -I -u 'admin:admin' 'https://your.management-api.url.gravitee.dev/management/v2/environments/DEFAULT/apis/f415bb33-9282-4f7f-95bb-3392821f7f97'
HTTP/2 200
etag: "1739439486097"

curl -I 'https://your.console.url.gravitee.dev/webcomponents/webcomponents-loader.js'
HTTP/2 200
etag: "67ad234b-1911"

curl -I 'https://your.portal.url.gravitee.dev/webcomponents/webcomponents-loader.js'
HTTP/2 200
etag: "67ad2357-1e5d"
----

With both kind of nginx configuration to see ETag headers.

APIM-8630
TT-6449
@passionne passionne force-pushed the fix/APIM-8630_helm_default_values_remove_nginx_etag_configuration-snippet branch from a83a12c to 22ac6de Compare February 14, 2025 13:53
@passionne passionne enabled auto-merge (rebase) February 14, 2025 13:53
@passionne passionne merged commit 52da33f into 4.3.x Feb 14, 2025
4 of 5 checks passed
@passionne passionne deleted the fix/APIM-8630_helm_default_values_remove_nginx_etag_configuration-snippet branch February 14, 2025 13:54
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants