[4.6.x] feat(helm): remove nginx configuration-snippet by default #10674
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This is an automatic copy of pull request #10646 done by Mergify.
Issue
https://gravitee.atlassian.net/browse/APIM-8630
https://gravitee.atlassian.net/browse/TT-6449
Description
By default, the console, portal and the management ingress
define this nginx configuration:
However this configuration implies security issue
as mentioned in official documentation (CVE-2021-25742).
https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/#configuration-snippet
Also, this Etag configuration is not needed
for Console and Portal as the Etag are already
covered by the nginx in their respective container
to serve static files.
Finally, for the management-api it may not be needed.
So we keep it in comment to mention that it is still an option.
So the goal here is to remove the
nginx.ingress.kubernetes.io/configuration-snippet
inhelm/values.yaml
.For testing, deploy you APIM and then curl console and portal:
With Etag provided by nginx ingress:
Without Etag from nginx but Etag from management, console or portal
itself:
With both kind of nginx configuration to see ETag headers.
Cherry-pick of 52da33f has failed:
To fix up this pull request, you can check it out locally. See documentation: https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/checking-out-pull-requests-locally