Skip to content

Commit 50be6f4

Browse files
authored
Merge branch 'main' into status-order
2 parents 9e9ecc6 + 7e075c6 commit 50be6f4

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

52 files changed

+46976
-131
lines changed

.github/workflows/ci.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -126,7 +126,7 @@ jobs:
126126
if: github.ref_type == 'tag'
127127

128128
- name: Install Cosign
129-
uses: sigstore/cosign-installer@1fc5bd396d372bee37d608f955b336615edf79c8 # v3.2.0
129+
uses: sigstore/cosign-installer@9614fae9e5c5eddabb09f90a270fcb487c9f7149 # v3.3.0
130130
if: github.ref_type == 'tag'
131131

132132
- name: Build binary
@@ -313,7 +313,7 @@ jobs:
313313
NGINX_CONF_DIR=internal/mode/static/nginx/conf
314314
315315
- name: Run Trivy vulnerability scanner
316-
uses: aquasecurity/trivy-action@22d2755f774d925b191a185b74e782a4b0638a41 # 0.15.0
316+
uses: aquasecurity/trivy-action@91713af97dc80187565512baba96e4364e983601 # 0.16.0
317317
continue-on-error: true
318318
with:
319319
image-ref: ghcr.io/nginxinc/nginx-gateway-fabric${{ matrix.container == 'nginx' && '/nginx' || '' }}:${{ steps.meta.outputs.version }}

.github/workflows/update-docker-images.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -123,7 +123,7 @@ jobs:
123123
NGINX_CONF_DIR=internal/mode/static/nginx/conf
124124
125125
- name: Run Trivy vulnerability scanner
126-
uses: aquasecurity/trivy-action@22d2755f774d925b191a185b74e782a4b0638a41 # 0.15.0
126+
uses: aquasecurity/trivy-action@91713af97dc80187565512baba96e4364e983601 # 0.16.0
127127
continue-on-error: true
128128
with:
129129
image-ref: ghcr.io/nginxinc/nginx-gateway-fabric/nginx:${{ needs.variables.outputs.ngf_tag }}

build/Dockerfile

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ RUN go mod download
99
COPY . /go/src/github.com/nginxinc/nginx-gateway-fabric
1010
RUN make build
1111

12-
FROM alpine:3.18 as capabilizer
12+
FROM alpine:3.19 as capabilizer
1313
RUN apk add --no-cache libcap
1414

1515
FROM capabilizer as local-capabilizer

examples/https-termination/README.md

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ reference a Secret in a different Namespace.
88

99
## 1. Deploy NGINX Gateway Fabric
1010

11-
1. Follow the [installation instructions](/docs/installation.md) to deploy NGINX Gateway Fabric.
11+
1. Follow the [installation instructions](https://docs.nginx.com/nginx-gateway-fabric/installation/) to deploy NGINX Gateway Fabric.
1212

1313
1. Save the public IP address of NGINX Gateway Fabric into a shell variable:
1414

@@ -195,19 +195,19 @@ You can also check the conditions of the Gateway `https` Listener to verify the
195195
Conditions:
196196
Last Transition Time: 2023-06-26T20:23:56Z
197197
Message: Certificate ref to secret certificate/cafe-secret not permitted by any ReferenceGrant
198-
Observed Generation: 2
198+
Observed Generation: 1
199199
Reason: RefNotPermitted
200200
Status: False
201201
Type: Accepted
202202
Last Transition Time: 2023-06-26T20:23:56Z
203203
Message: Certificate ref to secret certificate/cafe-secret not permitted by any ReferenceGrant
204-
Observed Generation: 2
204+
Observed Generation: 1
205205
Reason: RefNotPermitted
206206
Status: False
207207
Type: ResolvedRefs
208208
Last Transition Time: 2023-06-26T20:23:56Z
209209
Message: Certificate ref to secret certificate/cafe-secret not permitted by any ReferenceGrant
210-
Observed Generation: 2
210+
Observed Generation: 1
211211
Reason: Invalid
212212
Status: False
213213
Type: Programmed

internal/mode/static/nginx/modules/package-lock.json

Lines changed: 4 additions & 4 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

internal/mode/static/nginx/modules/package.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@
1212
},
1313
"devDependencies": {
1414
"c8": "8.0.1",
15-
"prettier": "3.1.0"
15+
"prettier": "3.1.1"
1616
},
1717
"type": "module"
1818
}

internal/mode/static/state/store.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -286,7 +286,7 @@ func (u *validatingUpsertUpdater) Upsert(obj client.Object) {
286286
obj,
287287
apiv1.EventTypeWarning,
288288
"Rejected",
289-
"%s; NGF will delete any existing NGINX configuration that corresponds to the resource",
289+
"%s; NGINX Gateway Fabric will delete any existing NGINX configuration that corresponds to the resource",
290290
err.Error(),
291291
)
292292

site/content/how-to/traffic-management/advanced-routing.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -125,7 +125,7 @@ This request should receive a response from the `coffee-v1` Pod.
125125

126126
```text
127127
Server address: 10.244.0.9:8080
128-
Server name: coffee-v2-68bd55f798-s9z5q
128+
Server name: coffee-v1-76c7c85bbd-cf8nz
129129
```
130130

131131
If we want our request to be routed to `coffee-v2`, then we need to meet the defined conditions. We can include a header:

site/content/how-to/traffic-management/routing-traffic-to-your-app.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -132,7 +132,7 @@ spec:
132132
EOF
133133
```
134134

135-
This gateway is associated with the NGINX Gateway Fabric through the **gatewayClassName** field. The default installation of NGINX Gateway Fabric creates a GatewayClass with the name **nginx**. NGINX Gateway Fabric will only configure gateways with a **gatewayClassName** of **nginx** unless you change the name via the `--gatewayclass` [command-line flag](/docs/cli-help.md#static-mode).
135+
This gateway is associated with the NGINX Gateway Fabric through the **gatewayClassName** field. The default installation of NGINX Gateway Fabric creates a GatewayClass with the name **nginx**. NGINX Gateway Fabric will only configure gateways with a **gatewayClassName** of **nginx** unless you change the name via the `--gatewayclass` [command-line flag]({{< relref "/reference/cli-help.md#static-mode" >}}).
136136

137137
We specify a [listener](https://gateway-api.sigs.k8s.io/references/spec/#gateway.networking.k8s.io/v1.Listener) on the gateway to open an entry point on the cluster. In this case, since the coffee application accepts HTTP requests, we create an HTTP listener, named **http**, that listens on port 80.
138138

Lines changed: 65 additions & 103 deletions
Original file line numberDiff line numberDiff line change
@@ -1,70 +1,23 @@
11
---
22
title: "Gateway API Resource Validation"
3-
description: "Learn how NGINX Gateway Fabric validates Gateway API resources."
43
weight: 800
54
toc: true
65
docs: "DOCS-000"
76
---
87

98
## Overview
109

11-
There are several reasons why NGF validates Gateway API resources:
10+
NGINX Gateway Fabric validates Gateway API resources for several reasons:
1211

13-
- *Robustness*: to gracefully handle invalid resources.
14-
- *Security*: to prevent malicious input from propagating to the NGINX configuration.
15-
- *Correctness*: to conform to the Gateway API specification for handling invalid resources.
12+
- _Robustness_: to gracefully handle invalid resources.
13+
- _Security_: to prevent malicious input from propagating to the NGINX configuration.
14+
- _Correctness_: to conform to the Gateway API specification for handling invalid resources.
1615

17-
Ultimately, the goal is to ensure that NGINX continues to handle traffic even if invalid Gateway API resources were
18-
created.
16+
The process involves four different steps, explained in detail in this document, with the goal of making sure that NGINX continues to handle traffic even if invalid Gateway API resources were created.
1917

20-
A Gateway API resource (a new resource or an update for the existing one) is validated by the following steps:
18+
## Step 1 - OpenAPI Scheme validation by Kubernetes API Server
2119

22-
### For Kubernetes 1.25+
23-
24-
1. OpenAPI schema validation by the Kubernetes API server.
25-
2. CEL validation by the Kubernetes API server.
26-
3. Webhook validation by NGF.
27-
4. Validation by NGF.
28-
29-
### For Kubernetes 1.23 and 1.24
30-
31-
1. OpenAPI schema validation by the Kubernetes API server.
32-
2. Webhook validation by the Gateway API webhook.
33-
3. Webhook validation by NGF.
34-
4. Validation by NGF.
35-
36-
To confirm that a resource is valid and accepted by NGF, check that the `Accepted` condition in the resource status
37-
has the Status field set to `True`. For example, in a status of a valid HTTPRoute, if NGF accepts a parentRef,
38-
the status of that parentRef will look like this:
39-
40-
```text
41-
Status:
42-
Parents:
43-
Conditions:
44-
Last Transition Time: 2023-03-30T23:18:00Z
45-
Message: The route is accepted
46-
Observed Generation: 2
47-
Reason: Accepted
48-
Status: True
49-
Type: Accepted
50-
Controller Name: gateway.nginx.org/nginx-gateway-controller
51-
Parent Ref:
52-
Group: gateway.networking.k8s.io
53-
Kind: Gateway
54-
Name: gateway
55-
Namespace: default
56-
Section Name: http
57-
```
58-
59-
> Make sure the reported observed generation is the same as the resource generation.
60-
61-
The remaining part of this document describes each step in detail with examples of how validation errors are reported.
62-
63-
### Step 1 - OpenAPI Scheme Validation by Kubernetes API Server
64-
65-
The Kubernetes API server validates Gateway API resources against the OpenAPI schema embedded in the Gateway API CRDs.
66-
For example, if you create an HTTPRoute with an invalid hostname `cafe.!@#$%example.com`, the API server will reject it
67-
with the following error:
20+
The Kubernetes API server validates Gateway API resources against the OpenAPI schema embedded in the Gateway API CRDs. For example, if you create an HTTPRoute with an invalid hostname "cafe.!@#$%example.com", the API server will reject it with the following error:
6821

6922
```shell
7023
kubectl apply -f coffee-route.yaml
@@ -74,53 +27,44 @@ kubectl apply -f coffee-route.yaml
7427
The HTTPRoute "coffee" is invalid: spec.hostnames[0]: Invalid value: "cafe.!@#$%example.com": spec.hostnames[0] in body should match '^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$'
7528
```
7629

77-
> While unlikely, bypassing this validation step is possible if the Gateway API CRDs are modified to remove the validation.
78-
> If this happens, Step 4 will reject any invalid values (from NGINX perspective).
30+
{{< note >}}While unlikely, bypassing this validation step is possible if the Gateway API CRDs are modified to remove the validation. If this happens, Step 4 will reject any invalid values (from NGINX perspective).{{< /note >}}
7931

80-
### Step 2 - For Kubernetes 1.25+ - CEL Validation by Kubernetes API Server
32+
## Step 2 - CEL or Webhook validation by Kubernetes
8133

82-
The Kubernetes API server validates Gateway API resources using CEL validation embedded in the Gateway API CRDs.
83-
It validates Gateway API resources using advanced rules unavailable in the OpenAPI schema validation.
84-
For example, if you create a Gateway resource with a TCP listener that configures a hostname, the CEL validation will
85-
reject it with the following error:
34+
- **Kubernetes 1.25 and later - CEL validation by Kubernetes API Server**
8635

36+
The Kubernetes API server validates Gateway API resources using CEL validation embedded in the Gateway API CRDs. It validates Gateway API resources using advanced rules unavailable in the OpenAPI schema validation. For example, if you create a Gateway resource with a TCP listener that configures a hostname, the CEL validation will reject it with the following error:
8737

88-
```shell
89-
kubectl apply -f some-gateway.yaml
90-
```
38+
```shell
39+
kubectl apply -f some-gateway.yaml
40+
```
9141

92-
```text
93-
The Gateway "some-gateway" is invalid: spec.listeners: Invalid value: "array": hostname must not be specified for protocols ['TCP', 'UDP']
94-
```
42+
```text
43+
The Gateway "some-gateway" is invalid: spec.listeners: Invalid value: "array": hostname must not be specified for protocols ['TCP', 'UDP']
44+
```
9545

96-
More information on CEL in Kubernetes can be found [here](https://kubernetes.io/docs/reference/using-api/cel/).
46+
More information on CEL in Kubernetes can be found [here](https://kubernetes.io/docs/reference/using-api/cel/).
9747

98-
### Step 2 - For Kubernetes 1.23 and 1.24 - Webhook Validation by Gateway API Webhook
9948

100-
The Gateway API comes with a validating webhook which is enabled by default in the Gateway API installation manifests.
101-
It validates Gateway API resources using advanced rules unavailable in the OpenAPI schema validation. For example, if
102-
you create a Gateway resource with a TCP listener that configures a hostname, the webhook will reject it with the
103-
following error:
49+
- **Kubernetes 1.23 and 1.24 - Webhook validation by Gateway API Webhook**
10450

105-
```shell
106-
kubectl apply -f some-gateway.yaml
107-
```
51+
The validating webhook must be [installed for these Kubernetes versions]({{< relref "installation/installing-ngf/helm.md#installing-the-gateway-api-resources" >}}). It validates Gateway API resources using advanced rules unavailable in the OpenAPI schema validation. For example, if you create a Gateway resource with a TCP listener that configures a hostname, the webhook will reject it with the following error:
10852

109-
```text
110-
Error from server: error when creating "some-gateway.yaml": admission webhook "validate.gateway.networking.k8s.io" denied the request: spec.listeners[1].hostname: Forbidden: should be empty for protocol TCP
111-
```
53+
```shell
54+
kubectl apply -f some-gateway.yaml
55+
```
11256

113-
> Bypassing this validation step is possible if the webhook is not running in the cluster.
114-
> If this happens, Step 3 will reject the invalid values.
57+
```text
58+
Error from server: error when creating "some-gateway.yaml": admission webhook "validate.gateway.networking.k8s.io" denied the request: spec.listeners[1].hostname: Forbidden: should be empty for protocol TCP
59+
```
11560

116-
### Step 3 - Webhook validation by NGF
61+
{{< note >}}Bypassing this validation step is possible if the webhook is not running in the cluster. If this happens, Step 3 will reject the invalid values.{{< /note >}}
11762

118-
To ensure that the resources are validated with the webhook validation rules, even if the webhook is not running,
119-
NGF performs the same validation. However, NGF performs the validation *after* the Kubernetes API server accepts
120-
the resource.
63+
## Step 3 - Webhook validation by NGINX Gateway Fabric
12164

122-
Below is an example of how NGF rejects an invalid resource (a Gateway resource with a TCP listener that configures a
123-
hostname) with a Kubernetes event:
65+
To ensure that the resources are validated with the webhook validation rules, even if the webhook is not running, NGINX Gateway Fabric performs the same validation. However, NGINX Gateway Fabric performs the validation _after_ the Kubernetes API server accepts the resource.
66+
67+
Below is an example of how NGINX Gateway Fabric rejects an invalid resource (a Gateway resource with a TCP listener that configures a hostname) with a Kubernetes event:
12468

12569
```shell
12670
kubectl describe gateway some-gateway
@@ -131,28 +75,21 @@ kubectl describe gateway some-gateway
13175
Events:
13276
Type Reason Age From Message
13377
---- ------ ---- ---- -------
134-
Warning Rejected 6s nginx-gateway-fabric-nginx the resource failed webhook validation, however the Gateway API webhook failed to reject it with the error; make sure the webhook is installed and running correctly; validation error: spec.listeners[1].hostname: Forbidden: should be empty for protocol TCP; NGF will delete any existing NGINX configuration that corresponds to the resource
78+
Warning Rejected 6s nginx-gateway-fabric-nginx the resource failed webhook validation, however the Gateway API webhook failed to reject it with the error; make sure the webhook is installed and running correctly; validation error: spec.listeners[1].hostname: Forbidden: should be empty for protocol TCP; NGINX Gateway Fabric will delete any existing NGINX configuration that corresponds to the resource
13579
```
13680

137-
> This validation step always runs and cannot be bypassed.
138-
> NGF will ignore any resources that fail the webhook validation, like in the example above.
139-
> If the resource previously existed, NGF will remove any existing NGINX configuration for that resource.
81+
{{< note >}}This validation step always runs and cannot be bypassed. NGINX Gateway Fabric will ignore any resources that fail the webhook validation, like in the example above. If the resource previously existed, NGINX Gateway Fabric will remove any existing NGINX configuration for that resource.{{< /note >}}
14082

141-
### Step 4 - Validation by NGF
83+
## Step 4 - Validation by NGINX Gateway Fabric
14284

14385
This step catches the following cases of invalid values:
14486

145-
- Valid values from the Gateway API perspective but not supported by NGF yet. For example, a feature in an
146-
HTTPRoute routing rule. Note: for the list of supported features,
147-
see [Gateway API Compatibility](gateway-api-compatibility.md) doc.
148-
- Valid values from the Gateway API perspective, but invalid for NGINX, because NGINX has stricter validation
149-
requirements for certain fields. Such values will cause NGINX to fail to reload or operate erroneously.
150-
- Invalid values (both from the Gateway API and NGINX perspectives) that were not rejected because Step 1 was bypassed.
151-
Similarly to the previous case, such values will cause NGINX to fail to reload or operate erroneously.
152-
- Malicious values that inject unrestricted NGINX config into the NGINX configuration (similar to an SQL injection
153-
attack).
87+
- Valid values from the Gateway API perspective but not supported by NGINX Gateway Fabric yet. For example, a feature in an HTTPRoute routing rule. For the list of supported features see [Gateway API Compatibility](gateway-api-compatibility.md) doc.
88+
- Valid values from the Gateway API perspective, but invalid for NGINX, because NGINX has stricter validation requirements for certain fields. These values will cause NGINX to fail to reload or operate erroneously.
89+
- Invalid values (both from the Gateway API and NGINX perspectives) that were not rejected because Step 1 was bypassed. Similar to the previous case, these values will cause NGINX to fail to reload or operate erroneously.
90+
- Malicious values that inject unrestricted NGINX config into the NGINX configuration (similar to an SQL injection attack).
15491

155-
Below is an example of how NGF rejects an invalid resource. The validation error is reported via the status:
92+
Below is an example of how NGINX Gateway Fabric rejects an invalid resource. The validation error is reported via the status:
15693

15794
```shell
15895
kubectl describe httproutes.gateway.networking.k8s.io coffee
@@ -178,4 +115,29 @@ Status:
178115
Section Name: http
179116
```
180117

181-
> This validation step always runs and cannot be bypassed.
118+
{{< note >}}This validation step always runs and cannot be bypassed.{{< /note >}}
119+
120+
## Confirm validation
121+
122+
To confirm that a resource is valid and accepted by NGINX Gateway Fabric, check that the **Accepted** condition in the resource status has the Status field set to **True**. For example, in a status of a valid HTTPRoute, if NGINX Gateway Fabric accepts a parentRef, the status of that parentRef will look like this:
123+
124+
```text
125+
Status:
126+
Parents:
127+
Conditions:
128+
Last Transition Time: 2023-03-30T23:18:00Z
129+
Message: The route is accepted
130+
Observed Generation: 2
131+
Reason: Accepted
132+
Status: True
133+
Type: Accepted
134+
Controller Name: gateway.nginx.org/nginx-gateway-controller
135+
Parent Ref:
136+
Group: gateway.networking.k8s.io
137+
Kind: Gateway
138+
Name: gateway
139+
Namespace: default
140+
Section Name: http
141+
```
142+
143+
{{< note>}}Make sure the reported observed generation is the same as the resource generation.{{< /note >}}

site/go.mod

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,4 +2,4 @@ module github.com/nginxinc/nginx-gateway-fabric/site
22

33
go 1.21
44

5-
require github.com/nginxinc/nginx-hugo-theme v0.40.0 // indirect
5+
require github.com/nginxinc/nginx-hugo-theme v0.40.1 // indirect

site/go.sum

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,3 +4,5 @@ github.com/nginxinc/nginx-hugo-theme v0.39.0 h1:P1hOPpityVUOM5OyIpQZa1UJyuUunGSm
44
github.com/nginxinc/nginx-hugo-theme v0.39.0/go.mod h1:DPNgSS5QYxkjH/BfH4uPDiTfODqWJ50NKZdorguom8M=
55
github.com/nginxinc/nginx-hugo-theme v0.40.0 h1:YP0I0+bRKcJ5WEb1s/OWcnlcvNvIcKscagJkCzsa+Vs=
66
github.com/nginxinc/nginx-hugo-theme v0.40.0/go.mod h1:DPNgSS5QYxkjH/BfH4uPDiTfODqWJ50NKZdorguom8M=
7+
github.com/nginxinc/nginx-hugo-theme v0.40.1 h1:1Q94uFYegNvjvwDV1py9VlYmh62AF1gh1oPGqjNmtis=
8+
github.com/nginxinc/nginx-hugo-theme v0.40.1/go.mod h1:DPNgSS5QYxkjH/BfH4uPDiTfODqWJ50NKZdorguom8M=

site/mdlint_conf.json

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,5 +15,6 @@
1515
"siblings_only": true
1616
},
1717
"MD046": false,
18-
"MD001": false
18+
"MD001": false,
19+
"MD049": false
1920
}

0 commit comments

Comments
 (0)