Validate incoming sidecar injections
Fixes
Add method isInjectAnnotationValid() in report.go to catch invalid
inject annotations
@@ -17,6 +17,8 @@ const (
injectDisableAnnotationPresent = "injection_disable_annotation_present"
annotationAtNamespace = "namespace"
annotationAtWorkload = "workload"
+ invalidInjectAnnotationWorkload = "invalid_inject_annotation_at_workload"
+ invalidInjectAnnotationNamespace = "invalid_inject_annotation_at_ns"
)
var (
@@ -27,6 +29,8 @@ var (
unsupportedResource: "this resource kind is unsupported",
injectEnableAnnotationAbsent: fmt.Sprintf("neither the namespace nor the pod have the annotation \"%s:%s\"", k8s.ProxyInjectAnnotation, k8s.ProxyInjectEnabled),
injectDisableAnnotationPresent: fmt.Sprintf("pod has the annotation \"%s:%s\"", k8s.ProxyInjectAnnotation, k8s.ProxyInjectDisabled),
+ invalidInjectAnnotationWorkload: fmt.Sprintf("invalid value for annotation \"%s\" at workload", k8s.ProxyInjectAnnotation),
+ invalidInjectAnnotationNamespace: fmt.Sprintf("invalid value for annotation \"%s\" at namespace", k8s.ProxyInjectAnnotation),
}
)
@@ -154,6 +158,14 @@ func (r *Report) disableByAnnotation(conf *ResourceConfig) (bool, string, string
return podAnnotation == k8s.ProxyInjectDisabled, "", ""
}
+ if !isInjectAnnotationValid(conf.nsAnnotations) {
+ return true, invalidInjectAnnotationNamespace, ""
+ }
+
+ if !isInjectAnnotationValid(conf.pod.meta.Annotations) {
+ return true, invalidInjectAnnotationWorkload, ""
+ }
+
if nsAnnotation == k8s.ProxyInjectEnabled {
if podAnnotation == k8s.ProxyInjectDisabled {
return true, injectDisableAnnotationPresent, annotationAtWorkload
@@ -167,3 +179,12 @@ func (r *Report) disableByAnnotation(conf *ResourceConfig) (bool, string, string
return false, "", annotationAtWorkload
}
+
+func isInjectAnnotationValid(annotations map[string]string) bool {
+ for k, v := range annotations {
+ if k == k8s.ProxyInjectAnnotation && !(v == k8s.ProxyInjectEnabled || v == k8s.ProxyInjectDisabled) {
+ return false
+ }
+ }
+ return true
+}
