Allow per-namespace annotations-risk-level

[sathieu]

Raising annotations-risk-level to High is good, but we need a way to add exceptions for specific namespaces that we now are using safe parameters.

For example, we use this for MinIO:

      nginx.ingress.kubernetes.io/configuration-snippet: |
          chunked_transfer_encoding off;

Proposed change: add a new option in ConfigMap annotations-risk-level-excluded-namespaces containing a space-separed list of namespaces where annotations-risk-level is set to Critical.

[k8s-ci-robot]

This issue is currently awaiting triage.

If Ingress contributors determines this is a relevant issue, they will accept it by applying the triage/accepted label and provide further guidance.

The triage/accepted label can be added by org members by writing /triage accepted in a comment.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[sathieu]

Other usecases (for kube-apiserver):

    nginx.ingress.kubernetes.io/server-snippet: |
      client_header_buffer_size 40k;
      large_client_header_buffers 4 40k;

[Gacko]

We lowered the annotation risk level to High because there are Critical annotations known to cause security issues in multi-tenant environments. It's probably not what you want, but I'd suggest deploying a second Ingress NGINX Controller for your secure/trusted stuff as this would make it even more secure overall. If you're not running a multi-tenant environment and trust the people creating Ingress resources, there shouldn't be an issue with increasing the risk level back to Critical.

Anyway: We won't implement a feature like this as we're currently looking forward to our Gateway API implementation.

[sathieu]

We are using multi-tenant clusters, and will probably move to another Gateway API implementation than ingate, but a few features are still missing in Gateway API specs.

We'll use Gatekeeper to check ingress-nginx annotations.