airship/maas
Code Issues Proposed changes

Change pathtype to prefix

Browse Source 
Due to cve-2022-4886 the default pathType for an ingress should be
either "Exact" or "Prefix". This allows for more strict path validation by
the admission controller.

Change-Id: I1089bd5c893685fe3b2bcd6868da2f2b761e144f
This commit is contained in:
Ritchie, Frank (fr801x) 2024-01-29 10:58:42 -05:00
parent 962db46114
commit 906f9a5f15
1 changed files with 5 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
charts/maas/templates/ingress-region.yaml
View File

@ -28,28 +28,28 @@ spec:
paths:
{{- if .Values.conf.maas.ingress_disable_gui }}
- path: /MAAS/api
pathType: ImplementationSpecific
pathType: Prefix
backend:
service:
name: {{ tuple "maas_region" "internal" . | include "helm-toolkit.endpoints.hostname_short_endpoint_lookup" }}
port:
name: region-api
- path: /MAAS/images-stream
pathType: ImplementationSpecific
pathType: Prefix
backend:
service:
name: {{ tuple "maas_region" "internal" . | include "helm-toolkit.endpoints.hostname_short_endpoint_lookup" }}
port:
name: region-api
- path: /MAAS/metadata
pathType: ImplementationSpecific
pathType: Prefix
backend:
service:
name: {{ tuple "maas_region" "internal" . | include "helm-toolkit.endpoints.hostname_short_endpoint_lookup" }}
port:
name: region-api
- path: /MAAS/rpc
pathType: ImplementationSpecific
pathType: Prefix
backend:
service:
name: {{ tuple "maas_region" "internal" . | include "helm-toolkit.endpoints.hostname_short_endpoint_lookup" }}
@ -57,7 +57,7 @@ spec:
name: region-api
{{- else }}
- path: /
pathType: ImplementationSpecific
pathType: Prefix
backend:
service:
name: {{ tuple "maas_region" "internal" . | include "helm-toolkit.endpoints.hostname_short_endpoint_lookup" }}