hsts annotation validation has been relaxed to comform with existing behaviour

Author: Mike Stephen

internal/k8s/validation.go

@@ -137,17 +137,17 @@ var (
 			validateBoolAnnotation,
 		},
 		hstsMaxAgeAnnotation: {
-			validateRelatedAnnotation(hstsAnnotation, validateIsTrue),
+			validateRelatedAnnotation(hstsAnnotation, validateIsBool),
 			validateRequiredAnnotation,
 			validateInt64Annotation,
 		},
 		hstsIncludeSubdomainsAnnotation: {
-			validateRelatedAnnotation(hstsAnnotation, validateIsTrue),
+			validateRelatedAnnotation(hstsAnnotation, validateIsBool),
 			validateRequiredAnnotation,
 			validateBoolAnnotation,
 		},
 		hstsBehindProxyAnnotation: {
-			validateRelatedAnnotation(hstsAnnotation, validateIsTrue),
+			validateRelatedAnnotation(hstsAnnotation, validateIsBool),
 			validateRequiredAnnotation,
 			validateBoolAnnotation,
 		},
@@ -471,6 +471,11 @@ func validateRewriteListAnnotation(context *annotationValidationContext) field.E
 	return allErrs
 }
 
+func validateIsBool(v string) error {
+	_, err := configs.ParseBool(v)
+	return err
+}
+
 func validateIsTrue(v string) error {
 	b, err := configs.ParseBool(v)
 	if err != nil {

internal/k8s/validation_test.go

@@ -751,6 +751,18 @@ func TestValidateNginxIngressAnnotations(t *testing.T) {
 			expectedErrors:        nil,
 			msg:                   "valid nginx.org/hsts-max-age annotation",
 		},
+		{
+			annotations: map[string]string{
+				"nginx.org/hsts":         "false",
+				"nginx.org/hsts-max-age": "120",
+			},
+			specServices:          map[string]bool{},
+			isPlus:                false,
+			appProtectEnabled:     false,
+			internalRoutesEnabled: false,
+			expectedErrors:        nil,
+			msg:                   "valid nginx.org/hsts-max-age nginx.org/hsts can be false",
+		},
 		{
 			annotations: map[string]string{
 				"nginx.org/hsts":         "true",
@@ -778,32 +790,30 @@ func TestValidateNginxIngressAnnotations(t *testing.T) {
 			},
 			msg: "invalid nginx.org/hsts-max-age, related annotation nginx.org/hsts not set",
 		},
+
 		{
 			annotations: map[string]string{
-				"nginx.org/hsts":         "false",
-				"nginx.org/hsts-max-age": "120",
+				"nginx.org/hsts":                    "true",
+				"nginx.org/hsts-include-subdomains": "true",
 			},
 			specServices:          map[string]bool{},
 			isPlus:                false,
 			appProtectEnabled:     false,
 			internalRoutesEnabled: false,
-			expectedErrors: []string{
-				"annotations.nginx.org/hsts-max-age: Forbidden: related annotation nginx.org/hsts: must be true",
-			},
-			msg: "invalid nginx.org/hsts-max-age nginx.org/hsts is not true",
+			expectedErrors:        nil,
+			msg:                   "valid nginx.org/hsts-include-subdomains annotation",
 		},
-
 		{
 			annotations: map[string]string{
-				"nginx.org/hsts":                    "true",
+				"nginx.org/hsts":                    "false",
 				"nginx.org/hsts-include-subdomains": "true",
 			},
 			specServices:          map[string]bool{},
 			isPlus:                false,
 			appProtectEnabled:     false,
 			internalRoutesEnabled: false,
 			expectedErrors:        nil,
-			msg:                   "valid nginx.org/hsts-include-subdomains annotation",
+			msg:                   "valid nginx.org/hsts-include-subdomains, nginx.org/hsts can be false",
 		},
 		{
 			annotations: map[string]string{
@@ -832,32 +842,30 @@ func TestValidateNginxIngressAnnotations(t *testing.T) {
 			},
 			msg: "invalid nginx.org/hsts-include-subdomains, related annotation nginx.org/hsts not set",
 		},
+
 		{
 			annotations: map[string]string{
-				"nginx.org/hsts":                    "false",
-				"nginx.org/hsts-include-subdomains": "true",
+				"nginx.org/hsts":              "true",
+				"nginx.org/hsts-behind-proxy": "true",
 			},
 			specServices:          map[string]bool{},
 			isPlus:                false,
 			appProtectEnabled:     false,
 			internalRoutesEnabled: false,
-			expectedErrors: []string{
-				"annotations.nginx.org/hsts-include-subdomains: Forbidden: related annotation nginx.org/hsts: must be true",
-			},
-			msg: "invalid nginx.org/hsts-include-subdomains nginx.org/hsts is not true",
+			expectedErrors:        nil,
+			msg:                   "valid nginx.org/hsts-behind-proxy annotation",
 		},
-
 		{
 			annotations: map[string]string{
-				"nginx.org/hsts":              "true",
+				"nginx.org/hsts":              "false",
 				"nginx.org/hsts-behind-proxy": "true",
 			},
 			specServices:          map[string]bool{},
 			isPlus:                false,
 			appProtectEnabled:     false,
 			internalRoutesEnabled: false,
 			expectedErrors:        nil,
-			msg:                   "valid nginx.org/hsts-behind-proxy annotation",
+			msg:                   "valid nginx.org/hsts-behind-proxy, nginx.org/hsts can be false",
 		},
 		{
 			annotations: map[string]string{
@@ -886,20 +894,6 @@ func TestValidateNginxIngressAnnotations(t *testing.T) {
 			},
 			msg: "invalid nginx.org/hsts-behind-proxy, related annotation nginx.org/hsts not set",
 		},
-		{
-			annotations: map[string]string{
-				"nginx.org/hsts":              "false",
-				"nginx.org/hsts-behind-proxy": "true",
-			},
-			specServices:          map[string]bool{},
-			isPlus:                false,
-			appProtectEnabled:     false,
-			internalRoutesEnabled: false,
-			expectedErrors: []string{
-				"annotations.nginx.org/hsts-behind-proxy: Forbidden: related annotation nginx.org/hsts: must be true",
-			},
-			msg: "invalid nginx.org/hsts-behind-proxy nginx.org/hsts is not true",
-		},
 
 		{
 			annotations: map[string]string{