Empty access_by_lua_block breaks satisfy any

[aledbf]

What this PR does / why we need it:

When access_by_lua_block is empty and satisfy any is specified in a snippet (or custom template),
any restriction is broken due the fact an empty access_by_lua_block block means 'OK'

Example:

nginx.ingress.kubernetes.io/configuration-snippet: |-
  allow 127.0.0.0/8;
  allow 10.0.0.0/8;
  deny all;
  satisfy any;

This PR enables the access_by_lua_block only if the waf module is enabled

Which issue this PR fixes (optional, in fixes #<issue number>(, fixes #<issue_number>, ...) format, will close that issue when PR gets merged): fixes #3480

[ElvinEfendi]

/lgtm

Good catch!

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: aledbf, ElvinEfendi

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [ElvinEfendi,aledbf]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[proligde]

@aledbf not sure if I'm missing sth. here but I'm using ingress-nginx version 0.25.1 (the one currently bundled with microk8s) and it seems that the issue still exists. No matter if I use:

nginx.ingress.kubernetes.io/configuration-snippet: |-
  allow 127.0.0.0/8;  
  allow 10.0.0.0/8;  
  deny all;  
  satisfy any;

or

    nginx.ingress.kubernetes.io/auth-type: basic  
    nginx.ingress.kubernetes.io/auth-secret: my-basic-auth-secret  
    nginx.ingress.kubernetes.io/satisfy: "any"  
    nginx.ingress.kubernetes.io/whitelist-source-range: "1.2.3.4"  

Access is never blocked.

[aledbf]

@proligde I suggest you update to 0.32.0. Not sure why microk8s is using a version from Aug 14, 2019.

[proligde]

@aledbf me neither ;-) but according to https://microk8s.io/docs/release-notes they do. Anyway thanks for the suggestion. I'll see if I can exchange the bundled version with a from-scratch installation of ingress-nginx.