Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix issue in logic of modsec template #4793

Merged
merged 1 commit into from
Nov 28, 2019
Merged

Conversation

MMeent
Copy link
Contributor

@MMeent MMeent commented Nov 28, 2019

according to go templates: (and ((not false) false)) == true

the only way to remove the owasp rules from every location is to disable modsec on that location, or to enable owasp globally, both not-so-great choices.

This commit fixes the logic issue by fixing the and-clause in the if-statement. As a result this reduces global resource usages when modsecurity is configured globally, but not on every location.

What this PR does / why we need it:
The current logic in the template dictates that when you enable modsecurity globally, you either also enable the owasp rule sets globally, or the owasp rulesets are rendered into each location, increasing memory usage per-location without a way to turn this off.

Which issue this PR fixes fixes #4629

Special notes for your reviewer: If possible, please backport to 0.26.x

according to go templates: `(and ((not false) false))` == `true`

the only way to remove the owasp rules from every location is to disable modsec on that location, or to enable owasp globally, both not-so-great choices.

This commit fixes the logic issue by fixing the and-clause in the if-statement. As a result this reduces global resource usages when modsecurity is configured globally, but not on every location.
@k8s-ci-robot k8s-ci-robot added cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Nov 28, 2019
@k8s-ci-robot
Copy link
Contributor

Hi @MMeent. Thanks for your PR.

I'm waiting for a kubernetes member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@k8s-ci-robot k8s-ci-robot added the size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. label Nov 28, 2019
@aledbf
Copy link
Member

aledbf commented Nov 28, 2019

/ok-to-test

@k8s-ci-robot k8s-ci-robot added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Nov 28, 2019
@codecov-io
Copy link

codecov-io commented Nov 28, 2019

Codecov Report

❗ No coverage uploaded for pull request base (master@de12fc1). Click here to learn what that means.
The diff coverage is n/a.

Impacted file tree graph

@@            Coverage Diff            @@
##             master    #4793   +/-   ##
=========================================
  Coverage          ?   58.59%           
=========================================
  Files             ?       88           
  Lines             ?     6702           
  Branches          ?        0           
=========================================
  Hits              ?     3927           
  Misses            ?     2349           
  Partials          ?      426

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update de12fc1...75e8d37. Read the comment docs.

@aledbf
Copy link
Member

aledbf commented Nov 28, 2019

/lgtm

@MMeent thanks!

@k8s-ci-robot k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Nov 28, 2019
@k8s-ci-robot
Copy link
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: aledbf, MMeent

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@k8s-ci-robot k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Nov 28, 2019
@aledbf
Copy link
Member

aledbf commented Nov 28, 2019

/retest

@k8s-ci-robot k8s-ci-robot merged commit 60fc37d into kubernetes:master Nov 28, 2019
@MMeent MMeent deleted the patch-2 branch December 2, 2019 11:54
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. lgtm "Looks good to me", indicates that a PR is ready to be merged. ok-to-test Indicates a non-member PR verified by an org member that is safe to test. size/XS Denotes a PR that changes 0-9 lines, ignoring generated files.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Since v0.25.0(maybe?), memory footprint increased by factor of 7 (0.24.1 to 0.26.1, no other change)
4 participants