Description
A trailing comma in the haproxy.org/allow-list annotation appears to cause the allow-list to behave as if it were empty, effectively allowing traffic from any source IP.
For example:
metadata:
annotations:
haproxy.org/allow-list: "10.0.0.0/8,192.168.1.0/24,"Without the trailing comma, access is correctly restricted to the specified networks:
haproxy.org/allow-list: "10.0.0.0/8,192.168.1.0/24"
However, adding the trailing comma causes the Ingress to become accessible from arbitrary external IP addresses.
Expected behavior
A trailing comma should either:
- be ignored, resulting in the same configuration as without the trailing comma; or
- cause the annotation to be rejected as invalid.
It should not result in the allow-list being disabled or interpreted as allowing all sources.
Actual behavior
With:
haproxy.org/allow-list: "10.0.0.0/8,192.168.1.0/24,"
the configured source restrictions are effectively bypassed and the service becomes reachable from the public internet.
This is particularly concerning because a trailing comma can easily be introduced accidentally when generating the annotation dynamically.
Security impact
This can result in an unintended exposure of an otherwise restricted Kubernetes Ingress.
For example, a configuration intended to allow only internal networks:
haproxy.org/allow-list: "10.0.0.0/8,172.16.0.0/12,"
can potentially become publicly accessible simply because of the trailing comma.
This could lead to accidental exposure of internal services.
Reproduction
Create an Ingress with:
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: test
annotations:
haproxy.org/allow-list: "10.0.0.0/8,"
spec:
ingressClassName: haproxy
# ...Then access the Ingress from an IP outside the allowed 10.0.0.0/8 network.
The request is allowed, whereas removing the trailing comma correctly blocks the request.
Environment
- HAProxy Kubernetes Ingress Controller: Community Edition
- Controller version:
3.2.6
- HAProxy version:
3.2.12
Given the security implications, it may also be worth treating malformed allow-list annotations as configuration errors and failing closed rather than falling back to allowing all traffic.
Reference:
HAProxy Kubernetes Ingress Controller — allow-list documentation
Description
A trailing comma in the
haproxy.org/allow-listannotation appears to cause the allow-list to behave as if it were empty, effectively allowing traffic from any source IP.For example:
Without the trailing comma, access is correctly restricted to the specified networks:
However, adding the trailing comma causes the Ingress to become accessible from arbitrary external IP addresses.
Expected behavior
A trailing comma should either:
It should not result in the allow-list being disabled or interpreted as allowing all sources.
Actual behavior
With:
the configured source restrictions are effectively bypassed and the service becomes reachable from the public internet.
This is particularly concerning because a trailing comma can easily be introduced accidentally when generating the annotation dynamically.
Security impact
This can result in an unintended exposure of an otherwise restricted Kubernetes Ingress.
For example, a configuration intended to allow only internal networks:
can potentially become publicly accessible simply because of the trailing comma.
This could lead to accidental exposure of internal services.
Reproduction
Create an Ingress with:
Then access the Ingress from an IP outside the allowed
10.0.0.0/8network.The request is allowed, whereas removing the trailing comma correctly blocks the request.
Environment
3.2.63.2.12Given the security implications, it may also be worth treating malformed
allow-listannotations as configuration errors and failing closed rather than falling back to allowing all traffic.Reference:
HAProxy Kubernetes Ingress Controller — allow-list documentation