Skip to content

Commit e2ee334

Browse files
Link configuration snippet to allow-snippet-annotations (#10456)
1 parent 4bac120 commit e2ee334

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

docs/user-guide/nginx-configuration/annotations.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -316,7 +316,7 @@ nginx.ingress.kubernetes.io/configuration-snippet: |
316316
more_set_headers "Request-Id: $req_id";
317317
```
318318
319-
Be aware this can be dangerous in multi-tenant clusters, as it can lead to people with otherwise limited permissions being able to retrieve all secrets on the cluster. The recommended mitigation for this threat is to disable this feature, so it may not work for you. See CVE-2021-25742 and the [related issue on github](https://github.com/kubernetes/ingress-nginx/issues/7837) for more information.
319+
Since version 1.9.0 this annotation is disabled by default and has to be explicitly enabled, see [allow-snippet-annotations](./configmap.md/#allow-snippet-annotations). Enabling it can be dangerous in multi-tenant clusters, as it can lead to people with otherwise limited permissions being able to retrieve all secrets on the cluster. See CVE-2021-25742 and the [related issue on github](https://github.com/kubernetes/ingress-nginx/issues/7837) for more information.
320320
321321
### Custom HTTP Errors
322322

0 commit comments

Comments
 (0)