Skip to content

Commit a6e38dc

Browse files
kendrickcurtiskendrickcurtis
authored
added rules to detect ingress nginx as it is being deprecated (#71)
1 parent c2fc324 commit a6e38dc

File tree

4 files changed

+180
-0
lines changed

4 files changed

+180
-0
lines changed

‎docs/codacy-rules.yaml‎

Lines changed: 96 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -511,3 +511,99 @@ rules:
511511
description: Classes with 'Exception' in their name should inherit from Exception or its subclasses
512512
impact: LOW
513513
confidence: HIGH
514+
- id: codacy.k8s.ingress.nginx.retirement.ingress-resource
515+
languages:
516+
- yaml
517+
severity: WARNING
518+
message: >
519+
This Ingress is configured to use the Ingress NGINX controller
520+
(kubernetes.io/ingress.class: nginx or ingressClassName: nginx).
521+
Ingress NGINX is scheduled for retirement (no fixes after March 2026).
522+
Plan to migrate to Gateway API or another Ingress controller.
523+
patterns:
524+
- pattern-either:
525+
# Classic way: annotation kubernetes.io/ingress.class: nginx
526+
- pattern: |
527+
apiVersion: ...
528+
kind: Ingress
529+
metadata:
530+
...
531+
annotations:
532+
...
533+
kubernetes.io/ingress.class: nginx
534+
...
535+
# Newer way: spec.ingressClassName: nginx
536+
- pattern: |
537+
apiVersion: ...
538+
kind: Ingress
539+
spec:
540+
...
541+
ingressClassName: nginx
542+
...
543+
metadata:
544+
category: security
545+
technology:
546+
- kubernetes
547+
description: >
548+
Detects Ingress resources configured to use the Ingress NGINX controller.
549+
Ingress NGINX is scheduled for retirement (no fixes after March 2026).
550+
impact: MEDIUM
551+
confidence: HIGH
552+
references:
553+
- https://kubernetes.io/blog/2025/11/11/ingress-nginx-retirement/
554+
- https://kubernetes.github.io/ingress-nginx/user-guide/basic-usage/
555+
- id: codacy.k8s.ingress.nginx.retirement.ingress-class
556+
languages:
557+
- yaml
558+
severity: WARNING
559+
message: >
560+
This IngressClass is wired to the Ingress NGINX controller
561+
(spec.controller: k8s.io/ingress-nginx).
562+
Ingress NGINX is scheduled for retirement (no fixes after March 2026).
563+
Plan to migrate to Gateway API or another Ingress controller.
564+
pattern: |
565+
apiVersion: networking.k8s.io/v1
566+
kind: IngressClass
567+
...
568+
spec:
569+
controller: k8s.io/ingress-nginx
570+
metadata:
571+
category: security
572+
technology:
573+
- kubernetes
574+
description: >
575+
Detects IngressClass objects wired to the Ingress NGINX controller.
576+
Ingress NGINX is scheduled for retirement (no fixes after March 2026).
577+
impact: MEDIUM
578+
confidence: HIGH
579+
references:
580+
- https://kubernetes.io/blog/2025/11/11/ingress-nginx-retirement/
581+
- id: codacy.k8s.ingress.nginx.retirement.workload
582+
languages:
583+
- yaml
584+
severity: WARNING
585+
message: >
586+
This Kubernetes resource is labelled as part of the Ingress NGINX
587+
controller stack (app.kubernetes.io/name: ingress-nginx).
588+
Ingress NGINX is scheduled for retirement (no fixes after March 2026).
589+
Plan to migrate to Gateway API or another Ingress controller.
590+
pattern: |
591+
apiVersion: ...
592+
kind: $KIND
593+
metadata:
594+
...
595+
labels:
596+
...
597+
app.kubernetes.io/name: ingress-nginx
598+
...
599+
metadata:
600+
category: security
601+
technology:
602+
- kubernetes
603+
description: >
604+
Detects Kubernetes resources labelled as part of the Ingress NGINX
605+
controller stack. Ingress NGINX is scheduled for retirement (no fixes after March 2026).
606+
impact: MEDIUM
607+
confidence: HIGH
608+
references:
609+
- https://kubernetes.io/blog/2025/11/11/ingress-nginx-retirement/

‎docs/multiple-tests/codacy-rules/patterns.xml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,4 +12,7 @@
1212
<module name="codacy.python.openai.import-without-guardrails"/>
1313
<module name="codacy.csharp.security.sql-injection.dynamic-query"/>
1414
<module name="codacy.csharp.best-practice.misleading-exception-class-name" />
15+
<module name="codacy.k8s.ingress.nginx.retirement.ingress-resource" />
16+
<module name="codacy.k8s.ingress.nginx.retirement.ingress-class" />
17+
<module name="codacy.k8s.ingress.nginx.retirement.workload" />
1518
</module>

‎docs/multiple-tests/codacy-rules/results.xml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -44,4 +44,10 @@
4444
<error source="codacy.csharp.best-practice.misleading-exception-class-name" line="26" message="Class name contains 'Exception' but does not inherit from System.Exception or its subclasses." severity="warning" />
4545
<error source="codacy.csharp.best-practice.misleading-exception-class-name" line="33" message="Class name contains 'Exception' but does not inherit from System.Exception or its subclasses." severity="warning" />
4646
</file>
47+
<file name="codacy.k8s.ingress.nginx.retirement.yaml">
48+
<error source="codacy.k8s.ingress.nginx.retirement.ingress-resource" line="5" message="This Ingress is configured to use the Ingress NGINX controller (kubernetes.io/ingress.class: nginx or ingressClassName: nginx). Ingress NGINX is scheduled for retirement (no fixes after March 2026). Plan to migrate to Gateway API or another Ingress controller." severity="warning" />
49+
<error source="codacy.k8s.ingress.nginx.retirement.ingress-resource" line="26" message="This Ingress is configured to use the Ingress NGINX controller (kubernetes.io/ingress.class: nginx or ingressClassName: nginx). Ingress NGINX is scheduled for retirement (no fixes after March 2026). Plan to migrate to Gateway API or another Ingress controller." severity="warning" />
50+
<error source="codacy.k8s.ingress.nginx.retirement.ingress-class" line="46" message="This IngressClass is wired to the Ingress NGINX controller (spec.controller: k8s.io/ingress-nginx). Ingress NGINX is scheduled for retirement (no fixes after March 2026). Plan to migrate to Gateway API or another Ingress controller." severity="warning" />
51+
<error source="codacy.k8s.ingress.nginx.retirement.workload" line="55" message="This Kubernetes resource is labelled as part of the Ingress NGINX controller stack (app.kubernetes.io/name: ingress-nginx). Ingress NGINX is scheduled for retirement (no fixes after March 2026). Plan to migrate to Gateway API or another Ingress controller." severity="warning" />
52+
</file>
4753
</checkstyle>

‎docs/multiple-tests/codacy-rules/src/codacy.k8s.ingress.nginx.retirement.yaml‎

Lines changed: 75 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,75 @@
1+
# Test file for k8s.ingress.nginx.retirement rules
2+
3+
---
4+
# Test case 1: Ingress with annotation (should trigger ingress-resource rule)
5+
apiVersion: networking.k8s.io/v1
6+
kind: Ingress
7+
metadata:
8+
name: test-ingress-annotation
9+
annotations:
10+
kubernetes.io/ingress.class: nginx
11+
spec:
12+
rules:
13+
- host: example.com
14+
http:
15+
paths:
16+
- path: /
17+
pathType: Prefix
18+
backend:
19+
service:
20+
name: test-service
21+
port:
22+
number: 80
23+
24+
---
25+
# Test case 2: Ingress with ingressClassName (should trigger ingress-resource rule)
26+
apiVersion: networking.k8s.io/v1
27+
kind: Ingress
28+
metadata:
29+
name: test-ingress-classname
30+
spec:
31+
ingressClassName: nginx
32+
rules:
33+
- host: example.com
34+
http:
35+
paths:
36+
- path: /
37+
pathType: Prefix
38+
backend:
39+
service:
40+
name: test-service
41+
port:
42+
number: 80
43+
44+
---
45+
# Test case 3: IngressClass (should trigger ingress-class rule)
46+
apiVersion: networking.k8s.io/v1
47+
kind: IngressClass
48+
metadata:
49+
name: nginx
50+
spec:
51+
controller: k8s.io/ingress-nginx
52+
53+
---
54+
# Test case 4: Deployment with ingress-nginx label (should trigger workload rule)
55+
apiVersion: apps/v1
56+
kind: Deployment
57+
metadata:
58+
name: ingress-nginx-controller
59+
labels:
60+
app.kubernetes.io/name: ingress-nginx
61+
app.kubernetes.io/component: controller
62+
spec:
63+
replicas: 1
64+
selector:
65+
matchLabels:
66+
app.kubernetes.io/name: ingress-nginx
67+
template:
68+
metadata:
69+
labels:
70+
app.kubernetes.io/name: ingress-nginx
71+
spec:
72+
containers:
73+
- name: controller
74+
image: registry.k8s.io/ingress-nginx/controller:v1.8.1
75+

0 commit comments

Comments
 (0)