Admission webhook did not detect host/path overlap with multiple ingress rules

[rkevin-arch]

What happened:

The validation webhook when checking for host/path overlap between objects will exit prematurely if the first rule doesn't have any issues, even if subsequent rules have issues. See below repro case for an example.

What you expected to happen:

The new object with overlapping rules should be rejected

NGINX Ingress controller version (exec into the pod and run /nginx-ingress-controller --version): 1.12.1

Kubernetes version (use kubectl version): v1.32.2

Environment: Self-hosted onprem, but the issue has nothing to do with the environment and can be replicated in a fresh minikube environment.

How to reproduce this issue:

Create the following ingress object:

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: first-ingress
spec:
  rules:
  - host: conflict.example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: whatever
            port:
              number: 80

Then try creating this ingress object:

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: second-ingress
spec:
  rules:
  - host: safe.example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: whatever
            port:
              number: 80
  - host: conflict.example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: whatever
            port:
              number: 80

This will create successfully despite the second rule being in conflict with the other object. If you reverse the order of the two rules in this second object, the validation controller fails with admission webhook "validate.nginx.ingress.kubernetes.io" denied the request: host "conflict.example.com" and path "/" is already defined in ingress default/first-ingress as expected.

Anything else we need to know:

This ultimately stems from stray return nils here. I'll make a PR to fix this

[longwuyuan]

/remove-kind bug

Check the nginx.conf file inside the pod. How many do you see for the same hostname ?

/remove-kind bug
/kind support
/triage needs-information

[rkevin-arch]

This bug report doesn't have much to do with nginx.conf generation itself. Since ingress-nginx processes objects from the oldest objects first, the first object will take precedence over the second object if both are created. This bug report is for the admission controller not catching that the second object has a duplicate hostname/path. You can reproduce this behavior by the instructions already provided in the description, and I have made a PR #13162 to fix this issue

[github-actions]

This is stale, but we won't close it automatically, just bare in mind the maintainers may be busy with other tasks and will reach your issue ASAP. If you have any question or request to prioritize this, please reach #ingress-nginx-dev on Kubernetes Slack.