ingress-nginx rewrite-target annotation nginx configuration injection

#!/usr/bin/env bash
# noisgate verifier: CVE-2026-3288 (ingress-nginx rewrite-target injection)
# Exit: 0 PATCHED, 1 VULNERABLE, 2 UNKNOWN
set -u
CTX="${1:-}"
KUBECTL="kubectl"
[ -n "$CTX" ] && KUBECTL="kubectl --context=$CTX"

command -v jq >/dev/null || { echo "UNKNOWN: jq missing"; exit 2; }
command -v kubectl >/dev/null || { echo "UNKNOWN: kubectl missing"; exit 2; }

# Find any Deployment/DaemonSet running an ingress-nginx controller image
PODS=$($KUBECTL get pods -A -o json 2>/dev/null | \
  jq -r '.items[] | select(.spec.containers[]?.image | test("ingress-nginx/controller")) | \
    [.metadata.namespace, .metadata.name, (.spec.containers[] | select(.image|test("ingress-nginx/controller")) | .image)] | @tsv')

if [ -z "$PODS" ]; then
  echo "UNKNOWN: no ingress-nginx controller pods found in this cluster"
  exit 2
fi

vuln=0
unknown=0
while IFS=$'\t' read -r ns name image; do
  tag=$(echo "$image" | sed -E 's/.*:v?([0-9]+\.[0-9]+\.[0-9]+).*/\1/')
  if ! echo "$tag" | grep -qE '^[0-9]+\.[0-9]+\.[0-9]+$'; then
    echo "UNKNOWN: $ns/$name image=$image (cannot parse tag)"
    unknown=1
    continue
  fi
  IFS=. read -r maj min pat <<< "$tag"
  # Fixed: 1.13.8, 1.14.4, 1.15.0 (and any 1.15+ / 1.x >1.15)
  fixed=1
  if [ "$maj" -eq 1 ]; then
    if [ "$min" -lt 13 ]; then fixed=0
    elif [ "$min" -eq 13 ] && [ "$pat" -lt 8 ]; then fixed=0
    elif [ "$min" -eq 14 ] && [ "$pat" -lt 4 ]; then fixed=0
    fi
  elif [ "$maj" -lt 1 ]; then
    fixed=0
  fi
  if [ "$fixed" -eq 0 ]; then
    echo "VULNERABLE: $ns/$name running $tag"
    vuln=1
  else
    echo "PATCHED: $ns/$name running $tag"
  fi
done <<< "$PODS"

if [ "$vuln" -eq 1 ]; then exit 1; fi
if [ "$unknown" -eq 1 ]; then exit 2; fi
exit 0