Nginx Ingress annotation snippet related checks are not checking the correct configuration

[tepentti]

There are 3 checks that are related to Nginx Ingress annotation snippets:

• checkov/kubernetes/checks/resource/k8s/NginxIngressCVE202125742Alias.py
• checkov/kubernetes/checks/resource/k8s/NginxIngressCVE202125742AllSnippets.py
• checkov/kubernetes/checks/resource/k8s/NginxIngressCVE202125742Lua.py

However all of these only check if some annotation snippets are in place, not if the feature is actually disabled. It can be disabled with configuration allow-snippet-annotations which defaults to false:

https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#allow-snippet-annotations

I suggest that those three checks are consolidated into one which fails if in the ConfigMap for Nginx Ingress that configuration is set to true.

[bo156]

@tepentti thanks for the suggestion, the best way to keep all of our policies up to date (and add new ones) is using our community 💯 Please feel free to introduce a PR for this change (or anyone else which might want to contribute :) )