custom-error-pages: Add an ability to disable "/metrics", "/healthz" and "/debug/vars" endpoints

Author: ucinskijCreated Oct 13, 2022Updated Mar 13, 2026
Labelskind/featurepriority/backlogneeds-triage

The custom-error-pages backend does it job pretty well, however during a security scan it was detected that it exposes three endpoints: /metrics /healthz /debug/vars

/metrics and /healthz are implemented by https://github.com/kubernetes/ingress-nginx/blob/499dbf57af5d0d7eb2fdb298cc89b5f4bf179854/images/custom-error-pages/rootfs/main.go#L78

/debug/vars at a first sight seems to be coming with github.com/prometheus/client_golang which includes expvar: https://pkg.go.dev/expvar

Especially the first and last ones expose information that might be considered as 'sensitive' by some organizations. Hence why I would like to ask for a feature toggle that would allow to disable those endpoints. It is to be considered if those should be exposed by default or not.

Source: kubernetes/ingress-nginx