github.com/verrazzano/verrazzano@v1.7.0/platform-operator/helm_config/charts/verrazzano-authproxy/templates/verrazzano-ingress.yaml (about) 1 # Copyright (c) 2021, 2023, Oracle and/or its affiliates. 2 # Licensed under the Universal Permissive License v 1.0 as shown at https://oss.oracle.com/licenses/upl. 3 4 --- 5 apiVersion: networking.k8s.io/v1 6 kind: Ingress 7 metadata: 8 annotations: 9 {{- if .Values.dns.wildcard.domain}} 10 verrazzano.io/dns.wildcard.domain: {{ .Values.dns.wildcard.domain }} 11 {{- end }} 12 external-dns.alpha.kubernetes.io/target: verrazzano-ingress.{{ .Values.config.envName }}.{{ .Values.config.dnsSuffix }} 13 kubernetes.io/tls-acme: "true" 14 nginx.ingress.kubernetes.io/rewrite-target: /$1$2 15 nginx.ingress.kubernetes.io/affinity: cookie 16 nginx.ingress.kubernetes.io/configuration-snippet: | 17 proxy_hide_header X-Powered-By; 18 add_header Last-Modified "$date_gmt"; 19 add_header Pragma "no-cache"; 20 add_header Cache-Control "no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0"; 21 add_header Expect-CT "max-age=86400, enforce"; 22 add_header Referrer-Policy "strict-origin"; 23 add_header X-Content-Type-Options "nosniff" always; 24 add_header X-Frame-Options "DENY" always; 25 add_header X-Permitted-Cross-Domain-Policies "none"; 26 add_header Strict-Transport-Security "max-age=86400; includeSubDomains"; 27 add_header X-XSS-Protection "1; mode=block"; 28 add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-eval' static.oracle.com; form-action 'none'; connect-src 'self' https:; media-src 'none'; object-src 'none'; font-src 'self' static.oracle.com; img-src 'self' data:; style-src 'self' static.oracle.com; frame-ancestors 'none';" always; 29 nginx.ingress.kubernetes.io/session-cookie-conditional-samesite-none: "true" 30 nginx.ingress.kubernetes.io/session-cookie-expires: "86400" 31 nginx.ingress.kubernetes.io/session-cookie-max-age: "86400" 32 nginx.ingress.kubernetes.io/session-cookie-name: route 33 nginx.ingress.kubernetes.io/session-cookie-samesite: Strict 34 nginx.ingress.kubernetes.io/service-upstream: "true" 35 nginx.ingress.kubernetes.io/upstream-vhost: "${service_name}.${namespace}.svc.cluster.local" 36 cert-manager.io/common-name: verrazzano.{{ .Values.config.envName }}.{{ .Values.config.dnsSuffix }} 37 cert-manager.io/cluster-issuer: verrazzano-cluster-issuer 38 name: verrazzano-ingress 39 namespace: {{ .Release.Namespace }} 40 spec: 41 ingressClassName: {{ .Values.config.ingressClassName }} 42 rules: 43 - host: verrazzano.{{ .Values.config.envName }}.{{ .Values.config.dnsSuffix }} 44 http: 45 paths: 46 {{- if .Values.v2.enabled }} 47 - backend: 48 service: 49 name: {{ .Values.name }} 50 port: 51 number: {{ .Values.v2.port }} 52 path: /(clusters)(.*) 53 pathType: Prefix 54 {{- end }} 55 - backend: 56 service: 57 name: {{ .Values.name }} 58 port: 59 number: {{ .Values.port }} 60 path: /()(.*) 61 pathType: ImplementationSpecific 62 tls: 63 - hosts: 64 - verrazzano.{{ .Values.config.envName }}.{{ .Values.config.dnsSuffix }} 65 secretName: verrazzano-tls