mirror of
https://github.com/outbackdingo/cozystack.git
synced 2026-01-28 10:18:42 +00:00
667c778f27
This patch updates the default API Ingress to add the nginx.ingress.kubernetes.io/force-ssl-redirect annotation, ensuring all HTTP traffic (port 80) is redirected to HTTPS (port 443). This prevents unencrypted external access and improves security. ```release-note [ingress] Force HTTPS access for api.dev3.infra.aenix.org and block direct HTTP. ``` Signed-off-by: IvanHunters <xorokhotnikov@gmail.com>
30 lines
902 B
YAML
30 lines
902 B
YAML
{{- $cozyConfig := lookup "v1" "ConfigMap" "cozy-system" "cozystack" }}
|
|
{{- $host := index $cozyConfig.data "root-host" }}
|
|
{{- $exposeServices := splitList "," ((index $cozyConfig.data "expose-services") | default "") }}
|
|
{{- $exposeIngress := index $cozyConfig.data "expose-ingress" | default "tenant-root" }}
|
|
|
|
{{- if and (has "api" $exposeServices) }}
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
annotations:
|
|
nginx.ingress.kubernetes.io/backend-protocol: HTTPS
|
|
nginx.ingress.kubernetes.io/ssl-passthrough: "true"
|
|
nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
|
|
name: kubernetes
|
|
namespace: default
|
|
spec:
|
|
ingressClassName: {{ $exposeIngress }}
|
|
rules:
|
|
- host: api.{{ $host }}
|
|
http:
|
|
paths:
|
|
- backend:
|
|
service:
|
|
name: kubernetes
|
|
port:
|
|
number: 443
|
|
path: /
|
|
pathType: Prefix
|
|
{{- end }}
|