Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add options to set additional nginx headers #3817

Merged
merged 4 commits into from
Feb 10, 2025
Merged

Add options to set additional nginx headers #3817

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
0f27e2f
Add options to values.yaml and the nginx template for injecting extra…
nealormsbee Jan 22, 2025
31b37be
Signed-off-by: jesse goodier <31039225+jessegoodier@users.noreply.git…
jessegoodier Jan 23, 2025
5a1532d
Add additional whitelist sources to CSP
nealormsbee Jan 23, 2025
b2f2d0f
Remove support for per-route header configs. Only use global server h…
nealormsbee Jan 23, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 3 additions & 17 deletions cost-analyzer/templates/cost-analyzer-frontend-config-map-template.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -153,7 +153,9 @@ data:
root /var/www;
index index.html;

add_header Cache-Control "must-revalidate";
{{- range .Values.kubecostFrontend.nginxHeaders.server }}
add_header {{ . }}
{{- end }}

{{- if .Values.kubecostFrontend.extraServerConfig }}
{{- .Values.kubecostFrontend.extraServerConfig | toString | nindent 8 -}}
Expand Down Expand Up @@ -240,8 +242,6 @@ data:

location ~ ^/(turndown|cluster)/ {

add_header 'Access-Control-Allow-Origin' '*' always;
add_header 'Access-Control-Allow-Methods' 'GET, PUT, POST, DELETE, OPTIONS' always;
{{- if .Values.clusterController }}
{{- if .Values.clusterController.enabled }}
{{- if or .Values.saml .Values.oidc }}
Expand Down Expand Up @@ -1473,8 +1473,6 @@ data:
{{- end }}
location = /model/hideOrphanedResources {
default_type 'application/json';
add_header 'Access-Control-Allow-Origin' '*' always;
add_header 'Access-Control-Allow-Methods' 'GET, PUT, POST, DELETE, OPTIONS' always;
{{- if .Values.kubecostFrontend.hideOrphanedResources }}
return 200 '{"hideOrphanedResources": "true"}';
{{- else }}
Expand All @@ -1483,8 +1481,6 @@ data:
}
location = /model/hideDiagnostics {
default_type 'application/json';
add_header 'Access-Control-Allow-Origin' '*' always;
add_header 'Access-Control-Allow-Methods' 'GET, PUT, POST, DELETE, OPTIONS' always;
{{- if .Values.kubecostFrontend.hideDiagnostics }}
return 200 '{"hideDiagnostics": "true"}';
{{- else }}
Expand All @@ -1500,8 +1496,6 @@ data:

location /model/multi-cluster-diagnostics-enabled {
default_type 'application/json';
add_header 'Access-Control-Allow-Origin' '*' always;
add_header 'Access-Control-Allow-Methods' 'GET, PUT, POST, DELETE, OPTIONS' always;
{{- if and .Values.diagnostics.enabled .Values.diagnostics.primary.enabled }}
{{- if or (not (empty .Values.kubecostModel.federatedStorageConfigSecret )) .Values.kubecostModel.federatedStorageConfig }}
return 200 '{"multiClusterDiagnosticsEnabled": true}';
Expand All @@ -1521,8 +1515,6 @@ data:
# Deployment, we should forward that path to the K8s Service.
location /model/diagnostics/multicluster {
default_type 'application/json';
add_header 'Access-Control-Allow-Origin' '*' always;
add_header 'Access-Control-Allow-Methods' 'GET, PUT, POST, DELETE, OPTIONS' always;
proxy_read_timeout 300;
proxy_pass http://multi-cluster-diagnostics/status;
proxy_redirect off;
Expand All @@ -1533,8 +1525,6 @@ data:
# simple alias for support
location /mcd {
default_type 'application/json';
add_header 'Access-Control-Allow-Origin' '*' always;
add_header 'Access-Control-Allow-Methods' 'GET, PUT, POST, DELETE, OPTIONS' always;
proxy_read_timeout 300;
proxy_pass http://multi-cluster-diagnostics/status?window=7d;
proxy_redirect off;
Expand All @@ -1554,8 +1544,6 @@ data:
{{- if .Values.forecasting.enabled }}
location /forecasting {
default_type 'application/json';
add_header 'Access-Control-Allow-Origin' '*' always;
add_header 'Access-Control-Allow-Methods' 'GET, PUT, POST, DELETE, OPTIONS' always;
proxy_read_timeout 300;
proxy_pass http://forecasting/;
proxy_redirect off;
Expand All @@ -1572,8 +1560,6 @@ data:

location /model/productConfigs {
default_type 'application/json';
add_header 'Access-Control-Allow-Origin' '*' always;
add_header 'Access-Control-Allow-Methods' 'GET, PUT, POST, DELETE, OPTIONS' always;
return 200 '\n
{
"ssoConfigured": "{{ template "ssoEnabled" . }}",
Expand Down
10 changes: 10 additions & 0 deletions cost-analyzer/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -537,6 +537,16 @@ kubecostFrontend:
# fqdn: kubecost-multi-diag.kubecost.svc.cluster.local:9007
# clusterController:
# fqdn: cluster-controller.kubecost.svc.cluster.local:9731
#

# Configurable headers for nginx responses.
nginxHeaders:
# applied to all route locations
server:
- "'Access-Control-Allow-Origin' '*' always;"
- "'Access-Control-Allow-Methods' 'GET, PUT, POST, DELETE, OPTIONS' always;"
- Content-Security-Policy "default-src 'self' 'unsafe-inline' api.userway.org cdn.userway.org api-js.mixpanel.com keyper.kubecost.com; frame-ancestors 'none'; font-src 'self' data:;";
- Cache-Control "must-revalidate";

# Kubecost Metrics deploys a separate pod which will emit kubernetes specific metrics required
# by the cost-model. This pod is designed to remain active and decoupled from the cost-model itself.
Expand Down
Loading