Trey t
ace03d2340
Four related hardening changes made on the live cluster during this session. Each manifest captures the final working state so a fresh `kubectl apply` of the repo reproduces it. 1. Cloudflare Full (strict) TLS — ingresses now carry `tls:` blocks pointing at `cloudflare-origin-cert` secret (installed imperatively from the CF Origin CA PEM). CF SSL mode flipped from Flexible to Full (strict). CF↔origin is now HTTPS; origin serves a CF-issued cert that only CF can validate. 2. Traefik middleware attached to all three ingresses — `rate-limit` (100/min avg, 200 burst) and `security-headers` (frame-deny, nosniff, HSTS, referrer policy, permissions policy). `admin-auth` middleware was also defined in middleware.yaml but is not attached (needs an unset basic-auth secret) and was deleted at runtime. 3. `security-headers` middleware: stripped the Content-Security-Policy entry. The Go API sets its own CSP in internal/router/router.go that permits Google Fonts for the landing page. Two CSP headers combine via intersection (most restrictive wins), which would break the landing page. Next.js apps set their own CSP via middleware. Header kept documentation comments explain this. 4. NetworkPolicies — default-deny + explicit allows, applied. Added missing policies for `web`. Corrected the Traefik ingress rule: the scaffold used `namespaceSelector: kube-system`, but our Traefik runs as a DaemonSet with `hostNetwork: true`, so traffic arrives with the NODE IP as source. Fixed to an `ipBlock` list of the three node IPs plus the cluster pod CIDR (10.42.0.0/16). 5. admin livenessProbe path fix: was hitting /admin/ (404) which caused a 6-hour crashloop cycle (87 restarts) before the bug was caught. Fixed to / — matches the startupProbe and readinessProbe paths that were corrected earlier. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
101 lines
2.7 KiB
YAML
101 lines
2.7 KiB
YAML
# Hostname-based Ingress with TLS terminated at Traefik using the
|
|
# Cloudflare Origin CA cert (secret/cloudflare-origin-cert). CF→origin
|
|
# encryption enables CF SSL mode "Full (strict)".
|
|
#
|
|
# Middleware chain (security headers, rate limit, CF-only allowlist, admin
|
|
# basic auth) is defined in `middleware.yaml`. security-headers + rate-limit
|
|
# are attached below via annotation.
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: honeydue-api
|
|
namespace: honeydue
|
|
labels:
|
|
app.kubernetes.io/part-of: honeydue
|
|
annotations:
|
|
traefik.ingress.kubernetes.io/router.middlewares: honeydue-security-headers@kubernetescrd,honeydue-rate-limit@kubernetescrd
|
|
spec:
|
|
ingressClassName: traefik
|
|
tls:
|
|
- hosts:
|
|
- api.myhoneydue.com
|
|
- myhoneydue.com
|
|
secretName: cloudflare-origin-cert
|
|
rules:
|
|
- host: api.myhoneydue.com
|
|
http:
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: api
|
|
port:
|
|
number: 8000
|
|
# Root domain serves the marketing landing page from the Go API's
|
|
# STATIC_DIR. ALLOWED_HOSTS in honeydue-config includes myhoneydue.com.
|
|
- host: myhoneydue.com
|
|
http:
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: api
|
|
port:
|
|
number: 8000
|
|
---
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: honeydue-admin
|
|
namespace: honeydue
|
|
labels:
|
|
app.kubernetes.io/part-of: honeydue
|
|
annotations:
|
|
traefik.ingress.kubernetes.io/router.middlewares: honeydue-security-headers@kubernetescrd,honeydue-rate-limit@kubernetescrd
|
|
spec:
|
|
ingressClassName: traefik
|
|
tls:
|
|
- hosts:
|
|
- admin.myhoneydue.com
|
|
secretName: cloudflare-origin-cert
|
|
rules:
|
|
- host: admin.myhoneydue.com
|
|
http:
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: admin
|
|
port:
|
|
number: 3000
|
|
---
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: honeydue-web
|
|
namespace: honeydue
|
|
labels:
|
|
app.kubernetes.io/part-of: honeydue
|
|
annotations:
|
|
traefik.ingress.kubernetes.io/router.middlewares: honeydue-security-headers@kubernetescrd,honeydue-rate-limit@kubernetescrd
|
|
spec:
|
|
ingressClassName: traefik
|
|
tls:
|
|
- hosts:
|
|
- app.myhoneydue.com
|
|
secretName: cloudflare-origin-cert
|
|
rules:
|
|
- host: app.myhoneydue.com
|
|
http:
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: web
|
|
port:
|
|
number: 3000
|