security(hermes): update oauth boundaries

services/hermes/oauth2-proxy.yaml

@@ -74,7 +74,7 @@ spec:
       automountServiceAccountToken: true
       containers:
         - name: oauth2-proxy
-          image: quay.io/oauth2-proxy/oauth2-proxy:v7.6.0@sha256:dcb6ff8dd21bf3058f6a22c6fa385fa5b897a9cd3914c88a2cc2bb0a85f8065d
+          image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.3@sha256:10a1165743a192e1940b4708fb9647027185ce11a681a1c5519b442ff7f1f561
           imagePullPolicy: IfNotPresent
           args:
             - --provider=oidc
@@ -94,12 +94,16 @@ spec:
             - --cookie-path=/
             - --cookie-secure=true
             - --cookie-samesite=lax
+            - --cookie-csrf-expire=10m
+            - --cookie-csrf-per-request=true
+            - --cookie-csrf-per-request-limit=8
             - --cookie-refresh=1h
             - --cookie-expire=8h
             - --upstream=http://hermes-agent.hermes.svc.cluster.local:7681
             - --http-address=0.0.0.0:4180
             - --skip-provider-button=true
             - --reverse-proxy=true
+            - --trusted-proxy-ip=10.42.0.0/16
           ports:
             - {name: http, containerPort: 4180}
           readinessProbe:
@@ -164,7 +168,7 @@ spec:
       automountServiceAccountToken: true
       containers:
         - name: oauth2-proxy
-          image: quay.io/oauth2-proxy/oauth2-proxy:v7.6.0@sha256:dcb6ff8dd21bf3058f6a22c6fa385fa5b897a9cd3914c88a2cc2bb0a85f8065d
+          image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.3@sha256:10a1165743a192e1940b4708fb9647027185ce11a681a1c5519b442ff7f1f561
           imagePullPolicy: IfNotPresent
           args:
             - --provider=oidc
@@ -184,12 +188,16 @@ spec:
             - --cookie-path=/
             - --cookie-secure=true
             - --cookie-samesite=lax
+            - --cookie-csrf-expire=10m
+            - --cookie-csrf-per-request=true
+            - --cookie-csrf-per-request-limit=8
             - --cookie-refresh=1h
             - --cookie-expire=8h
             - --upstream=http://hermes-triage.hermes.svc.cluster.local:8787
             - --http-address=0.0.0.0:4180
             - --skip-provider-button=true
             - --reverse-proxy=true
+            - --trusted-proxy-ip=10.42.0.0/16
           ports:
             - {name: http, containerPort: 4180}
           readinessProbe:

testing/tests/test_hermes_herdr.py

@@ -175,6 +175,30 @@ def test_agent_ttyd_defers_identity_to_owner_only_oauth_boundary():
     ]
 
 
+def test_hermes_oauth_boundaries_use_current_hardened_proxy():
+    documents = [
+        document
+        for document in yaml.safe_load_all((HERMES / "oauth2-proxy.yaml").read_text())
+        if document
+    ]
+    deployments = [
+        document
+        for document in documents
+        if document["kind"] == "Deployment"
+        and document["metadata"]["name"].startswith("oauth2-proxy-hermes-")
+    ]
+
+    assert len(deployments) == 3
+    for deployment in deployments:
+        container = deployment["spec"]["template"]["spec"]["containers"][0]
+        args = container["args"]
+        assert "v7.15.3@sha256:10a1165743a192e" in container["image"]
+        assert "--cookie-csrf-expire=10m" in args
+        assert "--cookie-csrf-per-request=true" in args
+        assert "--cookie-csrf-per-request-limit=8" in args
+        assert "--trusted-proxy-ip=10.42.0.0/16" in args
+
+
 def test_agent_installs_hermes_integration_before_startup():
     deployment = yaml.safe_load((HERMES / "agent-deployment.yaml").read_text())
     pod = deployment["spec"]["template"]["spec"]