vault: harden public ingress

services/vault/ingress.yaml

@@ -7,6 +7,8 @@ metadata:
   annotations:
     kubernetes.io/ingress.class: traefik
     traefik.ingress.kubernetes.io/router.entrypoints: websecure
+    traefik.ingress.kubernetes.io/router.middlewares: vault-vault-public-chain@kubernetescrd
+    traefik.ingress.kubernetes.io/router.priority: "10"
     traefik.ingress.kubernetes.io/router.tls: "true"
 spec:
   ingressClassName: traefik
@@ -24,3 +26,75 @@ spec:
                 name: vault
                 port:
                   number: 8200
+
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: vault-ui-discovery
+  namespace: vault
+  annotations:
+    kubernetes.io/ingress.class: traefik
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+    traefik.ingress.kubernetes.io/router.middlewares: vault-vault-public-chain@kubernetescrd
+    traefik.ingress.kubernetes.io/router.priority: "120"
+    traefik.ingress.kubernetes.io/router.tls: "true"
+spec:
+  ingressClassName: traefik
+  tls:
+    - hosts: [secret.bstein.dev]
+      secretName: vault-server-tls
+  rules:
+    - host: secret.bstein.dev
+      http:
+        paths:
+          - path: /v1/sys/health
+            pathType: Exact
+            backend:
+              service:
+                name: vault
+                port:
+                  number: 8200
+          - path: /v1/sys/seal-status
+            pathType: Exact
+            backend:
+              service:
+                name: vault
+                port:
+                  number: 8200
+          - path: /v1/sys/internal/ui/mounts
+            pathType: Exact
+            backend:
+              service:
+                name: vault
+                port:
+                  number: 8200
+
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: vault-api
+  namespace: vault
+  annotations:
+    kubernetes.io/ingress.class: traefik
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+    traefik.ingress.kubernetes.io/router.middlewares: vault-vault-api-chain@kubernetescrd
+    traefik.ingress.kubernetes.io/router.priority: "100"
+    traefik.ingress.kubernetes.io/router.tls: "true"
+spec:
+  ingressClassName: traefik
+  tls:
+    - hosts: [secret.bstein.dev]
+      secretName: vault-server-tls
+  rules:
+    - host: secret.bstein.dev
+      http:
+        paths:
+          - path: /v1
+            pathType: Prefix
+            backend:
+              service:
+                name: vault
+                port:
+                  number: 8200

services/vault/kustomization.yaml

@@ -13,8 +13,9 @@ resources:
   - k8s-auth-config-cronjob.yaml
   - oidc-config-cronjob.yaml
   - service.yaml
-  - ingress.yaml
   - certificate.yaml
+  - middleware.yaml
+  - ingress.yaml
   - serverstransport.yaml
 generatorOptions:
   disableNameSuffixHash: true

services/vault/middleware.yaml

@@ -0,0 +1,95 @@
+# services/vault/middleware.yaml
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: vault-security-headers
+  namespace: vault
+spec:
+  headers:
+    contentTypeNosniff: true
+    frameDeny: true
+    referrerPolicy: no-referrer
+    permissionsPolicy: "camera=(), geolocation=(), microphone=(), payment=(), usb=()"
+    stsSeconds: 31536000
+    stsIncludeSubdomains: false
+    stsPreload: false
+
+---
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: vault-response-cleanup
+  namespace: vault
+spec:
+  headers:
+    customResponseHeaders:
+      Server: ""
+      X-Powered-By: ""
+      X-Vault-Cluster: ""
+      X-Vault-Namespace: ""
+
+---
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: vault-edge-rate-limit
+  namespace: vault
+spec:
+  rateLimit:
+    average: 120
+    burst: 240
+
+---
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: vault-edge-inflight
+  namespace: vault
+spec:
+  inFlightReq:
+    amount: 100
+
+---
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: vault-api-forward-auth
+  namespace: vault
+spec:
+  forwardAuth:
+    address: http://oauth2-proxy.sso.svc.cluster.local/oauth2/auth
+    trustForwardHeader: true
+    authResponseHeaders:
+      - Authorization
+      - X-Auth-Request-Email
+      - X-Auth-Request-User
+      - X-Auth-Request-Groups
+
+---
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: vault-public-chain
+  namespace: vault
+spec:
+  chain:
+    middlewares:
+      - name: vault-edge-rate-limit
+      - name: vault-edge-inflight
+      - name: vault-response-cleanup
+      - name: vault-security-headers
+
+---
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: vault-api-chain
+  namespace: vault
+spec:
+  chain:
+    middlewares:
+      - name: vault-edge-rate-limit
+      - name: vault-edge-inflight
+      - name: vault-api-forward-auth
+      - name: vault-response-cleanup
+      - name: vault-security-headers