96 lines
1.9 KiB
YAML
96 lines
1.9 KiB
YAML
# services/vault/middleware.yaml
|
|
apiVersion: traefik.io/v1alpha1
|
|
kind: Middleware
|
|
metadata:
|
|
name: vault-security-headers
|
|
namespace: vault
|
|
spec:
|
|
headers:
|
|
contentTypeNosniff: true
|
|
frameDeny: true
|
|
referrerPolicy: no-referrer
|
|
permissionsPolicy: "camera=(), geolocation=(), microphone=(), payment=(), usb=()"
|
|
stsSeconds: 31536000
|
|
stsIncludeSubdomains: false
|
|
stsPreload: false
|
|
|
|
---
|
|
apiVersion: traefik.io/v1alpha1
|
|
kind: Middleware
|
|
metadata:
|
|
name: vault-response-cleanup
|
|
namespace: vault
|
|
spec:
|
|
headers:
|
|
customResponseHeaders:
|
|
Server: ""
|
|
X-Powered-By: ""
|
|
X-Vault-Cluster: ""
|
|
X-Vault-Namespace: ""
|
|
|
|
---
|
|
apiVersion: traefik.io/v1alpha1
|
|
kind: Middleware
|
|
metadata:
|
|
name: vault-edge-rate-limit
|
|
namespace: vault
|
|
spec:
|
|
rateLimit:
|
|
average: 120
|
|
burst: 240
|
|
|
|
---
|
|
apiVersion: traefik.io/v1alpha1
|
|
kind: Middleware
|
|
metadata:
|
|
name: vault-edge-inflight
|
|
namespace: vault
|
|
spec:
|
|
inFlightReq:
|
|
amount: 100
|
|
|
|
---
|
|
apiVersion: traefik.io/v1alpha1
|
|
kind: Middleware
|
|
metadata:
|
|
name: vault-api-forward-auth
|
|
namespace: vault
|
|
spec:
|
|
forwardAuth:
|
|
address: http://oauth2-proxy.sso.svc.cluster.local/oauth2/auth
|
|
trustForwardHeader: true
|
|
authResponseHeaders:
|
|
- Authorization
|
|
- X-Auth-Request-Email
|
|
- X-Auth-Request-User
|
|
- X-Auth-Request-Groups
|
|
|
|
---
|
|
apiVersion: traefik.io/v1alpha1
|
|
kind: Middleware
|
|
metadata:
|
|
name: vault-public-chain
|
|
namespace: vault
|
|
spec:
|
|
chain:
|
|
middlewares:
|
|
- name: vault-edge-rate-limit
|
|
- name: vault-edge-inflight
|
|
- name: vault-response-cleanup
|
|
- name: vault-security-headers
|
|
|
|
---
|
|
apiVersion: traefik.io/v1alpha1
|
|
kind: Middleware
|
|
metadata:
|
|
name: vault-api-chain
|
|
namespace: vault
|
|
spec:
|
|
chain:
|
|
middlewares:
|
|
- name: vault-edge-rate-limit
|
|
- name: vault-edge-inflight
|
|
- name: vault-api-forward-auth
|
|
- name: vault-response-cleanup
|
|
- name: vault-security-headers
|