mirror of
https://github.com/sredevopsorg/deepseek-kubernetes-sandbox.git
synced 2026-11-03 09:23:25 +00:00
1a929e3e24
- Replace user:token cookies with opaque server-side sessions, revocable on logout, delete, recreate and expiry; bind every credential to the path user and add cross-user regression tests. - Rate-limit /users and /login, add optional signup invite codes and form same-origin checks, and unify login failures to 401. - Require explicit ALLOW_INSECURE_COOKIES for plain HTTP, use __Host-dsh_gw_session when secure, and fix secure cookie deletion. - Strip client-supplied forwarding/SSO headers, add an optional upstream allowlist, per-user in-flight and WebSocket message caps, credential-free handshake errors, and sweep-time state pruning. - Digest-pin base images, hash-pin gateway dependencies, verify DSH_COMMIT in the build, and run the gateway image as non-root with a pinned Python base. - Update manifests, production checklist, architecture/security docs and add an SSO preflight script. BREAKING CHANGE: existing dsh_gw_session=<user>:<token> cookies are invalid; users must sign in again. Unknown users on POST /login now return 401 instead of 404, and the gateway refuses COOKIE_SECURE=false unless ALLOW_INSECURE_COOKIES=1. Co-authored-by: SREDevOpsAgents <agents@sredevops.org>
37 lines
1.2 KiB
YAML
37 lines
1.2 KiB
YAML
# REQUIRED with the Ingress exposure variant for production: restrict the
|
|
# gateway's ingress to the ingress controller. Applying the variant without
|
|
# this policy is demo-only.
|
|
#
|
|
# This manifest assumes Traefik, matching this variant's
|
|
# `ingressClassName: traefik`. Traefik's Helm chart labels its pods
|
|
# app.kubernetes.io/name=traefik; adjust the selector for another controller or
|
|
# for a hostNetwork install (where the source is the node IP, not a pod IP).
|
|
#
|
|
# The sandbox NetworkPolicy and the gateway egress policy are separate and also
|
|
# required for production; see
|
|
# ../../../docs/optional-hardening.md#6-production-checklist.
|
|
#
|
|
# NetworkPolicy enforcement of kubelet probe traffic is CNI-dependent. If the
|
|
# gateway starts failing its /healthz probes, allow the node CIDR on port 8080
|
|
# or remove this policy. See ../../../docs/optional-hardening.md.
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: dsh-gateway-ingress
|
|
namespace: dsh-demo
|
|
spec:
|
|
podSelector:
|
|
matchLabels:
|
|
app: dsh-gateway
|
|
policyTypes:
|
|
- Ingress
|
|
ingress:
|
|
- from:
|
|
- namespaceSelector: {}
|
|
podSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: traefik
|
|
ports:
|
|
- protocol: TCP
|
|
port: 8080
|