mirror of
https://github.com/sredevopsorg/deepseek-kubernetes-sandbox.git
synced 2026-11-03 09:23:25 +00:00
ae8aba8241
- Replace user:token cookies with opaque server-side sessions, revocable on logout, delete, recreate and expiry; bind every credential to the path user and add cross-user regression tests. - Rate-limit /users and /login, add optional signup invite codes and form same-origin checks, and unify login failures to 401. - Require explicit ALLOW_INSECURE_COOKIES for plain HTTP, use __Host-dsh_gw_session when secure, and fix secure cookie deletion. - Strip client-supplied forwarding/SSO headers, add an optional upstream allowlist, per-user in-flight and WebSocket message caps, credential-free handshake errors, and sweep-time state pruning. - Digest-pin base images, hash-pin gateway dependencies, verify DSH_COMMIT in the build, and run the gateway image as non-root with a pinned Python base. - Update manifests, production checklist, architecture/security docs and add an SSO preflight script. BREAKING CHANGE: existing dsh_gw_session=<user>:<token> cookies are invalid; users must sign in again. Unknown users on POST /login now return 401 instead of 404, and the gateway refuses COOKIE_SECURE=false unless ALLOW_INSECURE_COOKIES=1.
64 lines
2.7 KiB
YAML
64 lines
2.7 KiB
YAML
# OPTIONAL browser entry point: expose the gateway through Traefik.
|
|
#
|
|
# This is the "no SSO" exposure variant and is MUTUALLY EXCLUSIVE with
|
|
# ../gateway-api-sso/ — apply exactly one of them (see ../README.md).
|
|
#
|
|
# Requires the base manifests (Service dsh-gateway:8080 from
|
|
# manifests/50-gateway.yaml) and a Traefik install with an IngressClass named
|
|
# "traefik" (k3s ships one). Replace the placeholder host below with a name
|
|
# that resolves to your ingress address, and either supply a real TLS Secret or
|
|
# delete the `tls:` block for plain HTTP.
|
|
#
|
|
# Two things must match this host:
|
|
# 1. SandboxTemplate (manifests/10-sandboxtemplate.yaml): set
|
|
# DSH_TRUSTED_HOSTS to this host so DSH accepts the forwarded Host/Origin
|
|
# on /api.
|
|
# 2. Gateway Deployment (manifests/50-gateway.yaml): set COOKIE_SECURE to
|
|
# "true" and remove ALLOW_INSECURE_COOKIES once this Ingress serves HTTPS,
|
|
# so the session cookie is Secure:
|
|
# kubectl -n dsh-demo set env deploy/dsh-gateway \
|
|
# COOKIE_SECURE=true ALLOW_INSECURE_COOKIES-
|
|
# The base manifest sets "false" + ALLOW_INSECURE_COOKIES=1 for the
|
|
# plain-HTTP port-forward demo; without the acknowledgement the gateway
|
|
# refuses to start.
|
|
#
|
|
# WebSocket support is REQUIRED: the browser talks to /u/<user>/... and DSH
|
|
# uses WebSockets for live session traffic. Traefik upgrades WS/SSE
|
|
# transparently for ordinary HTTP routers, but do NOT attach buffering
|
|
# middlewares (e.g. compress, buffering) to this router — they break streaming
|
|
# and upgrades. `path: /` Prefix covers the landing page and every per-user
|
|
# proxy path, so no per-sandbox Ingress is needed.
|
|
#
|
|
# 61-networkpolicy.yaml is part of this variant and required for production:
|
|
# it restricts the gateway's ingress to Traefik pods. Adjust its selector if
|
|
# your ingress controller uses a different label or hostNetwork. The sandbox
|
|
# and gateway-egress NetworkPolicies are separate requirements; see
|
|
# ../../../docs/optional-hardening.md#6-production-checklist.
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: dsh-gateway
|
|
namespace: dsh-demo
|
|
# Typical Traefik + cert-manager wiring (uncomment and adapt):
|
|
# annotations:
|
|
# traefik.ingress.kubernetes.io/router.entrypoints: websecure
|
|
# cert-manager.io/cluster-issuer: letsencrypt-prod
|
|
annotations: {}
|
|
spec:
|
|
ingressClassName: traefik
|
|
tls:
|
|
- hosts:
|
|
- dsh.example.com # placeholder
|
|
secretName: dsh-example-tls # placeholder; create/PKI-provision this Secret
|
|
rules:
|
|
- host: dsh.example.com # placeholder
|
|
http:
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: dsh-gateway
|
|
port:
|
|
number: 8080
|