mirror of
https://github.com/sredevopsorg/deepseek-kubernetes-sandbox.git
synced 2026-11-03 01:13:24 +00:00
1a929e3e24
- Replace user:token cookies with opaque server-side sessions, revocable on logout, delete, recreate and expiry; bind every credential to the path user and add cross-user regression tests. - Rate-limit /users and /login, add optional signup invite codes and form same-origin checks, and unify login failures to 401. - Require explicit ALLOW_INSECURE_COOKIES for plain HTTP, use __Host-dsh_gw_session when secure, and fix secure cookie deletion. - Strip client-supplied forwarding/SSO headers, add an optional upstream allowlist, per-user in-flight and WebSocket message caps, credential-free handshake errors, and sweep-time state pruning. - Digest-pin base images, hash-pin gateway dependencies, verify DSH_COMMIT in the build, and run the gateway image as non-root with a pinned Python base. - Update manifests, production checklist, architecture/security docs and add an SSO preflight script. BREAKING CHANGE: existing dsh_gw_session=<user>:<token> cookies are invalid; users must sign in again. Unknown users on POST /login now return 401 instead of 404, and the gateway refuses COOKIE_SECURE=false unless ALLOW_INSECURE_COOKIES=1. Co-authored-by: SREDevOpsAgents <agents@sredevops.org>
122 lines
3.2 KiB
YAML
122 lines
3.2 KiB
YAML
# REQUIRED with the SSO exposure variant: enforce the trust boundary at the
|
|
# network layer. Applying the SSO variant without this file is demo-only.
|
|
#
|
|
# The chain is Traefik (Gateway API) -> oauth2-proxy -> dsh-gateway. These
|
|
# policies make it the ONLY chain:
|
|
# - the gateway accepts traffic only from oauth2-proxy pods;
|
|
# - oauth2-proxy accepts traffic only from the Gateway implementation;
|
|
# - oauth2-proxy egress is limited to DNS, public HTTPS (GitHub) and the
|
|
# gateway.
|
|
# The gateway's own egress (Kubernetes API, sandbox pods) is intentionally not
|
|
# restricted here: the API-server endpoint is cluster-specific. Add it for
|
|
# production. See
|
|
# ../../../docs/optional-hardening.md#gateway-egress-required-for-production.
|
|
#
|
|
# This manifest assumes Traefik, matching gatewayClassName: traefik in
|
|
# 70-gateway.yaml. Adjust the app.kubernetes.io/name selector for another
|
|
# implementation. NetworkPolicy enforcement of kubelet probes is CNI-dependent;
|
|
# if the gateway or proxy fails its probes, allow the node CIDR on the probe
|
|
# port or remove the ingress policy.
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: dsh-gateway-ingress
|
|
namespace: dsh-demo
|
|
spec:
|
|
podSelector:
|
|
matchLabels:
|
|
app: dsh-gateway
|
|
policyTypes:
|
|
- Ingress
|
|
ingress:
|
|
- from:
|
|
- podSelector:
|
|
matchLabels:
|
|
app: oauth2-proxy
|
|
ports:
|
|
- protocol: TCP
|
|
port: 8080
|
|
---
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: oauth2-proxy-ingress
|
|
namespace: dsh-demo
|
|
spec:
|
|
podSelector:
|
|
matchLabels:
|
|
app: oauth2-proxy
|
|
policyTypes:
|
|
- Ingress
|
|
ingress:
|
|
- from:
|
|
- namespaceSelector: {}
|
|
podSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: traefik
|
|
ports:
|
|
- protocol: TCP
|
|
port: 4180
|
|
---
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: oauth2-proxy-egress
|
|
namespace: dsh-demo
|
|
spec:
|
|
podSelector:
|
|
matchLabels:
|
|
app: oauth2-proxy
|
|
policyTypes:
|
|
- Egress
|
|
egress:
|
|
# Cluster DNS.
|
|
- to:
|
|
- namespaceSelector:
|
|
matchLabels:
|
|
kubernetes.io/metadata.name: kube-system
|
|
podSelector:
|
|
matchLabels:
|
|
k8s-app: kube-dns
|
|
ports:
|
|
- protocol: UDP
|
|
port: 53
|
|
- protocol: TCP
|
|
port: 53
|
|
# NodeLocal DNSCache.
|
|
- to:
|
|
- ipBlock:
|
|
cidr: 169.254.20.10/32
|
|
ports:
|
|
- protocol: UDP
|
|
port: 53
|
|
- protocol: TCP
|
|
port: 53
|
|
# The gateway backend.
|
|
- to:
|
|
- podSelector:
|
|
matchLabels:
|
|
app: dsh-gateway
|
|
ports:
|
|
- protocol: TCP
|
|
port: 8080
|
|
# GitHub OAuth endpoints are public HTTPS. Private ranges and the metadata
|
|
# server stay blocked.
|
|
- to:
|
|
- ipBlock:
|
|
cidr: 0.0.0.0/0
|
|
except:
|
|
- 10.0.0.0/8
|
|
- 172.16.0.0/12
|
|
- 192.168.0.0/16
|
|
- 169.254.0.0/16
|
|
- 100.64.0.0/10
|
|
- ipBlock:
|
|
cidr: "::/0"
|
|
except:
|
|
- "fc00::/7"
|
|
- "fe80::/10"
|
|
ports:
|
|
- protocol: TCP
|
|
port: 443
|