Misc updates for making CSP headers work

README.md

@@ -30,3 +30,31 @@ Read the [DinoPark Introduction] and [Rust usage] for more information.
 [DinoPark Tree]: https://github.com/mozilla-iam/dino-park-tree
 [DinoPark Introduction]: https://github.com/mozilla-iam/dino-park/blob/master/Introduction.md
 [Rust usage]: https://github.com/mozilla-iam/dino-park/blob/master/Rust.md
+
+## Deploying
+
+This application must be manually deployed, until we migrate our builds to
+GitHub Actions.
+
+To deploy to the development and staging clusters, run:
+
+```
+AWS_PROFILE=iam-admin aws codebuild start-build \
+    --project-name dino-park-fence \
+    --environment-variables-override 'name=MANUAL_DEPLOY_TRIGGER,value=branch/master'
+```
+
+To deploy to the production environment, first cut a release (or tag) in the
+form:
+
+```
+<MAJOR>.<MINOR>.<PATCH>-prod
+```
+
+Then run:
+
+```
+AWS_PROFILE=iam-admin aws codebuild start-build \
+    --project-name dino-park-fence \
+    --environment-variables-override 'name=MANUAL_DEPLOY_TRIGGER,value=tag/<MAJOR>.<MINOR>.<PATCH>-prod'
+```

k8s/templates/ingress-controller.yaml

@@ -10,6 +10,7 @@ data:
   use-proxy-protocol: "true"
   enable-vts-status: "true"
   proxy-buffer-size: "16k"
+  allow-snippet-annotations: "true"
 ---
 
 apiVersion: v1
@@ -81,7 +82,13 @@ rules:
     verbs:
       - get
       - update
-
+  - apiGroups:
+      - ""
+    resources:
+      - events
+    verbs:
+      - create
+      - patch
 ---
 
 apiVersion: rbac.authorization.k8s.io/v1

k8s/templates/ingress.yaml

@@ -13,7 +13,11 @@ metadata:
     nginx.ingress.kubernetes.io/enable-modsecurity: "true"
     nginx.ingress.kubernetes.io/enable-owasp-core-rules: "true"
     nginx.ingress.kubernetes.io/configuration-snippet: |
-            more_set_headers "X-Frame-Options: DENY" "X-XSS-Protection: 1" "X-Content-Type-Options: nosniff" "Strict-Transport-Security: max-age=63072000" "Content-Security-Policy: default-src 'none'; connect-src 'self'; font-src https://fonts.gstatic.com; img-src 'self' data: blob:; script-src 'self' 'sha256-4qKuKHlhZHVtOHkzV6IoRxvJyftFsU9Bzug8piLac2s=' 'sha256-wFlxiON/IU9ZZ5PD6RqOAhUMQtTTYSO6Fh/5V470Tdo='; style-src 'self' https://fonts.googleapis.com 'unsafe-inline'; frame-ancestors 'none'; base-uri 'none'; form-action 'self'; manifest-src 'self'; prefetch-src 'self'";
+      more_set_headers "X-Frame-Options: DENY";
+      more_set_headers "X-XSS-Protection: 1";
+      more_set_headers "X-Content-Type-Options: nosniff";
+      more_set_headers "Strict-Transport-Security: max-age=63072000";
+      more_set_headers "Content-Security-Policy: default-src 'none'; connect-src 'self'; font-src https://fonts.gstatic.com; img-src 'self' data: blob:; script-src 'self' 'sha256-4qKuKHlhZHVtOHkzV6IoRxvJyftFsU9Bzug8piLac2s=' 'sha256-wFlxiON/IU9ZZ5PD6RqOAhUMQtTTYSO6Fh/5V470Tdo='; style-src 'self' https://fonts.googleapis.com 'unsafe-inline'; frame-ancestors 'none'; base-uri 'none'; form-action 'self'; manifest-src 'self'; prefetch-src 'self'";
 spec:
   tls:
   - hosts:

k8s/templates/public-splitter.yaml

@@ -24,7 +24,6 @@ data:
       proxy_read_timeout      90;
       proxy_buffers           32 4k;
       resolver                kube-dns.kube-system.svc.cluster.local  valid=5s;
-      add_header              Content-Security-Policy "default-src 'self'; frame-ancestors 'none'; script-src-elem 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data:" always;
 
       map $http_cookie $login {
         default {{ if .Values.public }}"no"{{ else }}"yes"{{ end }};
@@ -59,7 +58,7 @@ data:
           return 404;
         }
 
-        location ~ /(contribute.json$|logbackin.html$|favicon.ico$|reload.html$|opensearch.xml$|webapp/) {
+        location ~ /(contribute.json$|favicon.ico$|reload.html$|reload.js$|opensearch.xml$|webapp/) {
           proxy_pass http://dino-park-front-end-service.{{ .Values.namespace }}.svc.cluster.local:80;
 
         }
@@ -69,11 +68,7 @@ data:
         }
 
         location /oauth/logout {
-          {{ if .Values.public -}}
           proxy_pass http://gatekeeper.{{ .Values.namespace }}.svc.cluster.local:80$uri?redirect=/;
-          {{- else -}}
-          proxy_pass http://gatekeeper.{{ .Values.namespace }}.svc.cluster.local:80$uri?redirect=/logbackin.html;
-          {{- end }}
         }
 
         location /oauth {

k8s/templates/router.yaml

@@ -28,11 +28,6 @@ data:
 
         listen 80;
 
-        {{- if not .Values.public }}
-        location /~ {
-          return 404;
-        }
-        {{- end }}
         location /api/v4/ {
           proxy_pass http://dino-park-fence-service:80;
         }

k8s/values.yaml

@@ -5,7 +5,6 @@ dinopark_fence_replicas: 1
 ingress_replicas: 1
 router_replicas: 1
 gatekeeper_replicas: 1
-public: true
 settings:
   auth: https://auth.mozilla.auth0.com/
   dino_park__orgchart__related_endpoint: "http://dino-park-tree-service:80/orgchart/related/"

k8s/values/test.yaml

@@ -2,5 +2,4 @@ env: test
 namespace: dinopark-test
 domain_name: dinopark.k8s.test.sso.allizom.org
 pictures_domain_name: picture.api.test.sso.allizom.org
-assume_role: arn:aws:iam::320464205386:role/dino-park-fence-role-test-us-west-2
-public: true
+assume_role: arn:aws:iam::320464205386:role/dino-park-fence-role-test-us-west-2