How to enable the HTTP Strict Transport Security on Automation Suite

News Knowledge Base
1

How to enable HSTS on the Automation suite 23.10.x, 23.4.x?

HTTP Strict Transport Security (HSTS) can be applied to the Automation Suite.

Please refer to the script below for enabling HSTS:

kubectl apply -f - <<EOF
apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: hsts-response-header
  namespace: istio-system
spec:
  configPatches:
  - applyTo: HTTP_FILTER
    match:
      context: GATEWAY
      listener:
        filterChain:
          filter:
            name: envoy.filters.network.http_connection_manager
            subFilter:
              name: envoy.filters.http.router
    patch:
      operation: INSERT_BEFORE
      value:
        name: envoy.config.filter.network.custom_protocol
        typed_config:
          '@type': type.googleapis.com/envoy.extensions.filters.http.lua.v3.Lua
          inlineCode: |2

        function envoy_on_response(response_handle)
          response_handle:headers():add("Strict-Transport-Security", "max-age=31536000; includeSubDomains; preload")
        end



workloadSelector:

labels:

istio: ingressgateway

EOF