eval

k8s/ingress-catchall.yaml

@@ -0,0 +1,173 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: ingress-catchall
+  namespace: ingress-nginx
+data:
+  nginx.conf: |
+    worker_processes  1;
+    pid /tmp/nginx.pid;
+
+    events {
+      worker_connections  1024;
+    }
+
+    http {
+      include       /etc/nginx/mime.types;
+      default_type  application/octet-stream;
+      sendfile      on;
+      keepalive_timeout  65;
+      client_body_temp_path /tmp/client_temp;
+      proxy_temp_path /tmp/proxy_temp;
+      fastcgi_temp_path /tmp/fastcgi_temp;
+      uwsgi_temp_path /tmp/uwsgi_temp;
+      scgi_temp_path /tmp/scgi_temp;
+
+      server {
+        listen 8080;
+      server_name _;
+      root /usr/share/nginx/html;
+      error_page 403 =404 /index.html;
+
+      # Only GET is intentionally accepted by this catch-all.
+      # The "if" is safe here because it only performs a return.
+        # Serve robots.txt directly with Disallow: /
+        location = /robots.txt {
+          default_type text/plain;
+          return 200 "User-agent: *\nDisallow: /\n";
+        }
+
+        # Deliberately trigger an internal 403 so the static error page is
+        # returned with the externally visible status still set to 404.
+        location / {
+          if ($request_method != GET) {
+            add_header Allow GET always;
+            return 405;
+          }
+
+          deny all;
+        }
+
+        # Keep the error document internal so /index.html also follows the
+        # catch-all policy instead of becoming a successful public endpoint.
+        location = /index.html {
+          internal;
+          allow all;
+        }
+      }
+    }
+  index.html: |
+    <!doctype html>
+    <html lang="en">
+    <head>
+      <meta charset="utf-8">
+      <meta name="viewport" content="width=device-width, initial-scale=1">
+      <title>Not found</title>
+      <style>
+        :root { color-scheme: dark; }
+        * { box-sizing: border-box; }
+        body {
+          min-height: 100vh;
+          margin: 0;
+          display: grid;
+          place-items: center;
+          padding: 2rem;
+          color: #e8ecf2;
+          background: #0d1014;
+          font: 16px/1.5 system-ui, -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif;
+        }
+        main { width: min(100%, 42rem); }
+        .code {
+          margin: 0 0 .75rem;
+          color: #7b8cff;
+          font: 700 clamp(4rem, 14vw, 8rem)/.9 ui-monospace, SFMono-Regular, Menlo, monospace;
+          letter-spacing: -.08em;
+        }
+        h1 { margin: 0 0 .75rem; font-size: clamp(1.5rem, 4vw, 2.25rem); }
+        p { margin: 0; max-width: 34rem; color: #98a3b2; }
+        code { color: #e8ecf2; }
+      </style>
+    </head>
+    <body>
+      <main>
+        <p class="code">404</p>
+        <h1>There is nothing here.</h1>
+        <p>The requested resource does not exist on this ingress endpoint.</p>
+      </main>
+    </body>
+    </html>
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: ingress-catchall
+  namespace: ingress-nginx
+  labels:
+    app.kubernetes.io/name: ingress-catchall
+    app.kubernetes.io/part-of: ingress-nginx
+spec:
+  replicas: 2
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: ingress-catchall
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: ingress-catchall
+        app.kubernetes.io/part-of: ingress-nginx
+    spec:
+      automountServiceAccountToken: false
+      securityContext:
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+        - name: nginx
+          image: nginx:1.27-alpine
+          imagePullPolicy: IfNotPresent
+          ports:
+            - name: http
+              containerPort: 8080
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop: ["ALL"]
+            runAsNonRoot: true
+            runAsUser: 101
+          volumeMounts:
+            - name: config
+              mountPath: /etc/nginx/nginx.conf
+              subPath: nginx.conf
+              readOnly: true
+            - name: config
+              mountPath: /usr/share/nginx/html/index.html
+              subPath: index.html
+              readOnly: true
+          readinessProbe:
+            tcpSocket:
+              port: http
+            periodSeconds: 5
+          livenessProbe:
+            tcpSocket:
+              port: http
+            initialDelaySeconds: 5
+            periodSeconds: 10
+      volumes:
+        - name: config
+          configMap:
+            name: ingress-catchall
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: ingress-catchall
+  namespace: ingress-nginx
+  labels:
+    app.kubernetes.io/name: ingress-catchall
+    app.kubernetes.io/part-of: ingress-nginx
+spec:
+  selector:
+    app.kubernetes.io/name: ingress-catchall
+  ports:
+    - name: http
+      port: 80
+      targetPort: http