apiVersion: v1
kind: ConfigMap
metadata:
  name: ingress-catchall
  namespace: ingress-nginx
data:
  nginx.conf: |
    worker_processes  1;
    pid /tmp/nginx.pid;

    events {
      worker_connections  1024;
    }

    http {
      include       /etc/nginx/mime.types;
      default_type  application/octet-stream;
      sendfile      on;
      keepalive_timeout  65;
      client_body_temp_path /tmp/client_temp;
      proxy_temp_path /tmp/proxy_temp;
      fastcgi_temp_path /tmp/fastcgi_temp;
      uwsgi_temp_path /tmp/uwsgi_temp;
      scgi_temp_path /tmp/scgi_temp;

      server {
        listen 8080;
      server_name _;
      root /usr/share/nginx/html;
      error_page 403 =404 /index.html;

      # Only GET is intentionally accepted by this catch-all.
      # The "if" is safe here because it only performs a return.
        # Serve robots.txt directly with Disallow: /
        location = /robots.txt {
          default_type text/plain;
          return 200 "User-agent: *\nDisallow: /\n";
        }

        # Deliberately trigger an internal 403 so the static error page is
        # returned with the externally visible status still set to 404.
        location / {
          if ($request_method != GET) {
            add_header Allow GET always;
            return 405;
          }

          deny all;
        }

        # Keep the error document internal so /index.html also follows the
        # catch-all policy instead of becoming a successful public endpoint.
        location = /index.html {
          internal;
          allow all;
        }
      }
    }
  index.html: |
    <!doctype html>
    <html lang="en">
    <head>
      <meta charset="utf-8">
      <meta name="viewport" content="width=device-width, initial-scale=1">
      <title>Not found</title>
      <style>
        :root { color-scheme: dark; }
        * { box-sizing: border-box; }
        body {
          min-height: 100vh;
          margin: 0;
          display: grid;
          place-items: center;
          padding: 2rem;
          color: #e8ecf2;
          background: #0d1014;
          font: 16px/1.5 system-ui, -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif;
        }
        main { width: min(100%, 42rem); }
        .code {
          margin: 0 0 .75rem;
          color: #7b8cff;
          font: 700 clamp(4rem, 14vw, 8rem)/.9 ui-monospace, SFMono-Regular, Menlo, monospace;
          letter-spacing: -.08em;
        }
        h1 { margin: 0 0 .75rem; font-size: clamp(1.5rem, 4vw, 2.25rem); }
        p { margin: 0; max-width: 34rem; color: #98a3b2; }
        code { color: #e8ecf2; }
      </style>
    </head>
    <body>
      <main>
        <p class="code">404</p>
        <h1>There is nothing here.</h1>
        <p>The requested resource does not exist on this ingress endpoint.</p>
      </main>
    </body>
    </html>
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: ingress-catchall
  namespace: ingress-nginx
  labels:
    app.kubernetes.io/name: ingress-catchall
    app.kubernetes.io/part-of: ingress-nginx
spec:
  replicas: 2
  selector:
    matchLabels:
      app.kubernetes.io/name: ingress-catchall
  template:
    metadata:
      labels:
        app.kubernetes.io/name: ingress-catchall
        app.kubernetes.io/part-of: ingress-nginx
    spec:
      automountServiceAccountToken: false
      securityContext:
        seccompProfile:
          type: RuntimeDefault
      containers:
        - name: nginx
          image: nginx:1.27-alpine
          imagePullPolicy: IfNotPresent
          ports:
            - name: http
              containerPort: 8080
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop: ["ALL"]
            runAsNonRoot: true
            runAsUser: 101
          volumeMounts:
            - name: config
              mountPath: /etc/nginx/nginx.conf
              subPath: nginx.conf
              readOnly: true
            - name: config
              mountPath: /usr/share/nginx/html/index.html
              subPath: index.html
              readOnly: true
          readinessProbe:
            tcpSocket:
              port: http
            periodSeconds: 5
          livenessProbe:
            tcpSocket:
              port: http
            initialDelaySeconds: 5
            periodSeconds: 10
      volumes:
        - name: config
          configMap:
            name: ingress-catchall
---
apiVersion: v1
kind: Service
metadata:
  name: ingress-catchall
  namespace: ingress-nginx
  labels:
    app.kubernetes.io/name: ingress-catchall
    app.kubernetes.io/part-of: ingress-nginx
spec:
  selector:
    app.kubernetes.io/name: ingress-catchall
  ports:
    - name: http
      port: 80
      targetPort: http