Is there away to enable HSTS HTTP Strict Transport Security for envoy gateway

[davem-git]

I'm looking to replace nginx ingress with envoy-gateway. I ran my site through ssl labs. While I got an A with envoy-gateway. I got an A+ with nginx. From what I can tell the only difference is the HSTS setting is called out on the NGINX one and not the envoy-gateway.

[arkodg]

hey @davem-git can you try setting the header using this filter https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io/v1.HTTPHeaderFilter ?

[winston0410]

Thanks for the example @mazzy89 . The only remaining question I have is, filters seems to be something you set for each individual HTTPRoute, but how can I set this globally at gateway level? So I don't have to set this in every HttpRoute

[mazzy89]

This a good question that you can find out. Let me know if you find it.

[arkodg]

although not designed to apply filters globally, you could use earlyRequestHeaders (will be part of the next v1.2 release, available on latest) https://gateway.envoyproxy.io/latest/tasks/traffic/http-request-headers/#early-header-modification

[evanrappe]

To return this header to the client as HSTS requires this needs to be a response header, not a request header... Any similar early-header functionality coming for the response side of things?

[arkodg]

ah my bad, misread that, yeah for response header, @mazzy89's suggestion is the only way thats supported today

[davem-git]

Sorry I missed this. I'm not too familiar with the filters. I'll see if I can figure out how to set this

[jgoodall]

Is there still no way to globally set Strict-Transport-Security on all HTTPS routes?

[davem-git]

to the best of my knowledge no. i don't know if i ever created an issue for it though. It can be added per httproute, so i put it in the template teams use to create new workloads to ensure its always there