<p>I understand that an NGINX Ingress controller allows <a href="https://kubernetes.github.io/ingress-nginx/examples/customization/custom-headers/" rel="nofollow noreferrer">custom header creation</a> using a <code>ConfigMap</code>. Is there either:</p>
<ol>
<li>a way to use NGINX for GKE or</li>
<li>to directly specify custom headers in the networking.gke.io
namespace?</li>
</ol>
<p>I am specifically interested in setting <a href="https://datatracker.ietf.org/doc/html/rfc6797" rel="nofollow noreferrer">HTTPS Strict Transport Security</a>, <a href="https://www.w3.org/TR/upgrade-insecure-requests/#preference" rel="nofollow noreferrer">Upgrade Insecure Requests</a> and <a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP" rel="nofollow noreferrer">Content Security Policy</a> headers. I find it a little award that the <code>redirectToHttp</code>feature does not enabled these by default so I am desperate for any ideas.</p>

<p>Taken from one of my Nginx ingress config values:</p>
<p>HSTS - under controller.config:</p>
<pre><code>  hsts: &quot;True&quot; # default is &quot;False&quot;. Enables HTTP Strict Transport Security (HSTS): the HSTS header is added to the responses from backends. See https://www.nginx.com/blog/http-strict-transport-security-hsts-and-nginx/
  hsts-max-age: &quot;31536000&quot; # default is 2592000 (1 month).
  hsts-include-subdomains: &quot;True&quot; # default is &quot;False&quot;.
</code></pre>
<p>Redirect to HTTPS - under anotations:</p>
<pre><code>nginx.ingress.kubernetes.io/force-ssl-redirect: &quot;true&quot;
</code></pre>
<p>CORS - Under anotations:</p>
<pre><code>nginx.ingress.kubernetes.io/enable-cors: &quot;true&quot;
nginx.ingress.kubernetes.io/cors-allow-origin: &quot;http://localhost:8888/&quot;
nginx.ingress.kubernetes.io/cors-max-age: &quot;3600&quot;
nginx.ingress.kubernetes.io/cors-allow-headers: &quot;DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization,apikey,x-apikey,Accept-Language,impersonated,source&quot;
nginx.ingress.kubernetes.io/cors-allow-methods: &quot;PUT, GET, POST, PATCH, OPTIONS&quot;
</code></pre>
<p>So, an example would look like this:</p>
<p>❯ kubectl get configmaps -n ingress nginx-ingress-0-24-controller -o yaml</p>
<pre><code>apiVersion: v1
data:
  Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none';
    style-src 'self' 'unsafe-inline'; frame-src 'self'
  Referrer-Policy: 'Referrer-Policy: strict-origin-when-cross-origin'
  X-API-Token: x
  X-Content-Type-Options: nosniff
  X-Frame-Options: SAMEORIGIN
  X-Using-Nginx-Controller: &quot;true&quot;
  X-XSS-Protection: 1; mode=block
  client_body_buffer_size: 128k
  client_max_body_size: 24M
  enable-vts-status: &quot;true&quot;
  hsts: &quot;True&quot;
  hsts-include-subdomains: &quot;True&quot;
  hsts-max-age: &quot;31536000&quot;
  http-snippet: |
    more_clear_headers 'Server';
  log-format-upstream: '{&quot;time&quot;: &quot;$time_iso8601&quot;, &quot;remote_addr&quot;: &quot;$proxy_protocol_addr&quot;,
    &quot;x-forward-for&quot;: &quot;$proxy_add_x_forwarded_for&quot;, &quot;request_id&quot;: &quot;$request_id&quot;, &quot;remote_user&quot;:
    &quot;$remote_user&quot;, &quot;bytes_sent&quot;: $bytes_sent, &quot;request_time&quot;: $request_time, &quot;status&quot;:
    $status, &quot;vhost&quot;: &quot;$host&quot;, &quot;request_proto&quot;: &quot;$server_protocol&quot;, &quot;path&quot;: &quot;$uri&quot;,
    &quot;request_query&quot;: &quot;$args&quot;, &quot;request_length&quot;: $request_length, &quot;duration&quot;: $request_time,
    &quot;method&quot;: &quot;$request_method&quot;, &quot;http_referrer&quot;: &quot;$http_referer&quot;, &quot;http_user_agent&quot;:
    &quot;$http_user_agent&quot;}'
  proxy-hide-headers: Server, server, Access-Control-Allow-Origin, X-Using-Nginx-Controller
  proxy-set-headers: ingress/nginx-ingress-0-24-custom-headers
  server-tokens: &quot;False&quot;
  ssl-ciphers: ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA
  ssl-protocols: TLSv1.2
  use-http2: &quot;true&quot;
kind: ConfigMap
metadata:
  creationTimestamp: &quot;2020-08-20T08:46:22Z&quot;
  labels:
    app: nginx-ingress
    chart: nginx-ingress-1.8.2
    component: controller
    heritage: Tiller
    release: nginx-ingress-0-24
  name: nginx-ingress-0-24-controller
  namespace: ingress
  resourceVersion: &quot;205918413&quot;
  selfLink: /api/v1/namespaces/ingress/configmaps/nginx-ingress-0-24-controller
  uid: 9fc20850-e2c1-11ea-87b8-42010af00186
</code></pre>
<p>While the annotations go in the ingress yaml:</p>
<p>❯ kubectl get ingresses -n system nginx-ingress-ingress-config protect-private -o yaml</p>
<pre><code>apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  annotations:
    kubernetes.io/ingress.class: nginx-0-24
    nginx.ingress.kubernetes.io/force-ssl-redirect: &quot;true&quot;
  creationTimestamp: &quot;2021-03-05T13:03:49Z&quot;
(...)
</code></pre>
