Feature Request: Router should support setting various tls-related headers

[ibotty]

It would be great, if the router could set some headers that structurally belong to the route, not the service/pod that is exposed. E.g. Strict-Transport-Security, or Public-Key-Pins.

[knobunc]

@pecameron we (the larger networking team) should talk about whether we want to support this as a core part of the route object. But for the moment, can you point at the docs you wrote to replace the router template, and indicate how you could use route annotations to accomplish this change. It would be good to use this as an example in the docs too, because it pulls the template replacement work together with custom route annotations that are defined (with validation rules) in the router. @JacobTanenbaum can point you at the annotation stuff in templates.

[pecameron]

You could do some of this today by adding a configmap with a replacement router template:
https://github.com/openshift/openshift-docs/blob/master/install_config/install/deploy_router.adoc#using-configmap-replace-template

The Route annotations are available in 3.3.

pr9810 shows ways of using annotations.

[ibotty]

It's nice to not have to rebuild the image for a different template (btw @pecameron: it still says that in a few places (stick tables) in the documentation, is that correct?), but I'd argue that setting these headers is important enough to include in the official image.

[openshift-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.
If this issue is safe to close now please do so with /close.

/lifecycle stale

[openshift-bot]

Stale issues rot after 30d of inactivity.

Mark the issue as fresh by commenting /remove-lifecycle rotten.
Rotten issues close after an additional 30d of inactivity.
Exclude this issue from closing by commenting /lifecycle frozen.

If this issue is safe to close now please do so with /close.

/lifecycle rotten
/remove-lifecycle stale

[openshift-bot]

Rotten issues close after 30d of inactivity.

Reopen the issue by commenting /reopen.
Mark the issue as fresh by commenting /remove-lifecycle rotten.
Exclude this issue from closing again by commenting /lifecycle frozen.

/close