Custom response headers support?

[aleks-m]

Hi.

Is there a way to configure custom response headers on path or load balancer level?

Thanks.

[rramkumar1]

@aleks-m Do you mean headers sent back to the client? Can't you do that in your application?

[aleks-m]

@rramkumar1 yes.

Well, in theory I can. But in my case I have multiple apps behind one load balancer and it will be pretty hard to modify all of them (especially given the fact what they are written in different programming languages). And such approach will be impossible if I run a third-party app with no source code provided and with no header configuration support. Would be much better to just set response headers on a load balancer instead of modifying each app source code.

[rramkumar1]

@mark-church any thoughts? I don't think there is a GCLB feature for this nor can I find a feature request.

[bowei]

This is not available right now, we'll update when it is possible on the underlying product.

[lorenzozimolo]

The feature has been released in beta in GCLB 3 days ago. https://issuetracker.google.com/issues/62051227

[jeremyd]

I need this feature for HSTS. Can we unfreeze this?

[bowei]

I might be not understanding frozen status -- I use it to pin issues so they do not rot

[jeremyd]

Apologies @bowei I assumed frozen meant something bad. I see now that it prevents auto-close. Thanks for clarifying.

[ivan046]

This is not available right now, we'll update when it is possible on the underlying product.

Hello @bowei! This is definitely supported by GCE load balancers (https://cloud.google.com/load-balancing/docs/custom-headers#working-with-response). Tested succesfully by manually adding custom responce headers (including CORS like Access-Control-Allow-Origin) to NEGs configured with Ingress BackendConfigs. Please, implement this feature. Response headers (mostly CORS ones) is a core feature that will let many people to get rid of ingress-nginx installed between ingress-gce and k8s services. Thanks!

[cgotfried]

I made a request for allowing Custom Response Headers from GKE, via a BackendConfig resource. This is essential for enforcing HSTS from a site served by a GKE cluster. The only workaround is to modify the load balaner settings generated by GKE, and that is not a clean approach. Vote for the feature at : https://issuetracker.google.com/issues/191700241

[aleks-m]

@cgotfried I can't vote on that issue - I got "access denied" then I tried to open that issue tracker URL.

[nealharris]

same, I'd like to vote for this, but cannot

[cgotfried]

@aleks-m , @nealharris I don't know why this is happening. The issue is not reachable in the Google issuetracker anymore. I get Access Denied when i try to go there. I don't have any way to troubleshoot this.

[otherguy]

@cgotfried I get the same Access Denied error. Could you re-create the issue?

[albertoal]

Also unable to upvote https://issuetracker.google.com/issues/191700241 - it will be great to have this feature available so we can use HSTS on GKE NEGs

[dinvlad]

Any updates on this one? This would be essential not only for HSTS, but for other "classic" security headers like X-Frame-Options, X-XSS-Protection, X-Content-Type-Options, Content-Security-Policy and Referrer-Policy.

[m62534]

+1

[allenvino1]

+1

[anhnt094]

+1

[bernardopericacho]

+1

[ridhoadya]

I found out, there are 3 PR related to this, https://github.com/kubernetes/ingress-gce/pull/1771, https://github.com/kubernetes/ingress-gce/pull/1772, and https://github.com/kubernetes/ingress-gce/pull/1776. But not sure, when it will be release

[dinvlad]

Any timeline on when this will land to GKE?

[swetharepakula]

We are currently testing out the changes. I will update when the changes are available in GKE and what version it is available in.

[ivan046]

@swetharepakula finally! thanks for the update!

[red8888]

@swetharepakula any updates? Want to configure this in my manifest instead of having to ask developers to generate custom response headers in code.

[swetharepakula]

We have released custom response header support. This is be available in new GKE 1.25+ clusters.

[shield-9]

@swetharepakula Is this feature available for existing GKE 1.25 clusters? At least, my cluster with v1.25.4-gke.2100 does not have BackendConfig CRD updated.

[swetharepakula]

@shield-9 , we have started the rollout, but the change has not completely been rolled out to existing clusters. Once rolled out, existing clusters will be upgraded according to maintenance windows with the new version of the ingress controller.

[megalucio]

May be worth update the docuementation to also say customResponseHeaders is supported here https://cloud.google.com/kubernetes-engine/docs/how-to/ingress-configuration#request_headers

[gdubicki]

Is it rolled out already? Apart from the docs ☝️ not being updated, there is also no mention of it in the GKE release notes and I would expect it to be there.