Change:
<!-- Please only use this template for submitting enhancement requests --What would you like to be : Add the "Strict-Transport-Security" header to the API server responses. Why is this needed: Nessus scanner treats this as a Medium Risk in kubernetes 1.18.10.
This issue is currently awaiting triage. If a SIG or subproject determines this is a relevant issue, they will accept it by applying the label and provide further guidance. The label can be by org members by writing in a comment. <detailsInstructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
/sig api-machinery
/remove-sig api-machinery /sig auth

Discussion:
// to set values and determine whether its allowed AdmissionControl      admission.Interface CorsAllowedOriginList []string <ins> HSTSDirectives        []string </ins> // FlowControl, if not nil, gives priority and fairness to request handling FlowControl utilflowcontrol.Interface

handler = genericapifilters.WithAuditAnnotations(handler, c.AuditBackend, c.AuditPolicyChecker) handler = genericapifilters.WithWarningRecorder(handler) handler = genericapifilters.WithCacheControl(handler) <ins> handler = genericfilters.WithHSTS(handler, c.HSTSDirectives) </ins> handler = genericapifilters.WithRequestReceivedTimestamp(handler) handler = genericfilters.WithPanicRecovery(handler, c.RequestInfoResolver) return handler

"cors.go", "doc.go", "goaway.go", <ins> "hsts.go", </ins> "longrunning.go", "maxinflight.go", "priority-and-fairness.go",

<ins> /* Copyright 2020 The Kubernetes Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. */ package filters import ( "net/http" "strings" ) // WithHSTS is a simple HSTS implementation that wraps an http Handler. // If hstsDirectives is empty or nil, no HSTS support is installed. func WithHSTS(handler http.Handler, hstsDirectives []string) http.Handler { if len(hstsDirectives) == 0 { return handler } allDirectives := strings.Join(hstsDirectives, "; ") return http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) { // Chrome and Mozilla Firefox maintain an HSTS preload list // issue : golang.org/issue/26162 // Set the Strict-Transport-Security header if it is not already set if _, ok := w.Header()["Strict-Transport-Security"]; !ok { w.Header().Set("Strict-Transport-Security", allDirectives) } handler.ServeHTTP(w, req) }) } </ins>

import ( "fmt" "net" <ins> "strings" </ins> "time" metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" "k8s.io/apimachinery/pkg/runtime/serializer" <ins> "k8s.io/apimachinery/pkg/util/errors" </ins> "k8s.io/apiserver/pkg/server" utilfeature "k8s.io/apiserver/pkg/util/feature"

AdvertiseAddress net.IP CorsAllowedOriginList       []string <ins> HSTSDirectives              []string </ins> ExternalHost                string MaxRequestsInFlight         int MaxMutatingRequestsInFlight int

// ApplyTo applies the run options to the method receiver and returns self func (s *ServerRunOptions) ApplyTo(c *server.Config) error { c.CorsAllowedOriginList = s.CorsAllowedOriginList <ins> c.HSTSDirectives = s.HSTSDirectives </ins> c.ExternalAddress = s.ExternalHost c.MaxRequestsInFlight = s.MaxRequestsInFlight c.MaxMutatingRequestsInFlight = s.MaxMutatingRequestsInFlight

errors = append(errors, fmt.Errorf("--max-resource-write-bytes can not be negative value")) } <ins> if err := validateHSTSDirectives(s.HSTSDirectives); err != nil { errors = append(errors, err) } </ins> return errors } <ins> func validateHSTSDirectives(hstsDirectives []string) error { // HSTS Headers format: Strict-Transport-Security:max-age=expireTime [;includeSubDomains] [;preload] // See https://tools.ietf.org/html/rfc6797#section-6.1 for more information allErrors := []error{} for _, hstsDirective := range hstsDirectives { if len(strings.TrimSpace(hstsDirective)) == 0 { allErrors = append(allErrors, fmt.Errorf("empty value in strict-transport-security-directives")) continue } if hstsDirective != "includeSubDomains" && hstsDirective != "preload" { maxAgeDirective := strings.Split(hstsDirective, "=") if len(maxAgeDirective) != 2 || maxAgeDirective[0] != "max-age" { allErrors = append(allErrors, fmt.Errorf("--strict-transport-security-directives invalid, allowed values: max-age=expireTime, includeSubDomains, preload. see https://tools.ietf.org/html/rfc6797#section-6.1 for more information")) } } } return errors.NewAggregate(allErrors) } </ins> // AddUniversalFlags adds flags for a specific APIServer to the specified FlagSet func (s *ServerRunOptions) AddUniversalFlags(fs *pflag.FlagSet) { // Note: the weird ""+ in below lines seems to be the only way to get gofmt to

"List of allowed origins for CORS, comma separated.  An allowed origin can be a regular "+ "expression to support subdomain matching. If this list is empty CORS will not be enabled.") <ins> fs.StringSliceVar(&s.HSTSDirectives, "strict-transport-security-directives", s.HSTSDirectives, ""+ "List of directives for HSTS, comma separated. If this list is empty, then HSTS directives will not "+ "be added. Example: 'max-age=31536000,includeSubDomains,preload'") </ins> deprecatedTargetRAMMB := 0 fs.IntVar(&deprecatedTargetRAMMB, "target-ram-mb", deprecatedTargetRAMMB, "DEPRECATED: Memory limit for apiserver in MB (used to configure sizes of caches, etc.)")

expectErr: "--shutdown-delay-duration can not be negative value", }, { <ins> name: "Test when HSTSHeaders is valid", testOptions: &ServerRunOptions{ AdvertiseAddress:            net.ParseIP("192.168.10.10"), CorsAllowedOriginList:       []string{"10.10.10.100", "10.10.10.200"}, HSTSDirectives:              []string{"fakevalue", "includeSubDomains", "preload"}, MaxRequestsInFlight:         400, MaxMutatingRequestsInFlight: 200, RequestTimeout:              time.Duration(2) * time.Minute, MinRequestTimeout:           1800, JSONPatchMaxCopyBytes:       10 * 1024 * 1024, MaxRequestBodyBytes:         10 * 1024 * 1024, }, expectErr: "--strict-transport-security-directives invalid, allowed values: max-age=expireTime, includeSubDomains, preload. see https://tools.ietf.org/html/rfc6797#section-6.1 for more information", }, { </ins> name: "Test when ServerRunOptions is valid", testOptions: &ServerRunOptions{ AdvertiseAddress:            net.ParseIP("192.168.10.10"), CorsAllowedOriginList:       []string{"10.10.10.100", "10.10.10.200"}, <ins> HSTSDirectives:              []string{"max-age=31536000", "includeSubDomains", "preload"}, </ins> MaxRequestsInFlight:         400, MaxMutatingRequestsInFlight: 200, RequestTimeout:              time.Duration(2) * time.Minute,