staging/web: Deny access to save/origin/visit/webhook

Related to swh/infra/sysadm-environment#5165 (closed)

After trying to use ingress-nginx snippets, I created two ingress on test-staging and it works fine.
Then I discovered that everything was already provided in swh-charts.
I just added some values.

Helm diff

./swh/helm-diff.sh
[swh] Comparing changes between branches production and staging_webhooks_check (per environment)...
Your branch is up to date with 'origin/production'.
[swh] Generate config in production branch for environment staging, namespace swh...
[swh] Generate config in production branch for environment staging, namespace swh-cassandra...
[swh] Generate config in production branch for environment staging, namespace swh-cassandra-next-version...
Your branch is up to date with 'origin/staging_webhooks_check'.
[swh] Generate config in staging_webhooks_check branch for environment staging...
[swh] Generate config in staging_webhooks_check branch for environment staging...
[swh] Generate config in staging_webhooks_check branch for environment staging...
Your branch is up to date with 'origin/production'.
[swh] Generate config in production branch for environment production, namespace swh...
[swh] Generate config in production branch for environment production, namespace swh-cassandra...
[swh] Generate config in production branch for environment production, namespace swh-cassandra-next-version...
Your branch is up to date with 'origin/staging_webhooks_check'.
[swh] Generate config in staging_webhooks_check branch for environment production...
[swh] Generate config in staging_webhooks_check branch for environment production...
[swh] Generate config in staging_webhooks_check branch for environment production...


------------- diff for environment staging namespace swh -------------

--- /tmp/swh-chart.swh.dRjrdpDa/staging-swh.before	2023-12-08 16:48:41.888055721 +0100
+++ /tmp/swh-chart.swh.dRjrdpDa/staging-swh.after	2023-12-08 16:48:42.292062394 +0100
@@ -15129,20 +15129,51 @@
           service:
             name: web
             port:
               number: 80
       
   tls:
   - hosts:
     - webapp-postgresql.internal.staging.swh.network
     secretName: swh-web-crt
 ---
+# Source: swh/templates/web/ingress.yaml
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  namespace: swh
+  name: web-ingress-webhooks
+  annotations:
+    nginx.ingress.kubernetes.io/whitelist-source-range: 10.42.0.0/16,10.43.0.0/16
+    cert-manager.io/cluster-issuer: letsencrypt-production-gandi
+    kubernetes.io/ingress.class: nginx
+    kubernetes.io/tls-acme: "true"
+    nginx.ingress.kubernetes.io/ssl-redirect: "true"
+
+spec:
+  rules:
+  - host: webapp-postgresql.internal.staging.swh.network
+    http:
+      paths:
+      - path: /save/origin/visit/webhook
+        pathType: Prefix
+        backend:
+          service:
+            name: web
+            port:
+              number: 5004
+      
+  tls:
+  - hosts:
+    - webapp-postgresql.internal.staging.swh.network
+    secretName: swh-web-crt
+---
 # Source: swh/templates/listers/deployment.yaml
 # Set useJsonLogger to false to let the logs be plain text
 ---
 # Source: swh/templates/checker-deposit/keda-autoscaling.yaml
 apiVersion: keda.sh/v1alpha1
 kind: ScaledObject
 metadata:
   name: checker-deposit-operators
   namespace: swh
 spec:


------------- diff for environment staging namespace swh-cassandra -------------

--- /tmp/swh-chart.swh.dRjrdpDa/staging-swh-cassandra.before	2023-12-08 16:48:42.016057836 +0100
+++ /tmp/swh-chart.swh.dRjrdpDa/staging-swh-cassandra.after	2023-12-08 16:48:42.432064706 +0100
@@ -13836,20 +13836,63 @@
             name: web
             port:
               number: 80
       
   tls:
   - hosts:
     - webapp.staging.swh.network
     - webapp-cassandra.internal.staging.swh.network
     secretName: swh-web-crt
 ---
+# Source: swh/templates/web/ingress.yaml
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  namespace: swh-cassandra
+  name: web-ingress-webhooks
+  annotations:
+    nginx.ingress.kubernetes.io/whitelist-source-range: 10.42.0.0/16,10.43.0.0/16
+    cert-manager.io/cluster-issuer: letsencrypt-production-gandi
+    kubernetes.io/ingress.class: nginx
+    kubernetes.io/tls-acme: "true"
+    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
+
+spec:
+  rules:
+  - host: webapp.staging.swh.network
+    http:
+      paths:
+      - path: /save/origin/visit/webhook
+        pathType: Prefix
+        backend:
+          service:
+            name: web
+            port:
+              number: 5004
+      
+  - host: webapp-cassandra.internal.staging.swh.network
+    http:
+      paths:
+      - path: /save/origin/visit/webhook
+        pathType: Prefix
+        backend:
+          service:
+            name: web
+            port:
+              number: 5004
+      
+  tls:
+  - hosts:
+    - webapp.staging.swh.network
+    - webapp-cassandra.internal.staging.swh.network
+    secretName: swh-web-crt
+---
 # Source: swh/templates/cookers/deployment.yaml
 # Set useJsonLogger to false to let the logs be plain text
 ---
 # Source: swh/templates/loaders/deployment.yaml
 # if defined at the "typed" loader level
 # otherwise use the global image is defined First this needs to replace - in
 # $loader_type with "" to find the proper image name.
 ---
 # Source: swh/templates/cookers/keda-autoscaling.yaml
 apiVersion: keda.sh/v1alpha1


------------- diff for environment staging namespace swh-cassandra-next-version -------------

--- /tmp/swh-chart.swh.dRjrdpDa/staging-swh-cassandra-next-version.before	2023-12-08 16:48:42.136059817 +0100
+++ /tmp/swh-chart.swh.dRjrdpDa/staging-swh-cassandra-next-version.after	2023-12-08 16:48:42.552066688 +0100
@@ -11422,20 +11422,51 @@
           service:
             name: web
             port:
               number: 80
       
   tls:
   - hosts:
     - webapp-cassandra-next-version.internal.staging.swh.network
     secretName: swh-web-crt
 ---
+# Source: swh/templates/web/ingress.yaml
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  namespace: swh-cassandra-next-version
+  name: web-ingress-webhooks
+  annotations:
+    nginx.ingress.kubernetes.io/whitelist-source-range: 10.42.0.0/16,10.43.0.0/16,192.168.130.0/24,192.168.50.0/24
+    cert-manager.io/cluster-issuer: letsencrypt-production-gandi
+    kubernetes.io/ingress.class: nginx
+    kubernetes.io/tls-acme: "true"
+    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
+
+spec:
+  rules:
+  - host: webapp-cassandra-next-version.internal.staging.swh.network
+    http:
+      paths:
+      - path: /save/origin/visit/webhook
+        pathType: Prefix
+        backend:
+          service:
+            name: web
+            port:
+              number: 5004
+      
+  tls:
+  - hosts:
+    - webapp-cassandra-next-version.internal.staging.swh.network
+    secretName: swh-web-crt
+---
 # Source: swh/templates/cookers/deployment.yaml
 # Set useJsonLogger to false to let the logs be plain text
 ---
 # Source: swh/templates/loaders/deployment.yaml
 # if defined at the "typed" loader level
 # otherwise use the global image is defined First this needs to replace - in
 # $loader_type with "" to find the proper image name.
 ---
 # Source: swh/templates/cookers/keda-autoscaling.yaml
 apiVersion: keda.sh/v1alpha1


------------- diff for environment production namespace swh -------------

No differences


------------- diff for environment production namespace swh-cassandra -------------

No differences