Add istio-config-contour chart and enforce HTTPS/TLS/HSTS for uralkal ingress

infrastructure/istio-config/uralkal/istio-config.yaml

@@ -7,6 +7,15 @@ spec:
   dependsOn: []
   interval: 5m
   timeout: 10m
+  chart:
+    spec:
+      chart: istio-config-contour
+      version: "0.1.1"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
   values:
     global:
       env: uralkal
@@ -19,6 +28,16 @@ spec:
               namespace: default
               selector:
                 istio: ingressgateway
+              httpsRedirect: true
+              tlsOptions:
+                minProtocolVersion: TLSV1_2
+                cipherSuites:
+                  - ECDHE-ECDSA-AES256-GCM-SHA384
+                  - ECDHE-RSA-AES256-GCM-SHA384
+                  - ECDHE-ECDSA-AES128-GCM-SHA256
+                  - ECDHE-RSA-AES128-GCM-SHA256
+                  - ECDHE-ECDSA-CHACHA20-POLY1305
+                  - ECDHE-RSA-CHACHA20-POLY1305
               servers:
                 - hosts:
                     - sarex.local.uralkali.com
@@ -37,6 +56,24 @@ spec:
                     - camunda-tasklist.sarex.local.uralkali.com
                   tls:
                     credentialName: uralkal-camunda-tls
+          envoyFilters:
+            gateway-hsts:
+              namespace: istio-system   # там же, где поды ingressgateway
+              workloadSelector:
+                labels:
+                  istio: ingressgateway
+              configPatches:
+                - applyTo: HTTP_ROUTE_CONFIGURATION
+                  match:
+                    context: GATEWAY
+                  patch:
+                    operation: MERGE
+                    value:
+                      response_headers_to_add:
+                        - header:
+                            key: Strict-Transport-Security
+                            value: "max-age=31536000"
+                          append_action: OVERWRITE_IF_EXISTS_OR_ADD
           virtualServices:
             platform:
               name: sarex-frontend-virt-service