[Zizee1994]

Summary

Harden ingress, track contract IDs, and document External Secrets setup

What was solved

#64 — Add security headers and rate limiting to the API ingress

Add NGINX ingress rate limiting annotations (limit-rps, limit-connections) and enable HSTS via security headers on the API ingress in k8s/ingress.yaml, scoped strictly to the edge ingress configuration.

Addressed:

• Changed: k8s/ingress.yaml
• Add limit-rps and limit-connections annotations to the ingress in k8s/ingress.yaml
• Enable HSTS (Strict-Transport-Security) via ingress annotations/security headers
• Apply changes only to k8s/ingress.yaml (edge ingress); do not modify backend/frontend deployments or other k8s manifests

#65 — Add contract ID keys to the backend ConfigMap

Add placeholder contract ID keys to the backend ConfigMap so the keys patched by rollback-contracts.cjs are tracked in Git, and document the post-deploy update flow for keeping the ConfigMap in sync with deployed contract IDs.

Addressed:

• Changed: k8s/configmap.yaml, scripts/rollback-contracts.cjs, docs/contract-deploy-guide.md
• Add contract ID keys (placeholders) to k8s/configmap.yaml so they are managed in Git
• Document the update flow after a contract deploy (how to update the ConfigMap contract ID keys and re-apply)
• Keep changes scoped to k8s/configmap.yaml and scripts/rollback-contracts.cjs (plus docs if needed)

#66 — Provide an ExternalSecret example for backend-secret

Add a standalone ExternalSecret example manifest for the backend-secret and document how to set it up with the External Secrets Operator, without wiring it into kustomization.

Addressed:

• Changed: k8s/examples/external-secret.yaml, k8s/examples/external-secret.yaml, docs/DEPLOY-KUBERNETES.md, k8s/examples/external-secret.yaml
• Create k8s/examples/external-secret.yaml providing an ExternalSecret that produces the backend-secret (matching keys used by k8s/secrets.yaml / backend deployment), and do NOT add it to k8s/kustomization.yaml
• Document External Secrets Operator setup steps in docs/DEPLOY-KUBERNETES.md, referencing the new example file
• Keep changes scoped to the example manifest and the Kubernetes deploy doc; do not alter unrelated manifests or docs

Changes

• k8s/configmap.yaml (modify)
• docs/contract-deploy-guide.md (modify)
• docs/DEPLOY-KUBERNETES.md (modify)
• k8s/ingress.yaml (modify)
• scripts/rollback-contracts.cjs (modify)
• k8s/examples/external-secret.yaml (create)

Approach

1. Add security headers and rate limiting to the API ingress #64 — Add security headers and rate limiting to the API ingress (Changed: k8s/ingress.yaml)
2. Add contract ID keys to the backend ConfigMap #65 — Add contract ID keys to the backend ConfigMap (Changed: k8s/configmap.yaml, scripts/rollback-contracts.cjs, docs/contract-deploy-guide.md)
3. Provide an ExternalSecret example for backend-secret #66 — Provide an ExternalSecret example for backend-secret (Changed: k8s/examples/external-secret.yaml, k8s/examples/external-secret.yaml, docs/DEPLOY-KUBERNETES.md, k8s/examples/external-secret.yaml)

Issues

Closes #64
Closes #65
Closes #66

[drips-wave]

@Zizee1994 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits