I have a kubernetes deployment which requires the following configuration:
- POST must be allowed from any origin.
- GET, HEAD, LIST must be restricted to intranet.
I came up with:
include modules/*.conf;
worker_processes 1;
error_log /dev/stdout info;
events {
worker_connections 1024;}
http {
include mime.types;
default_type application/octet-stream;
log_format main '$http_x_forwarded_for - $remote_user [$time_local] "$request" $status $body_bytes_sent "$http_referer" "$http_user_agent"';
access_log /dev/stdout main;
sendfile on;
keepalive_timeout 65;
server {
listen 8080;
server_name localhost;
port_in_redirect off;
location / {
root html;
index index.html;
}
error_page 403 /403.html;
error_page 404 /404.html;
error_page 500 /500.html;
error_page 502 /502.html;
error_page 503 /503.html;
error_page 504 /504.html;
}
}
if ($request_method != POST) {
limit_except GET DELETE PUT{
allow 10.0.0.0/8;
deny all;
}
}
But I'm still able to GET from an external network