Kubernetes ingress not enforcing inserting hsts into headers - hsts

Question

I am using kubectl to run Kubernetes on a Kops controlled cluster on AWS. I want to insert the Strict-Transport-Security header into the pages that are served from our site. My ingress currently forces all traffic to HTTPS, but ignores the annotations I have in my
ingress.yaml:
nginx.ingress.kubernetes.io/hsts: "true"
When I run kubectl get ingress <ingressname> -o yaml, I can see {"annotations":{"nginx.ingress.kubernetes.io/hsts":"true", but as far as I can tell, there is no sign of HSTS in the headers.
I have tried to make this happen from the configmap, but it also doesn't work.
I am using the quay.io/kubernetes-ingress-controller/nginx-ingress-controller:0.12.0 for the ingresscontroller, and my kubectl server version is v1.8.6.
The ingress deployment, service, and ingress itself all respond to changes, though putting gibberish in to the annotations in the ingress.yaml doesn't seem to break anything.
What am I doing wrong?

Answer 1

It may depend if you have actually enabled HTTPS on ingress itself. In my case I'm offloading SSL on AWS ELB thus seems to have to force the HSTS header. You may want to first try shorter max-age and drop out includeSubDomains. Use if you know what you are doing ;-) Check out this issue
You can force it by using config map similar to one below:
---
apiVersion: v1
data:
Strict-Transport-Security: "max-age=15768000 ; includeSubDomains"
kind: ConfigMap
metadata:
name: custom-headers-external-sts
namespace: ingress-nginx
---
kind: ConfigMap
apiVersion: v1
metadata:
name: nginx-configuration
namespace: ingress-nginx
labels:
app: ingress-nginx
data:
add-headers: "ingress-nginx/custom-headers-external-sts"

Answer 2

You can not directly add hsts header in annotations section in ingress-nginx yml. Because, hsts header is not available in ingress-nginx annotations.
You can use configuration-snippet to add additional headers in ingress-nginx annotations.
Just add it as mentioned below,
annotations:
nginx.ingress.kubernetes.io/configuration-snippet: |
more_set_headers "Strict-Transport-Security: max-age=31536000; includeSubDomains; preload";
Above solution is tried and tested!
Here is the link I had referred to: Configuration snippet

Answer 3

I seem to be experiencing the same problem, although I'm applying the changes via configmap.
Kubernetes: 1.8.6
Image: gcr.io/google_containers/nginx-ingress-controller:0.9.0-beta.15
Here's the config I've set:
kind: ConfigMap
apiVersion: v1
metadata:
name: nginx-ingress
namespace: kube-ingress
labels:
k8s-addon: nginx-ingress.addons.k8s.io
data:
allow-backend-server-header: "true"
hsts: "true"
hsts-include-subdomains: "true"
hsts-max-age: "31536000"
hsts-preload: "true"
use-proxy-protocol: "true"