fix(k8s): only set headers in public-splitter

This will cover all endpoints, including static files.

Jira: IAM-1775

Author: bheesham

k8s/templates/public-splitter.yaml

@@ -24,7 +24,7 @@ data:
       proxy_read_timeout      90;
       proxy_buffers           32 4k;
       resolver                kube-dns.kube-system.svc.cluster.local  valid=5s;
-      add_header              Content-Security-Policy "default-src 'self'; frame-ancestors 'none'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data:" always;
+      add_header              Content-Security-Policy "default-src 'self'; frame-ancestors 'none'; script-src-elem 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data:" always;
 
       map $http_cookie $login {
         default {{ if .Values.public }}"no"{{ else }}"yes"{{ end }};

k8s/templates/router.yaml

@@ -23,7 +23,6 @@ data:
       proxy_send_timeout      90;
       proxy_read_timeout      90;
       proxy_buffers           32 4k;
-      add_header              Content-Security-Policy "default-src 'self'; frame-ancestors 'none'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data:" always;
 
       server {