Always set content-type & nosniff

[tallclair]

What type of PR is this?
/kind bug

What this PR does / why we need it:

HTTP responses should always set a content-type header, and nosniff option to prevent certain types of XSS or mime attacks.

Follow-up to #72520 to fix a few more cases.

Does this PR introduce a user-facing change?:

NONE

/assign @dims

[dims]

/test pull-kubernetes-e2e-kops-aws

[dims]

/assign @lavalamp @liggitt
/lgtm

/test pull-kubernetes-e2e-kops-aws

[liggitt]

one question on the dot graph, @deads2k might know, lgtm otherwise

[fedebongio]

/cc @logicalhan

[logicalhan]

FYI, we can hopefully use this change here (#72589).

[tallclair]

ping @deads2k for the dot graph question

Can we get this merged?

[tallclair]

Er, sorry, I realized this needs to be sync'd up with #72589

[tallclair]

Actually, on close inspection, does reusing that make sense in all these cases? Is it ok to depend on k8s.io/apiserver from the scheduler, kube-proxy, and controller manager?

[dims]

/unassign

[liggitt]

one nit, then lgtm

[liqlin2015]

@tallclair Are you still working on this PR?
How can we make sure x-content-type-options: nosniff header is always set in the http response header in any of kube-apiserver API call? I did not see previous content type filter was referred by anyone. Should we put the content type filter in the default handler of chain of kube-apiserver?

[tallclair]

Yeah, sorry. Resolved the last comment.

How can we make sure x-content-type-options: nosniff header is always set in the http response header in any of kube-apiserver API call?

Good question. I can't think of a good universal approach. Suggestions welcome.

[liggitt]

/priority backlog
/lgtm
/approve

[tallclair]

Don't know why @liggitt 's /approve wasn't registered... adding the label manually.

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: liggitt, tallclair

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• cmd/kube-proxy/OWNERS [liggitt]
• cmd/kube-scheduler/OWNERS [liggitt]
• pkg/OWNERS [liggitt]
• staging/src/k8s.io/apiserver/OWNERS [liggitt]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment