title: How to set csp.rules for kibana using docker env vars?
body: <p>I'm trying to set up kibana with security turned on but without TLS, instead there's a reverse proxy on the ingress terminating TLS (really a GCP load balancer).</p>
  <p>Most things work fine, except some resources refuse to load and in chrome console I see:</p>
  <pre><code>Refused to execute inline script because it violates the following Content Security Policy directive: &quot;script-src 'unsafe-eval' 'self'&quot;. Either the 'unsafe-inline' keyword, a hash ('sha256-P5polb1UreUSOe5V/Pv7tc+yeZuJXiOi/3fqhGsU7BE='), or a nonce ('nonce-...') is required to enable inline execution.
  </code></pre>
  <p>So happy as a clam I find the csp.rules setting, thinking I can customize the policy which seems to not be designed to support kibana with a reverse proxy. But I can't get it to work! Kibana crashes on startup with error:</p>
  <pre><code>Configuring logger failed: TypeError: rules.map is not a function
    at cspRulesDeprecation (/usr/share/kibana/src/core/server/config/deprecation/core_deprecations.js:70:34)
  </code></pre>
  <p>from docker-compose.yml:</p>
  <pre><code>&quot;CSP_RULES=[\&quot;frame-src 'self' https://naturalcycles.com/\&quot;]&quot;
  </code></pre>