From 55ae6cdd3eafac4e04c2def38cda05bd634af382 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?C=C3=A9dric=20Verstraeten?= Date: Thu, 20 Aug 2026 21:33:32 +0200 Subject: [PATCH 1/2] Add dynamic CORS origins and secure refresh cookie Update the hub API Helm template to set `REFRESH_COOKIE_SECURE` automatically when the API schema is HTTPS, and generate `CORS_ALLOWED_ORIGINS` from configured frontend URLs (legacy URL, domain list, tenant wildcard domain, and demo URL). This keeps cookie behavior and CORS config aligned with deployment settings. --- charts/hub/templates/kerberos-hub/hub-api.yaml | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/charts/hub/templates/kerberos-hub/hub-api.yaml b/charts/hub/templates/kerberos-hub/hub-api.yaml index dc3d81c..e799378 100644 --- a/charts/hub/templates/kerberos-hub/hub-api.yaml +++ b/charts/hub/templates/kerberos-hub/hub-api.yaml @@ -194,6 +194,23 @@ spec: value: "{{ .Values.kerberoshub.api.schema }}://{{ .Values.kerberoshub.api.url }}" - name: PUBLIC_URL value: "{{ .Values.kerberoshub.frontend.schema }}://{{ .Values.kerberoshub.frontend.url }}" + - name: REFRESH_COOKIE_SECURE + value: {{ eq .Values.kerberoshub.api.schema "https" | quote }} + {{- $corsOrigins := list }} + {{- with .Values.kerberoshub.frontend.legacyUrl }} + {{- $corsOrigins = append $corsOrigins (printf "%s://%s" $.Values.kerberoshub.frontend.schema .) }} + {{- end }} + {{- range .Values.kerberoshub.frontend.domains }} + {{- $corsOrigins = append $corsOrigins (printf "%s://%s" $.Values.kerberoshub.frontend.schema .) }} + {{- end }} + {{- if and .Values.kerberoshub.frontend.multiTenant .Values.kerberoshub.frontend.tenantBaseDomain }} + {{- $corsOrigins = append $corsOrigins (printf "%s://*.%s" .Values.kerberoshub.frontend.schema .Values.kerberoshub.frontend.tenantBaseDomain) }} + {{- end }} + {{- if and .Values.kerberoshub.frontend.demoEnabled .Values.kerberoshub.frontend.demoUrl }} + {{- $corsOrigins = append $corsOrigins (printf "%s://%s" .Values.kerberoshub.frontend.schema .Values.kerberoshub.frontend.demoUrl) }} + {{- end }} + - name: CORS_ALLOWED_ORIGINS + value: {{ join "," $corsOrigins | quote }} {{ if .Values.isPrivate }} - name: KERBEROS_PRIVATE_CLOUD value: "true" From 91eb64a2f3ad0aa019727f265c50b8a215b634e0 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?C=C3=A9dric=20Verstraeten?= Date: Thu, 20 Aug 2026 21:35:04 +0200 Subject: [PATCH 2/2] Update Chart.yaml --- charts/hub/Chart.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/charts/hub/Chart.yaml b/charts/hub/Chart.yaml index a5dbf26..225c219 100644 --- a/charts/hub/Chart.yaml +++ b/charts/hub/Chart.yaml @@ -16,7 +16,7 @@ type: application # This is the chart version. This version number should be incremented each time you make changes # to the chart and its templates, including the app version. # Versions are expected to follow Semantic Versioning (https://semver.org/) -version: 0.128.0 +version: 0.129.0 # This is the version number of the application being deployed. This version number should be # incremented each time you make changes to the application. Versions are not expected to