release: v0.10.2 — WebAuthn additional rp_origins

Fix passkey registration in K8s cluster-mode deployments where the
broker→leader redirect lands the browser on a per-pod subdomain that
the single configured webauthn_rp_origin did not cover.

Chart: 0.3.4 -> 0.3.5 — ConfigMap overlay auto-renders every per-pod
subdomain (both :443 and :8443) into webauthn_additional_rp_origins.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: dforsber

CHANGELOG.md

@@ -5,6 +5,17 @@ All notable changes to BoilStream will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.10.2] - 2026-04-19
+
+### Fixes
+
+- **WebAuthn passkey enrollment in K8s cluster mode**: Broker→leader redirects land the browser on a per-pod subdomain (`boilstream-N.<domain>`) different from the configured `webauthn_rp_origin`, and webauthn-rs's strict origin check rejected the ceremony with `HTTP 400 – Registration failed - The clients relying party origin does not match our servers information`.
+
+### Features
+
+- **`webauthn_additional_rp_origins` server config**: Optional list of extra origins accepted during WebAuthn registration/authentication. `rp_id` stays as the base domain so credentials roam across all pods; `rp_origin` is the canonical primary URL; the new list covers the redirect-target subdomains.
+- **Helm chart**: ConfigMap overlay auto-renders both `:443` and `:8443` variants of every per-pod subdomain (`boilstream-0.<domain>`, …) into `webauthn_additional_rp_origins`. Chart version **0.3.5**.
+
 ## [0.10.1] - 2026-04-19
 
 ### Fixes

charts/boilstream/Chart.yaml

@@ -6,8 +6,8 @@ description: |
   support. Each pod participates in S3-based leader election and serves
   per-user catalogs; failed pods are recovered from S3 backups.
 type: application
-version: 0.3.4
-appVersion: "0.10.1"
+version: 0.3.5
+appVersion: "0.10.2"
 kubeVersion: ">=1.27.0"
 keywords:
   - streaming

charts/boilstream/templates/configmap.yaml

@@ -128,6 +128,26 @@ data:
         'webauthn_rp_origin: "https://localhost"',
         'webauthn_rp_origin: "https://{{ .Values.domain }}"')
 
+    # Broker→leader redirects land the browser on a per-pod subdomain
+    # (boilstream-N.{{ .Values.domain }}). WebAuthn ceremonies started on
+    # that subdomain need each per-pod origin in the allowed list, since
+    # webauthn-rs does an exact origin match. rp_id remains the base domain
+    # so credentials work across all pods. Include both :443 (browser) and
+    # :8443 (direct CLI / 307-from-:443 landing) variants.
+    extra_origins = [
+{{- range $i, $_ := until (int .Values.replicas) }}
+        'https://boilstream-{{ $i }}.{{ $.Values.domain }}',
+        'https://boilstream-{{ $i }}.{{ $.Values.domain }}:8443',
+{{- end }}
+    ]
+    # Append a webauthn_additional_rp_origins list right after rp_origin.
+    rp_origin_line = 'webauthn_rp_origin: "https://{{ .Values.domain }}"'
+    yaml_list = ''.join(f'\n    - "{o}"' for o in extra_origins)
+    c = c.replace(
+        rp_origin_line,
+        rp_origin_line + '\n  webauthn_additional_rp_origins:' + yaml_list,
+    )
+
     c = c.replace(
         '# tls_cert: disabled for local k8s test',
         'tls_cert: "/tls/tls.crt"')