Add allowedCallbackHosts parameter for queue-worker

Allow users to restrict which hosts receive async function callbacks via
a list of glob URLs. Defaults to ["*"] for backwards compatibility
(allow all). Set to an empty list to deny all.

Signed-off-by: Han Verstraete (OpenFaaS Ltd) <han@openfaas.com>

Author: welteki

chart/openfaas/README.md

@@ -582,6 +582,7 @@ See [values.yaml](./values.yaml) for detailed configuration.
 | `jetstreamQueueWorker.logs.debug` | Log debug messages | `false` |
 | `jetstreamQueueWorker.logs.format` | Set the log format, supports `console` or `json` | `console` |
 | `jetstreamQueueWorker.adaptiveConcurrency` | Enable adaptive concurrency limiting for functions. This setting only takes effect when `jetstreamQueueWorker.mode` is set to `function`. | `true` |
+| `jetstreamQueueWorker.allowedCallbackHosts` | List of glob patterns for hosts allowed to receive async callbacks. Defaults to `["*"]` (allow all). Set to empty list `[]` to deny all | `["*"]` |
 | `nats.channel` | The name of the NATS Streaming channel or NATS JetStream stream to use for asynchronous function invocations | `faas-request` |
 | `nats.external.clusterName` | The name of the externally-managed NATS Streaming server | `""` |
 | `nats.external.enabled` | Whether to use an externally-managed NATS Streaming server | `false` |

chart/openfaas/templates/queueworker-dep.yaml

@@ -113,6 +113,8 @@ spec:
           value: "{{ .Values.queueWorkerPro.httpRetryCodes }}"
         - name: backoff
           value: "{{ .Values.queueWorkerPro.backoff }}"
+        - name: "allowed_callback_hosts"
+          value: "{{ join \",\" .Values.jetstreamQueueWorker.allowedCallbackHosts }}"
 
         {{- if .Values.securityContext }}
         securityContext:

chart/openfaas/values.yaml

@@ -220,6 +220,7 @@ faasnetes:
 #
 # The Jetstream queue-worker is the default queue-worker for OpenFaaS Pro.
 jetstreamQueueWorker:
+  allowedCallbackHosts: ["*"]
   image: ghcr.io/openfaasltd/jetstream-queue-worker:0.5.8
   mode: "static"
   # Enable adaptive concurrency limiting for functions.

chart/queue-worker/README.md

@@ -115,6 +115,7 @@ helm upgrade --install \
 | `gateway.host` | The host at which the OpenFaaS gateway can be reached | `http://gateway.openfaas` |
 | `gateway.port` | The port at which the OpenFaaS gateway can be reached | `8080` |
 | `insecureTLS` | Enable insecure tls for callbacks | `false` |
+| `allowedCallbackHosts` | List of glob patterns for hosts allowed to receive async callbacks. Defaults to `["*"]` (allow all). Set to empty list `[]` to deny all | `["*"]` |
 | `nats.host` | The host at which the NATS JetStream server can be reached | `nats.openfaas` |
 | `nats.port` | The port at which the NATS JetStream server can be reached | `4222` |
 | `nats.stream.name` | Name of the NATS JetStream stream to use | `faas-request` |

chart/queue-worker/templates/deployment.yaml

@@ -96,6 +96,8 @@ spec:
               value: "{{ .Values.httpRetryCodes }}"
             - name: "backoff"
               value: "{{ .Values.backoff }}"
+            - name: "allowed_callback_hosts"
+              value: "{{ join \",\" .Values.allowedCallbackHosts }}"
         volumeMounts:
         - name: license
           readOnly: true

chart/queue-worker/values.yaml

@@ -6,6 +6,8 @@
 
 image: ghcr.io/openfaasltd/jetstream-queue-worker:0.5.8
 
+allowedCallbackHosts: ["*"]
+
 replicas: 1
 
 # Change this to your queue name.