Add allowedCallbackURLs parameter for queue-worker

Allow users to restrict which URLs receive async function callbacks via
a list of glob patterns. Defaults to ["*"] for backwards compatibility
(allow all). Set to an empty list to deny all.

Signed-off-by: Han Verstraete (OpenFaaS Ltd) <han@openfaas.com>

Author: welteki

chart/openfaas/README.md

@@ -582,6 +582,7 @@ See [values.yaml](./values.yaml) for detailed configuration.
 | `jetstreamQueueWorker.logs.debug` | Log debug messages | `false` |
 | `jetstreamQueueWorker.logs.format` | Set the log format, supports `console` or `json` | `console` |
 | `jetstreamQueueWorker.adaptiveConcurrency` | Enable adaptive concurrency limiting for functions. This setting only takes effect when `jetstreamQueueWorker.mode` is set to `function`. | `true` |
+| `queueWorkerPro.allowedCallbackURLs` | List of glob patterns for URLs allowed to receive async callbacks. Defaults to `["*"]` (allow all). Set to empty list `[]` to deny all | `["*"]` |
 | `nats.channel` | The name of the NATS Streaming channel or NATS JetStream stream to use for asynchronous function invocations | `faas-request` |
 | `nats.external.clusterName` | The name of the externally-managed NATS Streaming server | `""` |
 | `nats.external.enabled` | Whether to use an externally-managed NATS Streaming server | `false` |

chart/openfaas/templates/queueworker-dep.yaml

@@ -113,6 +113,8 @@ spec:
           value: "{{ .Values.queueWorkerPro.httpRetryCodes }}"
         - name: backoff
           value: "{{ .Values.queueWorkerPro.backoff }}"
+        - name: "allowed_callback_urls"
+          value: "{{ join "," .Values.queueWorkerPro.allowedCallbackURLs }}"
 
         {{- if .Values.securityContext }}
         securityContext:

chart/openfaas/values.yaml

@@ -271,6 +271,7 @@ queueWorkerPro:
   printResponseBody: false
   # Control the concurrent invocations
   maxInflight: 50
+  allowedCallbackURLs: ["*"]
 
 # Community Edition, maxInflight is 1
 # Name of shared queue is "faas-request"

chart/queue-worker/README.md

@@ -115,6 +115,7 @@ helm upgrade --install \
 | `gateway.host` | The host at which the OpenFaaS gateway can be reached | `http://gateway.openfaas` |
 | `gateway.port` | The port at which the OpenFaaS gateway can be reached | `8080` |
 | `insecureTLS` | Enable insecure tls for callbacks | `false` |
+| `allowedCallbackURLs` | List of glob patterns for URLs allowed to receive async callbacks. Defaults to `["*"]` (allow all). Set to empty list `[]` to deny all | `["*"]` |
 | `nats.host` | The host at which the NATS JetStream server can be reached | `nats.openfaas` |
 | `nats.port` | The port at which the NATS JetStream server can be reached | `4222` |
 | `nats.stream.name` | Name of the NATS JetStream stream to use | `faas-request` |

chart/queue-worker/templates/deployment.yaml

@@ -96,6 +96,8 @@ spec:
               value: "{{ .Values.httpRetryCodes }}"
             - name: "backoff"
               value: "{{ .Values.backoff }}"
+            - name: "allowed_callback_urls"
+              value: "{{ join "," .Values.allowedCallbackURLs }}"
         volumeMounts:
         - name: license
           readOnly: true

chart/queue-worker/values.yaml

@@ -6,6 +6,8 @@
 
 image: ghcr.io/openfaasltd/jetstream-queue-worker:0.5.8
 
+allowedCallbackURLs: ["*"]
+
 replicas: 1
 
 # Change this to your queue name.