Add allowedCallbackURLs parameter for queue-worker

[welteki]

Description

Allow users to restrict which hosts receive async function callbacks via a list of glob patterns. The allowedCallbackURLs parameter is added to both the main openfaas chart and the standalone queue-worker chart.

• Defaults to ["*"] for backwards compatibility (allow all)
• Set to empty list [] to deny all callbacks
• Accepts a list of URLs like *.example.com or api.internal

Why is this needed?

Prevents SSRF-style attacks where malicious callback URLs could be used to reach internal services. Users can now restrict callbacks to trusted domains only.

• I have raised an issue to propose this change

How Has This Been Tested?

This chart was used and validated during E2E testing.

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)

Checklist:

• My code follows the code style of this project.
• My change requires a change to the documentation.
• I have updated the documentation accordingly.
• I have signed-off my commits with git commit -s

[reviewfn]

AI Pull Request Overview

Disclaimer: This review was generated by automated AI and may contain errors. Do not trust its outputs without human verification.

Summary

• Adds allowedCallbackURLs defaults to the OpenFaaS and standalone queue-worker Helm values.
• Renders the configured list into the queue-worker container as allowed_callback_urls.
• Documents the new value in both chart README parameter tables.
• The default remains allow-all via ["*"], preserving existing callback behavior.
• The main risk is releaseability: chart changes are not accompanied by chart version/package metadata updates.

Approval rating (1-10)

7/10. The implementation is small and consistent, but chart release metadata appears incomplete for a publishable Helm chart change.

Summary per file

Summary per file

File path	Summary
chart/openfaas/README.md	Documents the OpenFaaS chart callback allow-list value.
chart/openfaas/templates/queueworker-dep.yaml	Passes allowed callback URL patterns to the Pro queue-worker container.
chart/openfaas/values.yaml	Adds default allow-all callback URL patterns for Pro queue-worker.
chart/queue-worker/README.md	Documents the standalone queue-worker callback allow-list value.
chart/queue-worker/templates/deployment.yaml	Passes allowed callback URL patterns to the standalone queue-worker container.
chart/queue-worker/values.yaml	Adds default allow-all callback URL patterns for standalone queue-worker.

Overall Assessment

The chart value wiring is straightforward and consistent across the bundled OpenFaaS chart and the standalone queue-worker chart. The new defaults preserve existing behavior, and an empty list renders as an empty environment value, matching the documented deny-all intent if the worker treats an empty list that way. Before merging, the chart release metadata should be updated so these chart changes can be published and consumed through the Helm repository.

Detailed Review

Detailed Review

Finding: Helm chart changes are not versioned for release

The PR changes published chart behavior in both chart/openfaas/values.yaml:274 and chart/queue-worker/values.yaml:9, and also changes the rendered deployments in chart/openfaas/templates/queueworker-dep.yaml:116 and chart/queue-worker/templates/deployment.yaml:99. However, the scoped diff does not include corresponding chart version or package index updates for either chart.

This repository publishes Helm charts as versioned artifacts. If the chart versions remain unchanged, consumers of the Helm repository can continue to resolve the existing chart versions and never receive the new allowedCallbackURLs value or rendered allowed_callback_urls environment variable. Depending on the release automation, unchanged versions can also cause package overwrite/repository index ambiguity.

Update the OpenFaaS and queue-worker chart release metadata for this change, and regenerate the packaged chart/index artifacts if that is part of this repository's release flow.

AI agent details.

Agent processing time: 4m35.722s
Environment preparation time: 18.68s
Total time from webhook: 5m27.189s