Skip to content

fix: WPB-25750 Enable passing cspExtraConnectSrc value to nginx-ingress-services #5236

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
mohitrajain wants to merge 4 commits into
base: develop
Choose a base branch
from
Open

fix: WPB-25750 Enable passing cspExtraConnectSrc value to nginx-ingress-services #5236

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
98ebb7f
fix: WPB-25750 Enable passing cspExtraConnectSrc value to nginx-ingre…
mohitrajain May 21, 2026
8b604bd
fix: WPB-25750 fix typos for account host names in multi-ingress rela…
mohitrajain May 21, 2026
c789f77
fix: WPB-25750 enabling integration tests for nginx
mohitrajain May 21, 2026
b0e6e7e
fix: WPB-25750 set envoy to be default ingress mode
mohitrajain May 21, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions changelog.d/3-bug-fixes/cspExtraConnect-multiIngress
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
Enable passing cspExtraConnectSrc value to nginx-ingress-services when working with multi-ingresses (renderCSPInIngress=True). It would be required for webapp to connect to third party sft servers.
2 changes: 1 addition & 1 deletion charts/nginx-ingress-services/templates/ingress.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,7 @@ metadata:
{{if .Values.websockets.enabled}}
set $CSP "${CSP} wss://{{ .Values.config.dns.ssl }}";
{{end}}
set $CSP "${CSP} https://*.{{ .Values.config.dns.base }};";
set $CSP "${CSP} https://*.{{ .Values.config.dns.base }}{{- if .Values.config.cspExtraConnectSrc }} {{ .Values.config.cspExtraConnectSrc }}{{- end }};";
set $CSP "${CSP} default-src 'self';";
set $CSP "${CSP} font-src 'self' data:;";
set $CSP "${CSP} frame-src https://*.soundcloud.com https://*.spotify.com https://*.vimeo.com https://*.youtube-nocookie.com;";
Expand Down
4 changes: 4 additions & 0 deletions charts/nginx-ingress-services/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -175,6 +175,10 @@ config:
# (multi-ingress), because the webapps can only provide CSP headers for one
# (root) domain.
renderCSPInIngress: false
# Adds additional CSP connect-src entries. This is exclusive to `.config.dns.https`.
# It is only respected when renderCSPInIngress=True. Multiple entries can be passed with a space in between.
cspExtraConnectSrc:
# cspExtraConnectSrc: "https://sft.example-calling.com https://second-domain-example.com"
# Is this a chart instantiation for an additional backend domain (multi-ingress)?
#
# If 'true' some resources aren't created because they're expected to already
Expand Down