feat(deploy): the chart can configure what the security page says it can, and the CORS setting reaches the server

deploy/helm/chatcli-operator/templates/deployment.yaml

@@ -91,6 +91,18 @@ spec:
             - name: CHATCLI_CORS_ORIGIN
               value: {{ .Values.security.corsOrigin | quote }}
           {{- end }}
+          {{- with .Values.security.corsAllowedOrigins }}
+            - name: CHATCLI_CORS_ALLOWED_ORIGINS
+              value: {{ join "," . | quote }}
+          {{- end }}
+          {{- with .Values.security.corsAllowedMethods }}
+            - name: CHATCLI_CORS_ALLOWED_METHODS
+              value: {{ join "," . | quote }}
+          {{- end }}
+          {{- if .Values.security.corsAllowCredentials }}
+            - name: CHATCLI_CORS_ALLOW_CREDENTIALS
+              value: "true"
+          {{- end }}
           {{- if .Values.security.auditLogPath }}
             - name: CHATCLI_AUDIT_LOG_PATH
               value: {{ .Values.security.auditLogPath | quote }}

deploy/helm/chatcli-operator/values.schema.json

@@ -13,7 +13,9 @@
     "image": {
       "type": "object",
       "description": "Container image configuration.",
-      "required": ["repository"],
+      "required": [
+        "repository"
+      ],
       "additionalProperties": false,
       "properties": {
         "repository": {
@@ -27,7 +29,11 @@
         },
         "pullPolicy": {
           "type": "string",
-          "enum": ["Always", "IfNotPresent", "Never"],
+          "enum": [
+            "Always",
+            "IfNotPresent",
+            "Never"
+          ],
           "description": "Kubernetes image pull policy.",
           "default": "IfNotPresent"
         }
@@ -38,7 +44,9 @@
       "description": "List of Docker registry pull secrets.",
       "items": {
         "type": "object",
-        "required": ["name"],
+        "required": [
+          "name"
+        ],
         "additionalProperties": false,
         "properties": {
           "name": {
@@ -162,9 +170,26 @@
           "description": "Container image for the kubectl-apply Job that ships with the hook.",
           "additionalProperties": false,
           "properties": {
-            "repository": {"type": "string", "description": "Image repository. Defaults to the official Kubernetes-project distroless kubectl image at registry.k8s.io.", "default": "registry.k8s.io/kubectl"},
-            "tag": {"type": "string", "description": "Image tag. Must be a fully-qualified patch tag (e.g. v1.31.10) — major-minor stubs like v1.31 are NOT resolvable on registry.k8s.io.", "default": "v1.31.10"},
-            "pullPolicy": {"type": "string", "enum": ["Always", "IfNotPresent", "Never"], "description": "Image pull policy.", "default": "IfNotPresent"}
+            "repository": {
+              "type": "string",
+              "description": "Image repository. Defaults to the official Kubernetes-project distroless kubectl image at registry.k8s.io.",
+              "default": "registry.k8s.io/kubectl"
+            },
+            "tag": {
+              "type": "string",
+              "description": "Image tag. Must be a fully-qualified patch tag (e.g. v1.31.10) \u2014 major-minor stubs like v1.31 are NOT resolvable on registry.k8s.io.",
+              "default": "v1.31.10"
+            },
+            "pullPolicy": {
+              "type": "string",
+              "enum": [
+                "Always",
+                "IfNotPresent",
+                "Never"
+              ],
+              "description": "Image pull policy.",
+              "default": "IfNotPresent"
+            }
           }
         },
         "resources": {
@@ -175,12 +200,16 @@
         "tolerations": {
           "type": "array",
           "description": "Tolerations for the hook Job pod.",
-          "items": {"type": "object"}
+          "items": {
+            "type": "object"
+          }
         },
         "nodeSelector": {
           "type": "object",
           "description": "NodeSelector for the hook Job pod.",
-          "additionalProperties": {"type": "string"}
+          "additionalProperties": {
+            "type": "string"
+          }
         }
       }
     },
@@ -191,7 +220,11 @@
       "properties": {
         "type": {
           "type": "string",
-          "enum": ["ClusterIP", "NodePort", "LoadBalancer"],
+          "enum": [
+            "ClusterIP",
+            "NodePort",
+            "LoadBalancer"
+          ],
           "description": "Kubernetes Service type.",
           "default": "ClusterIP"
         }
@@ -324,14 +357,21 @@
           },
           "operator": {
             "type": "string",
-            "enum": ["Exists", "Equal"]
+            "enum": [
+              "Exists",
+              "Equal"
+            ]
           },
           "value": {
             "type": "string"
           },
           "effect": {
             "type": "string",
-            "enum": ["NoSchedule", "PreferNoSchedule", "NoExecute"]
+            "enum": [
+              "NoSchedule",
+              "PreferNoSchedule",
+              "NoExecute"
+            ]
           },
           "tolerationSeconds": {
             "type": "integer"
@@ -388,17 +428,27 @@
           "type": "object",
           "description": "TLS configuration for the REST API.",
           "properties": {
-            "certFile": { "type": "string" },
-            "keyFile": { "type": "string" }
+            "certFile": {
+              "type": "string"
+            },
+            "keyFile": {
+              "type": "string"
+            }
           }
         },
         "grpcTLS": {
           "type": "object",
           "description": "TLS for gRPC communication with ChatCLI server.",
           "properties": {
-            "certFile": { "type": "string" },
-            "keyFile": { "type": "string" },
-            "caFile": { "type": "string" }
+            "certFile": {
+              "type": "string"
+            },
+            "keyFile": {
+              "type": "string"
+            },
+            "caFile": {
+              "type": "string"
+            }
           }
         },
         "allowedResourceTypes": {
@@ -416,6 +466,24 @@
         "auditLogPath": {
           "type": "string",
           "description": "File path for structured audit logs."
+        },
+        "corsAllowedOrigins": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "description": "Origins allowed to call the operator REST API from a browser."
+        },
+        "corsAllowedMethods": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "description": "HTTP methods allowed cross-origin; defaults to GET, POST, PUT, DELETE, OPTIONS."
+        },
+        "corsAllowCredentials": {
+          "type": "boolean",
+          "description": "Allow cookies and Authorization on cross-origin requests."
         }
       }
     },
@@ -424,11 +492,19 @@
       "description": "Extra environment variables for the operator pod.",
       "items": {
         "type": "object",
-        "required": ["name"],
+        "required": [
+          "name"
+        ],
         "properties": {
-          "name": { "type": "string" },
-          "value": { "type": "string" },
-          "valueFrom": { "type": "object" }
+          "name": {
+            "type": "string"
+          },
+          "value": {
+            "type": "string"
+          },
+          "valueFrom": {
+            "type": "object"
+          }
         }
       }
     }

deploy/helm/chatcli-operator/values.yaml

@@ -131,7 +131,13 @@ security:
   # Custom log scrub patterns (comma-separated regexes)
   logScrubPatterns: ""
   # CORS allowed origin (empty = deny all)
-  corsOrigin: ""
+  # CORS for the operator REST API (dashboard). Deny-all until an origin is
+  # named: with none, a browser blocks every cross-origin call.
+  corsOrigin: ""                # a single origin (kept for compatibility)
+  corsAllowedOrigins: []        # several origins, or ["*"] for any
+  #   - "https://dashboard.example.com"
+  corsAllowedMethods: []        # defaults to GET, POST, PUT, DELETE, OPTIONS
+  corsAllowCredentials: false   # cookies / Authorization on cross-origin calls
   # Audit log file path
   auditLogPath: ""
 

deploy/helm/chatcli/templates/deployment.yaml

@@ -109,6 +109,29 @@ spec:
                   name: {{ .Values.security.jwtSecretRef.name }}
                   key: {{ .Values.security.jwtSecretRef.key }}
           {{- end }}
+          {{- if .Values.security.jwtIssuer }}
+            - name: CHATCLI_JWT_ISSUER
+              value: {{ .Values.security.jwtIssuer | quote }}
+          {{- end }}
+          {{- if .Values.security.jwtAudience }}
+            - name: CHATCLI_JWT_AUDIENCE
+              value: {{ .Values.security.jwtAudience | quote }}
+          {{- end }}
+          {{- if .Values.security.jwtPublicKey }}
+            - name: CHATCLI_JWT_PUBLIC_KEY
+              value: {{ .Values.security.jwtPublicKey | quote }}
+          {{- end }}
+          {{- if .Values.security.jwtPublicKeyRef }}
+            - name: CHATCLI_JWT_PUBLIC_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.security.jwtPublicKeyRef.name }}
+                  key: {{ .Values.security.jwtPublicKeyRef.key }}
+          {{- end }}
+          {{- if .Values.security.tlsClientCA }}
+            - name: CHATCLI_SERVER_TLS_CLIENT_CA
+              value: {{ .Values.security.tlsClientCA | quote }}
+          {{- end }}
           {{- if .Values.security.rateLimitRps }}
             - name: CHATCLI_RATE_LIMIT_RPS
               value: {{ .Values.security.rateLimitRps | quote }}

deploy/helm/chatcli/templates/networkpolicy.yaml

@@ -16,14 +16,44 @@ spec:
   - ports:
     - port: {{ .Values.server.port }}
       protocol: TCP
-    {{- if .Values.metrics.enabled }}
-    - port: {{ .Values.metrics.port | default 9090 }}
+    {{- /*
+      The metrics port comes from server.metricsPort, the same value the
+      deployment passes to --metrics-port. This block previously read a
+      .Values.metrics map that the chart does not define, so enabling the
+      policy at all failed to render with a nil pointer — the protection
+      could not be turned on.
+    */}}
+    {{- if .Values.server.metricsPort }}
+    - port: {{ .Values.server.metricsPort }}
       protocol: TCP
     {{- end }}
     {{- with .Values.networkPolicy.ingressFrom }}
     from:
       {{- toYaml . | nindent 4 }}
     {{- end }}
   egress:
+  {{- if eq (.Values.networkPolicy.egress | default "allowAll") "restricted" }}
+  {{- /*
+    Restricted egress. DNS comes first and is not optional: a pod that
+    cannot resolve names fails in ways that look nothing like a network
+    policy problem, and every other rule here is written against names.
+  */}}
+  - ports:
+    - port: 53
+      protocol: UDP
+    - port: 53
+      protocol: TCP
+  - ports:
+    # HTTPS: LLM providers, and any other outbound API the server calls.
+    - port: 443
+      protocol: TCP
+    # The Kubernetes API, for the watcher and the AIOps surface.
+    - port: {{ .Values.networkPolicy.kubernetesApiPort | default 6443 }}
+      protocol: TCP
+    {{- with .Values.networkPolicy.egressExtraPorts }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+  {{- else }}
   - {}  # Allow all egress (LLM API calls, DNS, etc.)
+  {{- end }}
 {{- end }}