This is an automated email from the ASF dual-hosted git repository.
adutra pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/polaris.git
The following commit(s) were added to refs/heads/main by this push:
new fbea493a35 fix(helm): add quarkus.http.cors.enabled=true when CORS is
configured (#3931)
fbea493a35 is described below
commit fbea493a350ea9ecb0afd671abe5fb98084619a4
Author: Dylan Decrulle <[email protected]>
AuthorDate: Thu Mar 5 14:27:28 2026 +0100
fix(helm): add quarkus.http.cors.enabled=true when CORS is configured
(#3931)
---
helm/polaris/templates/configmap.yaml | 37 ++++++++++++----------
helm/polaris/tests/configmap_test.yaml | 10 +++++-
helm/polaris/values.schema.json | 4 +++
helm/polaris/values.yaml | 3 ++
.../configuration/configuring-polaris.md | 1 +
.../in-dev/unreleased/helm-chart/reference.md | 1 +
6 files changed, 38 insertions(+), 18 deletions(-)
diff --git a/helm/polaris/templates/configmap.yaml
b/helm/polaris/templates/configmap.yaml
index c724e95948..27613c4418 100644
--- a/helm/polaris/templates/configmap.yaml
+++ b/helm/polaris/templates/configmap.yaml
@@ -114,23 +114,26 @@ data:
{{- $_ = set $map "quarkus.management.port" (get (first
.Values.managementService.ports) "port") -}}
{{- /* CORS */ -}}
- {{- if .Values.cors.allowedOrigins -}}
- {{- $_ = set $map "quarkus.http.cors.origins" (join ","
.Values.cors.allowedOrigins) -}}
- {{- end -}}
- {{- if .Values.cors.allowedMethods -}}
- {{- $_ = set $map "quarkus.http.cors.methods" (join ","
.Values.cors.allowedMethods) -}}
- {{- end -}}
- {{- if .Values.cors.allowedHeaders -}}
- {{- $_ = set $map "quarkus.http.cors.headers" (join ","
.Values.cors.allowedHeaders) -}}
- {{- end -}}
- {{- if .Values.cors.exposedHeaders -}}
- {{- $_ = set $map "quarkus.http.cors.exposed-headers" (join ","
.Values.cors.exposedHeaders) -}}
- {{- end -}}
- {{- if .Values.cors.accessControlMaxAge -}}
- {{- $_ = set $map "quarkus.http.cors.access-control-max-age"
.Values.cors.accessControlMaxAge -}}
- {{- end -}}
- {{- if ne .Values.cors.accessControlAllowCredentials nil -}}
- {{- $_ = set $map "quarkus.http.cors.access-control-allow-credentials"
.Values.cors.accessControlAllowCredentials -}}
+ {{- if .Values.cors.enabled -}}
+ {{- $_ = set $map "quarkus.http.cors.enabled" "true" -}}
+ {{- if .Values.cors.allowedOrigins -}}
+ {{- $_ = set $map "quarkus.http.cors.origins" (join ","
.Values.cors.allowedOrigins) -}}
+ {{- end -}}
+ {{- if .Values.cors.allowedMethods -}}
+ {{- $_ = set $map "quarkus.http.cors.methods" (join ","
.Values.cors.allowedMethods) -}}
+ {{- end -}}
+ {{- if .Values.cors.allowedHeaders -}}
+ {{- $_ = set $map "quarkus.http.cors.headers" (join ","
.Values.cors.allowedHeaders) -}}
+ {{- end -}}
+ {{- if .Values.cors.exposedHeaders -}}
+ {{- $_ = set $map "quarkus.http.cors.exposed-headers" (join ","
.Values.cors.exposedHeaders) -}}
+ {{- end -}}
+ {{- if .Values.cors.accessControlMaxAge -}}
+ {{- $_ = set $map "quarkus.http.cors.access-control-max-age"
.Values.cors.accessControlMaxAge -}}
+ {{- end -}}
+ {{- if ne .Values.cors.accessControlAllowCredentials nil -}}
+ {{- $_ = set $map "quarkus.http.cors.access-control-allow-credentials"
.Values.cors.accessControlAllowCredentials -}}
+ {{- end -}}
{{- end -}}
{{- /* Logging */ -}}
diff --git a/helm/polaris/tests/configmap_test.yaml
b/helm/polaris/tests/configmap_test.yaml
index 30c06f1db6..40417eea6a 100644
--- a/helm/polaris/tests/configmap_test.yaml
+++ b/helm/polaris/tests/configmap_test.yaml
@@ -370,10 +370,18 @@ tests:
- matchRegex: { path: 'data["application.properties"]', pattern:
"quarkus.http.cors" }
not: true
+ - it: should not include any CORS properties when cors.enabled is false
+ set:
+ cors: { enabled: false, allowedOrigins: [ "http://localhost:3000"; ],
allowedMethods: [ "GET" ], allowedHeaders: [ "X-Custom" ], exposedHeaders: [
"X-Exposed" ], accessControlMaxAge: "PT1H", accessControlAllowCredentials: true
}
+ asserts:
+ - matchRegex: { path: 'data["application.properties"]', pattern:
"quarkus.http.cors" }
+ not: true
+
- it: should include CORS configuration if defined
set:
- cors: { allowedOrigins: [ "http://localhost:3000";,
"https://localhost:4000"; ], allowedMethods: [ "GET", "POST" ], allowedHeaders:
[ "X-Custom1", "X-Custom2" ], exposedHeaders: [ "X-Exposed-Custom1",
"X-Exposed-Custom2" ], accessControlMaxAge: "PT1H",
accessControlAllowCredentials: false }
+ cors: { enabled: true, allowedOrigins: [ "http://localhost:3000";,
"https://localhost:4000"; ], allowedMethods: [ "GET", "POST" ], allowedHeaders:
[ "X-Custom1", "X-Custom2" ], exposedHeaders: [ "X-Exposed-Custom1",
"X-Exposed-Custom2" ], accessControlMaxAge: "PT1H",
accessControlAllowCredentials: false }
asserts:
+ - matchRegex: { path: 'data["application.properties"]', pattern:
"quarkus.http.cors.enabled=true" }
- matchRegex: { path: 'data["application.properties"]', pattern:
"quarkus.http.cors.origins=http://localhost:3000,https://localhost:4000"; }
- matchRegex: { path: 'data["application.properties"]', pattern:
"quarkus.http.cors.methods=GET,POST" }
- matchRegex: { path: 'data["application.properties"]', pattern:
"quarkus.http.cors.headers=X-Custom1,X-Custom2" }
diff --git a/helm/polaris/values.schema.json b/helm/polaris/values.schema.json
index 9eed1a1549..c71a020922 100644
--- a/helm/polaris/values.schema.json
+++ b/helm/polaris/values.schema.json
@@ -173,6 +173,10 @@
"type": "string"
}
},
+ "enabled": {
+ "description": "Specifies whether the CORS filter should
be enabled. See [CORS](https://quarkus.io/guides/http-reference#cors-filter)
for details.",
+ "type": "boolean"
+ },
"exposedHeaders": {
"description": "HTTP headers exposed to the client, ex:
X-Custom, Content-Disposition. The default is an empty list.",
"type": "array",
diff --git a/helm/polaris/values.yaml b/helm/polaris/values.yaml
index 4dfefcc18f..a64e5aaea2 100644
--- a/helm/polaris/values.yaml
+++ b/helm/polaris/values.yaml
@@ -1072,6 +1072,9 @@ oidc:
# Polaris CORS configuration.
cors:
+ # -- Specifies whether the CORS filter should be enabled. See
[CORS](https://quarkus.io/guides/http-reference#cors-filter) for details.
+ # @section -- CORS
+ enabled: false
# @schema item: string
# -- Origins allowed for CORS, e.g. http://polaris.apache.org,
http://localhost:8181. In case an entry of the list is surrounded by forward
slashes, it is interpreted as a regular expression.
# @section -- CORS
diff --git
a/site/content/in-dev/unreleased/configuration/configuring-polaris.md
b/site/content/in-dev/unreleased/configuration/configuring-polaris.md
index 1053d2bde9..e1adc33b32 100644
--- a/site/content/in-dev/unreleased/configuration/configuring-polaris.md
+++ b/site/content/in-dev/unreleased/configuration/configuring-polaris.md
@@ -95,6 +95,7 @@ Please refer to the [Quarkus
documentation](https://quarkus.io/guides/) for more
| `quarkus.http.port` | `8181`
| Define the HTTP port number.
|
| `quarkus.http.auth.basic` | `false`
| Enable the HTTP basic authentication.
|
| `quarkus.http.limits.max-body-size` | `10240K`
| Define the HTTP max body size limit.
|
+| `quarkus.http.cors.enabled` | `false`
| Enable the HTTP CORS filter. Must be set to `true` for any other
CORS property to take effect. |
| `quarkus.http.cors.origins` |
| Define the HTTP CORS origins.
|
| `quarkus.http.cors.methods` | `PATCH, POST, DELETE,
GET, PUT` | Define the HTTP CORS covered methods.
|
| `quarkus.http.cors.headers` | `*`
| Define the HTTP CORS covered headers.
|
diff --git a/site/content/in-dev/unreleased/helm-chart/reference.md
b/site/content/in-dev/unreleased/helm-chart/reference.md
index 6c9ea58ba5..eff81d07aa 100644
--- a/site/content/in-dev/unreleased/helm-chart/reference.md
+++ b/site/content/in-dev/unreleased/helm-chart/reference.md
@@ -319,6 +319,7 @@ weight: 900
| Key | Type | Default | Description |
|-----|------|---------|-------------|
+| cors.enabled | bool | `false` | Specifies whether the CORS filter should be
enabled. See [CORS](https://quarkus.io/guides/http-reference#cors-filter) for
details. |
| cors.allowedOrigins | list | `[]` | Origins allowed for CORS, e.g.
http://polaris.apache.org, http://localhost:8181. In case an entry of the list
is surrounded by forward slashes, it is interpreted as a regular expression. |
| cors.allowedMethods | list | `[]` | HTTP methods allowed for CORS, ex: GET,
PUT, POST. If this is not set or empty, all requested methods are considered
allowed. |
| cors.allowedHeaders | list | `[]` | HTTP headers allowed for CORS, ex:
X-Custom, Content-Disposition. If this is not set or empty, all requested
headers are considered allowed. |
