This is an automated email from the ASF dual-hosted git repository.
github-merge-queue[bot] pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/texera.git
The following commit(s) were added to refs/heads/main by this push:
new af6e0fdd96 fix(deploy): enable CORS on RustFS so browsers can fetch
presigned URLs (#8562)
af6e0fdd96 is described below
commit af6e0fdd96f44c1d575278b9fd12ed61ce6a8640
Author: Xuan Gu <[email protected]>
AuthorDate: Fri Sep 18 03:54:27 2026 +0000
fix(deploy): enable CORS on RustFS so browsers can fetch presigned URLs
(#8562)
### What changes were proposed in this PR?
Set `RUSTFS_CORS_ALLOWED_ORIGINS=*` on the rustfs service (single-node
compose, K8s chart via `extraEnv`, dev compose).
The dataset file preview fetches presigned URLs directly from the
browser, which is cross-origin. MinIO sent CORS headers by default;
RustFS sends none unless this variable is set (the old reflective
default was removed as CVE-2026-46685), so the preview shows a loading
state and does not render the content. Wildcard mode never allows
credentialed requests, and presigned requests carry no cookies, so this
restores MinIO's behavior without loosening anything; deployments that
want an allow-list can override it with their GUI origin.
### Any related issues, documentation, discussions?
Fixes #8557.
### How was this PR tested?
Tested on single-node deployment.
### Was this PR authored or co-authored using generative AI tooling?
Generated-by: Claude Fable 5 (Claude Code)
Co-authored-by: Claude Fable 5 <[email protected]>
---
bin/k8s/values.yaml | 3 +++
bin/single-node/docker-compose.yml | 1 +
file-service/src/main/resources/docker-compose.yml | 1 +
3 files changed, 5 insertions(+)
diff --git a/bin/k8s/values.yaml b/bin/k8s/values.yaml
index 8cd3a94d18..4f24269b39 100644
--- a/bin/k8s/values.yaml
+++ b/bin/k8s/values.yaml
@@ -111,6 +111,9 @@ rustfs:
rustfs:
access_key: texera_rustfs
secret_key: password
+ extraEnv:
+ - name: RUSTFS_CORS_ALLOWED_ORIGINS
+ value: "*"
config:
rustfs:
# Must match storage.s3.region: the region is part of the SigV4 scope.
diff --git a/bin/single-node/docker-compose.yml
b/bin/single-node/docker-compose.yml
index f604db653a..d09cbc09a3 100644
--- a/bin/single-node/docker-compose.yml
+++ b/bin/single-node/docker-compose.yml
@@ -29,6 +29,7 @@ services:
environment:
- RUSTFS_ACCESS_KEY=${STORAGE_S3_AUTH_USERNAME}
- RUSTFS_SECRET_KEY=${STORAGE_S3_AUTH_PASSWORD}
+ - RUSTFS_CORS_ALLOWED_ORIGINS=*
# Must match STORAGE_S3_REGION: the region is part of the SigV4 scope,
and
# LakeFS sends its blockstore region on every request.
- RUSTFS_REGION=${STORAGE_S3_REGION}
diff --git a/file-service/src/main/resources/docker-compose.yml
b/file-service/src/main/resources/docker-compose.yml
index 95088150b1..98cef98029 100644
--- a/file-service/src/main/resources/docker-compose.yml
+++ b/file-service/src/main/resources/docker-compose.yml
@@ -27,6 +27,7 @@ services:
environment:
- RUSTFS_ACCESS_KEY=texera_rustfs
- RUSTFS_SECRET_KEY=password
+ - RUSTFS_CORS_ALLOWED_ORIGINS=*
# Must match the region the AWS SDK signs with: it is part of the SigV4
scope.
- RUSTFS_REGION=us-west-2
- RUSTFS_CONSOLE_ENABLE=true
