Enable cors for numaflow api (#1631)

Signed-off-by: Ali Ibrahim <[email protected]> Signed-off-by: veds-g <[email protected]> Co-authored-by: Ali Ibrahim <[email protected]> Co-authored-by: veds-g <[email protected]>
numaproj · Apr 12, 2024 · 268b00d · 268b00d
1 parent 84b47ed
commit 268b00d
Show file tree

Hide file tree

Showing 10 changed files with 130 additions and 69 deletions.
diff --git a/cmd/commands/server.go b/cmd/commands/server.go
@@ -30,14 +30,15 @@ import (
 
 func NewServerCommand() *cobra.Command {
 	var (
-		insecure         bool
-		port             int
-		namespaced       bool
-		managedNamespace string
-		baseHref         string
-		readOnly         bool
-		disableAuth      bool
-		serverAddr       string
+		insecure           bool
+		port               int
+		namespaced         bool
+		managedNamespace   string
+		baseHref           string
+		disableAuth        bool
+		serverAddr         string
+		corsAllowedOrigins string
+		readOnly           bool
 	)
 
 	command := &cobra.Command{
@@ -51,15 +52,16 @@ func NewServerCommand() *cobra.Command {
 				baseHref = baseHref + "/"
 			}
 			opts := svrcmd.ServerOptions{
-				Insecure:         insecure,
-				Port:             port,
-				Namespaced:       namespaced,
-				ManagedNamespace: managedNamespace,
-				BaseHref:         baseHref,
-				ReadOnly:         readOnly,
-				DisableAuth:      disableAuth,
-				DexServerAddr:    common.NumaflowDexServerAddr,
-				ServerAddr:       serverAddr,
+				Insecure:           insecure,
+				Port:               port,
+				Namespaced:         namespaced,
+				ManagedNamespace:   managedNamespace,
+				BaseHref:           baseHref,
+				DisableAuth:        disableAuth,
+				DexServerAddr:      common.NumaflowDexServerAddr,
+				ServerAddr:         serverAddr,
+				CorsAllowedOrigins: corsAllowedOrigins,
+				ReadOnly:           readOnly,
 			}
 			server := svrcmd.NewServer(opts)
 			log := logging.NewLogger().Named("server")
@@ -74,5 +76,6 @@ func NewServerCommand() *cobra.Command {
 	command.Flags().BoolVar(&readOnly, "readonly", sharedutil.LookupEnvBoolOr("NUMAFLOW_SERVER_READONLY", false), "Whether to enable read only view for the UX server, defaults to false.")
 	command.Flags().BoolVar(&disableAuth, "disable-auth", sharedutil.LookupEnvBoolOr("NUMAFLOW_SERVER_DISABLE_AUTH", false), "Whether to disable authentication and authorization, defaults to false.")
 	command.Flags().StringVar(&serverAddr, "server-addr", sharedutil.LookupEnvStringOr("NUMAFLOW_SERVER_ADDRESS", "https://localhost:8443"), "The external address of the Numaflow server.")
+	command.Flags().StringVar(&corsAllowedOrigins, "cors-allowed-origins", sharedutil.LookupEnvStringOr("NUMAFLOW_SERVER_CORS_ALLOWED_ORIGINS", ""), "The values for allowed cors AllowOrigins header field, separated by comma.")
 	return command
 }
diff --git a/config/advanced-install/namespaced-numaflow-server.yaml b/config/advanced-install/namespaced-numaflow-server.yaml
@@ -253,6 +253,12 @@ spec:
               key: server.address
               name: numaflow-cmd-params-config
               optional: true
+        - name: NUMAFLOW_SERVER_CORS_ALLOWED_ORIGINS
+          valueFrom:
+            configMapKeyRef:
+              key: server.cors.allowed.origins
+              name: numaflow-cmd-params-config
+              optional: true
         image: quay.io/numaproj/numaflow:latest
         imagePullPolicy: Always
         livenessProbe:

diff --git a/config/advanced-install/numaflow-server.yaml b/config/advanced-install/numaflow-server.yaml
@@ -264,6 +264,12 @@ spec:
               key: server.address
               name: numaflow-cmd-params-config
               optional: true
+        - name: NUMAFLOW_SERVER_CORS_ALLOWED_ORIGINS
+          valueFrom:
+            configMapKeyRef:
+              key: server.cors.allowed.origins
+              name: numaflow-cmd-params-config
+              optional: true
         image: quay.io/numaproj/numaflow:latest
         imagePullPolicy: Always
         livenessProbe:

diff --git a/config/base/numaflow-server/numaflow-server-deployment.yaml b/config/base/numaflow-server/numaflow-server-deployment.yaml
@@ -126,6 +126,12 @@ spec:
                 name: numaflow-cmd-params-config
                 key: server.address
                 optional: true
+          - name: NUMAFLOW_SERVER_CORS_ALLOWED_ORIGINS
+            valueFrom:
+              configMapKeyRef:
+                name: numaflow-cmd-params-config
+                key: server.cors.allowed.origins
+                optional: true
           resources:
             limits:
               cpu: 500m

diff --git a/config/base/shared-config/numaflow-cmd-params-config.yaml b/config/base/shared-config/numaflow-cmd-params-config.yaml
@@ -44,3 +44,7 @@ data:
   #
   ### The external address of the Numaflow server. This is needed when using Dex for authentication.
   # server.address: https://localhost:8443
+  #
+  ### The list of allowed origins for CORS on Numaflow server, separated by a comma, defaults to ''.
+  #   For example: server.cors.allowed.origins: "http://localhost:3000,http://localhost:3001"
+  #  server.cors.allowed.origins: ""
diff --git a/config/install.yaml b/config/install.yaml
@@ -17606,6 +17606,12 @@ spec:
               key: server.address
               name: numaflow-cmd-params-config
               optional: true
+        - name: NUMAFLOW_SERVER_CORS_ALLOWED_ORIGINS
+          valueFrom:
+            configMapKeyRef:
+              key: server.cors.allowed.origins
+              name: numaflow-cmd-params-config
+              optional: true
         image: quay.io/numaproj/numaflow:latest
         imagePullPolicy: Always
         livenessProbe:

diff --git a/config/namespace-install.yaml b/config/namespace-install.yaml
@@ -17498,6 +17498,12 @@ spec:
               key: server.address
               name: numaflow-cmd-params-config
               optional: true
+        - name: NUMAFLOW_SERVER_CORS_ALLOWED_ORIGINS
+          valueFrom:
+            configMapKeyRef:
+              key: server.cors.allowed.origins
+              name: numaflow-cmd-params-config
+              optional: true
         image: quay.io/numaproj/numaflow:latest
         imagePullPolicy: Always
         livenessProbe:

diff --git a/go.mod b/go.mod
@@ -12,6 +12,7 @@ require (
 	github.com/coreos/go-oidc/v3 v3.6.0
 	github.com/fsnotify/fsnotify v1.7.0
 	github.com/gavv/httpexpect/v2 v2.16.0
+	github.com/gin-contrib/cors v1.7.1
 	github.com/gin-contrib/static v0.0.2-0.20220606235426-ae09b2ea7e39
 	github.com/gin-gonic/gin v1.9.1
 	github.com/go-openapi/inflect v0.19.0
@@ -39,14 +40,14 @@ require (
 	github.com/spaolacci/murmur3 v0.0.0-20180118202830-f09979ecbc72
 	github.com/spf13/cobra v1.7.0
 	github.com/spf13/viper v1.9.0
-	github.com/stretchr/testify v1.8.4
+	github.com/stretchr/testify v1.9.0
 	github.com/xdg-go/scram v1.1.2
 	go.uber.org/atomic v1.11.0
 	go.uber.org/goleak v1.3.0
 	go.uber.org/multierr v1.11.0
 	go.uber.org/zap v1.26.0
-	golang.org/x/crypto v0.19.0
-	golang.org/x/net v0.21.0
+	golang.org/x/crypto v0.21.0
+	golang.org/x/net v0.22.0
 	golang.org/x/oauth2 v0.12.0
 	golang.org/x/sync v0.6.0
 	google.golang.org/genproto/googleapis/api v0.0.0-20230726155614-23370e0ffb3e
@@ -74,9 +75,10 @@ require (
 	github.com/andybalholm/brotli v1.0.4 // indirect
 	github.com/asaskevich/govalidator v0.0.0-20210307081110-f21760c49a8d // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
-	github.com/bytedance/sonic v1.9.1 // indirect
+	github.com/bytedance/sonic v1.11.3 // indirect
 	github.com/cespare/xxhash/v2 v2.2.0 // indirect
-	github.com/chenzhuoyu/base64x v0.0.0-20221115062448-fe3a3abad311 // indirect
+	github.com/chenzhuoyu/base64x v0.0.0-20230717121745-296ad89f973d // indirect
+	github.com/chenzhuoyu/iasm v0.9.1 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f // indirect
 	github.com/eapache/go-resiliency v1.6.0 // indirect
@@ -88,7 +90,7 @@ require (
 	github.com/fatih/color v1.15.0 // indirect
 	github.com/fatih/structs v1.1.0 // indirect
 	github.com/felixge/httpsnoop v1.0.3 // indirect
-	github.com/gabriel-vasile/mimetype v1.4.2 // indirect
+	github.com/gabriel-vasile/mimetype v1.4.3 // indirect
 	github.com/ghodss/yaml v1.0.0 // indirect
 	github.com/gin-contrib/sse v0.1.0 // indirect
 	github.com/go-jose/go-jose/v3 v3.0.3 // indirect
@@ -105,7 +107,7 @@ require (
 	github.com/go-openapi/validate v0.20.3 // indirect
 	github.com/go-playground/locales v0.14.1 // indirect
 	github.com/go-playground/universal-translator v0.18.1 // indirect
-	github.com/go-playground/validator/v10 v10.14.0 // indirect
+	github.com/go-playground/validator/v10 v10.19.0 // indirect
 	github.com/go-stack/stack v1.8.1 // indirect
 	github.com/gobuffalo/flect v0.2.3 // indirect
 	github.com/gobwas/glob v0.2.3 // indirect
@@ -134,14 +136,14 @@ require (
 	github.com/josharian/intern v1.0.0 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
 	github.com/klauspost/compress v1.17.7 // indirect
-	github.com/klauspost/cpuid/v2 v2.2.4 // indirect
+	github.com/klauspost/cpuid/v2 v2.2.7 // indirect
 	github.com/kr/pretty v0.3.1 // indirect
 	github.com/kr/text v0.2.0 // indirect
-	github.com/leodido/go-urn v1.2.4 // indirect
+	github.com/leodido/go-urn v1.4.0 // indirect
 	github.com/magiconair/properties v1.8.5 // indirect
 	github.com/mailru/easyjson v0.7.7 // indirect
 	github.com/mattn/go-colorable v0.1.13 // indirect
-	github.com/mattn/go-isatty v0.0.19 // indirect
+	github.com/mattn/go-isatty v0.0.20 // indirect
 	github.com/matttproud/golang_protobuf_extensions/v2 v2.0.0 // indirect
 	github.com/minio/highwayhash v1.0.2 // indirect
 	github.com/mitchellh/copystructure v1.0.0 // indirect
@@ -158,7 +160,7 @@ require (
 	github.com/nats-io/nuid v1.0.1 // indirect
 	github.com/oklog/ulid v1.3.1 // indirect
 	github.com/pelletier/go-toml v1.9.4 // indirect
-	github.com/pelletier/go-toml/v2 v2.0.8 // indirect
+	github.com/pelletier/go-toml/v2 v2.2.0 // indirect
 	github.com/pierrec/lz4/v4 v4.1.21 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
@@ -180,7 +182,7 @@ require (
 	github.com/tidwall/pretty v1.2.0 // indirect
 	github.com/toqueteos/webbrowser v1.2.0 // indirect
 	github.com/twitchyliquid64/golang-asm v0.15.1 // indirect
-	github.com/ugorji/go/codec v1.2.11 // indirect
+	github.com/ugorji/go/codec v1.2.12 // indirect
 	github.com/valyala/bytebufferpool v1.0.0 // indirect
 	github.com/valyala/fasthttp v1.37.0 // indirect
 	github.com/xdg-go/pbkdf2 v1.0.0 // indirect
@@ -192,11 +194,11 @@ require (
 	github.com/yudai/gojsondiff v1.0.0 // indirect
 	github.com/yudai/golcs v0.0.0-20170316035057-ecda9a501e82 // indirect
 	go.mongodb.org/mongo-driver v1.7.3 // indirect
-	golang.org/x/arch v0.3.0 // indirect
+	golang.org/x/arch v0.7.0 // indirect
 	golang.org/x/exp v0.0.0-20220722155223-a9213eeb770e // indirect
 	golang.org/x/mod v0.14.0 // indirect
-	golang.org/x/sys v0.17.0 // indirect
-	golang.org/x/term v0.17.0 // indirect
+	golang.org/x/sys v0.18.0 // indirect
+	golang.org/x/term v0.18.0 // indirect
 	golang.org/x/text v0.14.0 // indirect
 	golang.org/x/time v0.3.0 // indirect
 	golang.org/x/tools v0.16.1 // indirect