From be8f6b473914e4a59709942c12cd475fb807f9ee Mon Sep 17 00:00:00 2001 From: Ivan Okhotnikov Date: Tue, 2 Jun 2026 21:05:15 +0300 Subject: [PATCH] fix(dashboard): set webOrigins to "+" and add --api-route for k8s API paths Two related issues caused the dashboard SPA to break with CORS errors after the kc-access cookie expired: 1. KeycloakClient for dashboard had no webOrigins set, so the operator never touched the field in Keycloak after initial creation. After any rootUrl change the existing webOrigins value became stale and blocked CORS from the SPA. Setting "+" tells Keycloak to derive allowed origins from redirectUris. 2. oauth2-proxy returned 302 -> Keycloak /auth for unauthenticated XHR/fetch on /api and /apis. The login page does not emit Access-Control-Allow-Origin, so the SPA's fetch failed with CORS. --api-route makes oauth2-proxy answer 401 without redirect, so the SPA can handle the re-auth itself via top-level navigation. Signed-off-by: Ivan Okhotnikov --- packages/system/dashboard/templates/gatekeeper.yaml | 2 ++ packages/system/dashboard/templates/keycloakclient.yaml | 2 ++ 2 files changed, 4 insertions(+) diff --git a/packages/system/dashboard/templates/gatekeeper.yaml b/packages/system/dashboard/templates/gatekeeper.yaml index 8d4b13f74..3aa6c5bef 100644 --- a/packages/system/dashboard/templates/gatekeeper.yaml +++ b/packages/system/dashboard/templates/gatekeeper.yaml @@ -68,6 +68,8 @@ spec: {{- end }} - --whitelist-domain=keycloak.{{ $host }} - --email-domain=* + - --api-route=^/api(/|$) + - --api-route=^/apis(/|$) - --pass-access-token=true - --pass-authorization-header=true - --cookie-refresh=3m diff --git a/packages/system/dashboard/templates/keycloakclient.yaml b/packages/system/dashboard/templates/keycloakclient.yaml index fa33fea4a..cd455af7f 100644 --- a/packages/system/dashboard/templates/keycloakclient.yaml +++ b/packages/system/dashboard/templates/keycloakclient.yaml @@ -64,6 +64,8 @@ spec: directAccess: true public: false webUrl: "https://dashboard.{{ $host }}" + webOrigins: + - "+" defaultClientScopes: - groups - kubernetes-client