From 6134eb43ab0710ee2ab2647500039f888ab47fd5 Mon Sep 17 00:00:00 2001 From: Jason Morrow Date: Thu, 10 Sep 2026 09:38:23 -0400 Subject: [PATCH 1/2] DUNDER-252: add SSRF_ALLOWED_IP_RANGES as a helm chart value Self-hosted operators whose custom actions or custom integrations poll an internal endpoint need to allow-list it -- the app blocks private, loopback, link-local and cloud-metadata addresses by default. Until now the only way to set SSRF_ALLOWED_IP_RANGES was to patch the configmap by hand. The app parses the var as a comma-separated list of IPs/CIDRs (HttpClients::SsrfSafe.parse_allowed_ip_ranges), so the value takes a YAML list and joins it. It defaults to [], which renders the empty string the app already treats as "allow nothing" -- no behavior change when unset. The value sits at the opslevel level rather than under web, since the workers and scheduler make these outbound requests too; all six workloads pick it up via envFrom and carry a checksum/config annotation, so an upgrade rolls them. --- .changes/unreleased/Feature-20260910-093000.yaml | 5 +++++ charts/opslevel/templates/opslevel/configmap.yaml | 1 + charts/opslevel/values.yaml | 7 +++++++ 3 files changed, 13 insertions(+) create mode 100644 .changes/unreleased/Feature-20260910-093000.yaml diff --git a/.changes/unreleased/Feature-20260910-093000.yaml b/.changes/unreleased/Feature-20260910-093000.yaml new file mode 100644 index 0000000..1e30c53 --- /dev/null +++ b/.changes/unreleased/Feature-20260910-093000.yaml @@ -0,0 +1,5 @@ +kind: Feature +body: Add `opslevel.ssrfAllowedIpRanges` so self-hosted operators can allow-list internal + IPs/CIDRs that custom integrations and webhooks need to reach, rendered into + `SSRF_ALLOWED_IP_RANGES` +time: 2026-09-10T09:30:00.000000-04:00 diff --git a/charts/opslevel/templates/opslevel/configmap.yaml b/charts/opslevel/templates/opslevel/configmap.yaml index 307f4bf..cd28cff 100644 --- a/charts/opslevel/templates/opslevel/configmap.yaml +++ b/charts/opslevel/templates/opslevel/configmap.yaml @@ -51,6 +51,7 @@ data: SMTP_PORT: '{{ .Values.smtp.secret.port }}' SMTP_USERNAME: '{{ .Values.smtp.secret.username }}' SORBET_RUNTIME_DEFAULT_CHECKED_LEVEL: 'never' + SSRF_ALLOWED_IP_RANGES: '{{ join "," .Values.opslevel.ssrfAllowedIpRanges }}' THROTTLE_GRAPHQL_LIMIT: '250' THROTTLER_ENABLED: 'true' TRANSACTIONAL_OUTBOX_ENABLED: '{{ .Values.opssight.enabled }}' diff --git a/charts/opslevel/values.yaml b/charts/opslevel/values.yaml index 1da65fc..768c16e 100644 --- a/charts/opslevel/values.yaml +++ b/charts/opslevel/values.yaml @@ -37,6 +37,13 @@ opslevel: domain: "example.com" subdomain: "self-hosted" forceSSL: false + # Internal destinations the app is allowed to reach when making outbound requests + # on a user-supplied URL -- custom action webhooks, custom integration extractors. + # Private, loopback, link-local and cloud-metadata addresses are blocked by default; + # list an IP ("10.1.2.3") or CIDR range ("10.0.0.0/8") here to carve one back out. + # Rendered into SSRF_ALLOWED_IP_RANGES, which web, workers and the scheduler all + # read at startup -- changing it restarts them. + ssrfAllowedIpRanges: [] image: repository: "746108190720.dkr.ecr.us-east-1.amazonaws.com/opslevel" tag: "selfhosted-prod-8de7ca42-1786633441" From 64006422094170863f82a9598c8c2fdad3e488c8 Mon Sep 17 00:00:00 2001 From: Jason Morrow Date: Thu, 10 Sep 2026 09:41:04 -0400 Subject: [PATCH 2/2] ignore stray chart tarballs and the chart download dir A stale replicated-1.2.0.tgz from a manual `helm pull` has been sitting untracked in the repo root since March 2025, showing up in every `git status`. Anchored as /*.tgz rather than *.tgz on purpose: the subchart tarballs under charts/opslevel/charts/ are vendored and tracked, and a blanket pattern would hide future dependency bumps (which land under a new filename) from git status. Also ignores /downloads, which `task pull-self-hosted` untars into. --- .gitignore | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/.gitignore b/.gitignore index b31ff3b..3186971 100644 --- a/.gitignore +++ b/.gitignore @@ -3,3 +3,8 @@ .idea /manifests rendered +# Stray chart tarballs from a manual `helm pull` in the repo root. Anchored so the +# vendored subcharts under charts/*/charts/ stay tracked and visible in git status. +/*.tgz +# `task pull-self-hosted` untars the published chart here +/downloads