feat: add scoped ssh client passthrough

2026-06-02 07:39:21 +00:00
parent 2a4f6d7791
commit 0c28961f9a
7 changed files with 116 additions and 7 deletions
@@ -238,6 +238,16 @@ spec:
                secretKeyRef:
                  name: unidesk-dev-runtime-secrets
                  key: PROVIDER_TOKEN
+            - name: UNIDESK_SSH_CLIENT_TOKEN
+              valueFrom:
+                secretKeyRef:
+                  name: unidesk-dev-runtime-secrets
+                  key: UNIDESK_SSH_CLIENT_TOKEN
+            - name: UNIDESK_SSH_CLIENT_ROUTE_ALLOWLIST
+              valueFrom:
+                configMapKeyRef:
+                  name: unidesk-dev-runtime-config
+                  key: UNIDESK_SSH_CLIENT_ROUTE_ALLOWLIST
            - name: SESSION_SECRET
              valueFrom:
                secretKeyRef:
@@ -64,6 +64,7 @@ stringData:
  POSTGRES_DB: unidesk_dev
  DATABASE_URL: postgres://unidesk_dev:change-me-dev-postgres-password@postgres-dev.unidesk-dev.svc.cluster.local:5432/unidesk_dev
  PROVIDER_TOKEN: change-me-D601-dev-provider-token
+  UNIDESK_SSH_CLIENT_TOKEN: change-me-dev-scoped-ssh-client-token
  AUTH_USERNAME: admin-dev
  AUTH_PASSWORD: change-me-dev-auth-password
  SESSION_SECRET: change-me-dev-session-secret-minimum-32-characters
@@ -88,6 +89,7 @@ data:
  UNIDESK_DEV_DATABASE_NAME: unidesk_dev
  UNIDESK_DEV_DATABASE_ALLOWED_HOSTS: postgres-dev,postgres-dev.unidesk-dev,postgres-dev.unidesk-dev.svc,postgres-dev.unidesk-dev.svc.cluster.local
  UNIDESK_DEV_DATABASE_FORBIDDEN_PATTERNS: d601-tcp-egress-gateway,database:5432/unidesk,74.48.78.17:15432
+  UNIDESK_SSH_CLIENT_ROUTE_ALLOWLIST: G14,G14:*,D601,D601:*
  DATABASE_VOLUME_NAME: postgres-dev-data
  DATABASE_VOLUME_SIZE: 5Gi
  HEARTBEAT_TIMEOUT_MS: "30000"