WPB-9495: nginz: add allowlisted_fqdn_origins override (#4087)

* add allowlisted_fqdn_origins override
* this is required to get CORS to work with additional developer domains
* included a test to prevent usage of allowlisted_fqdn_origins in non-staging environments

related to WPB-9495

changelog.d/5-internal/WPB-9495

@@ -0,0 +1 @@
+nginz: Added `allowlisted_fqdn_origins` to `nginx_conf` value

charts/nginz/templates/conf/_nginx.conf.tpl

@@ -146,7 +146,14 @@ http {
     {{ range $origin := .Values.nginx_conf.randomport_allowlisted_origins }}
       "~^https?://{{ $origin }}(:[0-9]{2,5})?$" "$http_origin";
     {{ end }}
-   }
+    {{/* Allow additional origin FQDNs, if present */}}
+    {{- range $origin := .Values.nginx_conf.allowlisted_fqdn_origins }}
+      "https://{{ $origin }}" "$http_origin";
+    {{- end }}
+    {{- if and .Values.nginx_conf.allowlisted_fqdn_origins (not (eq .Values.nginx_conf.env  "staging")) -}}
+    {{ fail "allowlisted_fqdn_origins is only cleared for usage in staging."}}
+    {{- end }}
+  }
 
 
   #

charts/nginz/values.yaml

@@ -78,6 +78,9 @@ nginx_conf:
     - webapp
     - teams
     - account
+  # Fully-qualified domain names from which to allow Cross-Origin Requests
+  # (they are **not** combined with 'external_env_domain')
+  allowlisted_fqdn_origins: []
 
   # The origins from which we allow CORS requests at random ports. This is
   # useful for testing with HTTP proxies and should not be used in production.