From bb0410dd2ee91ad2e68dcc420334edceaa396e92 Mon Sep 17 00:00:00 2001 From: Mike Vincent Date: Sat, 11 Jul 2026 10:48:06 -0700 Subject: [PATCH 1/2] security: enforce BROWSERSTATION_API_KEY on the gateway (head env from k8s secret) The gateway (uvicorn app.main:app on ray-head) reads BROWSERSTATION_API_KEY and enforces X-API-Key on /browsers* when set, but the deploy never injected it, so the endpoint was open (health 200 with any key). Inject it from the browserstation-auth k8s secret so POST/GET/DELETE /browsers require the key. Verified: no-key -> 401, with-key -> browser created; driver connects over CDP. --- rayservice.yaml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/rayservice.yaml b/rayservice.yaml index 1dd70e4..a848458 100644 --- a/rayservice.yaml +++ b/rayservice.yaml @@ -18,6 +18,11 @@ spec: env: - name: RAY_memory_usage_threshold value: "0.95" + - name: BROWSERSTATION_API_KEY + valueFrom: + secretKeyRef: + name: browserstation-auth + key: BROWSERSTATION_API_KEY ports: - containerPort: 8050 name: http From 1870cd8b01a0ee72378fe87b1c4461089a718133 Mon Sep 17 00:00:00 2001 From: Mike Vincent Date: Mon, 13 Jul 2026 09:09:04 -0700 Subject: [PATCH 2/2] Create BrowserStation auth secret in quickstart --- scripts/quickstart.sh | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/scripts/quickstart.sh b/scripts/quickstart.sh index 5cac386..edc55e0 100755 --- a/scripts/quickstart.sh +++ b/scripts/quickstart.sh @@ -23,6 +23,13 @@ helm repo update helm upgrade --install kuberay-operator kuberay/kuberay-operator \ --namespace ray-system --create-namespace --version 1.3.0 --wait +if [[ $API_KEY ]]; then + kubectl create secret generic browserstation-auth \ + --from-literal=BROWSERSTATION_API_KEY="$API_KEY" \ + --namespace ray-system \ + --dry-run=client -o yaml | kubectl apply -f - +fi + DOCKERFILE=$( [[ $ARCH == arm64 && -f Dockerfile.arm ]] && echo Dockerfile.arm \ || echo Dockerfile.$ARCH