ClusterGate v1.12.2

ClusterGate v1.12.2

Kubernetes Routing Gateway Platform — expose internal Kubernetes services over public domains.

⚠️ Breaking changes — read before upgrading

• Route targets on localhost, the Kubernetes API and ClusterGate's own database are now blocked by default. Loopback (localhost, 127.0.0.0/8, ::1, 0.0.0.0), kubernetes.default.svc… / KUBERNETES_SERVICE_HOST and the DATABASE_URL host are rejected when a route is saved and again by the proxy on every connection (HTTP and WebSocket). Existing routes pointing there stop working. Set TARGET_DENY_DEFAULTS=false to restore the old behavior; TARGET_DENY_EXTRA adds your own entries. System admins can additionally restrict an organization's routes to an allowlist of namespaces and hosts (off by default).
• Cookie-authenticated /api calls need a UI client token. The UI receives an X-CG-Client-Token at login and keeps it in memory only; on a hard reload it re-obtains it by redirecting through /api/auth/resume, so expect one quick redirect. Scripts that call /api with only the session cookie now get 401; use a bearer token instead (bearer-token clients are unaffected). API_CLIENT_TOKEN_REQUIRED=false turns the check off for debugging only.
• Swagger "Try it out" needs a bearer token. Authorize in Swagger UI with an API token; the browser session cookie alone is no longer accepted there.

Other security changes

• ClusterGate's own cg_* cookies (session, CSRF) are no longer forwarded to upstream services, and upstream responses can no longer set them.
• Apps under /r/ are isolated from the UI and API on the same host; the new per-route Sandbox Pages option serves untrusted apps from an opaque origin.

What's Changed

• chore(release): v1.12.2 with upgrade notes in the GitHub release (#37) (@No749ah)
• fix(security): keep one helmet config and test auth without an express app (@claude)
• feat(security): isolate apps under /r/ from the UI and API on the same host (@claude)
• feat(security): per-organization route target allowlists and global target denylist (@claude)
• fix(proxy): stop forwarding ClusterGate session cookies to upstreams (@claude)

Docker Images

# Backend
docker pull ghcr.io/No749ah/clustergate-backend:v1.12.2

# Frontend
docker pull ghcr.io/No749ah/clustergate-frontend:v1.12.2

Quick Start

git clone https://github.com/No749ah/ClusterGate.git
cd ClusterGate
cp .env.example .env
# Edit .env — set JWT_SECRET and POSTGRES_PASSWORD
docker compose up -d
docker compose exec backend npm run db:migrate

Frontend: http://localhost:3000
Backend API: http://localhost:3001

On first visit, the Setup Wizard will guide you through creating your admin account.

Kubernetes Deploy

helm upgrade --install clustergate ./helm/clustergate \
  --namespace clustergate \
  --create-namespace \
  --set ingress.host=clustergate.example.com \
  --set backend.secrets.jwtSecret=$(openssl rand -base64 64) \
  --set postgres.credentials.password=$(openssl rand -base64 32) \
  --wait