From f6b7717517dc7b9b63b16ed22b6dcc6d75a7d75e Mon Sep 17 00:00:00 2001
From: Daniel Hougaard <daniel@infisical.com>
Date: Thu, 29 May 2025 16:39:47 +0400
Subject: [PATCH 1/2] fix: allow https on gateway k8s hosts

---
 .../server/routes/v1/identity-kubernetes-auth-router.ts  | 2 ++
 .../identity-kubernetes-auth-service.ts                  | 9 ++++++++-
 2 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/backend/src/server/routes/v1/identity-kubernetes-auth-router.ts b/backend/src/server/routes/v1/identity-kubernetes-auth-router.ts
index d9ef62087..80aa0960e 100644
--- a/backend/src/server/routes/v1/identity-kubernetes-auth-router.ts
+++ b/backend/src/server/routes/v1/identity-kubernetes-auth-router.ts
@@ -104,6 +104,7 @@ export const registerIdentityKubernetesRouter = async (server: FastifyZodProvide
         .object({
           kubernetesHost: z
             .string()
+            .url()
             .trim()
             .min(1)
             .describe(KUBERNETES_AUTH.ATTACH.kubernetesHost)
@@ -223,6 +224,7 @@ export const registerIdentityKubernetesRouter = async (server: FastifyZodProvide
         .object({
           kubernetesHost: z
             .string()
+            .url()
             .trim()
             .min(1)
             .optional()
diff --git a/backend/src/services/identity-kubernetes-auth/identity-kubernetes-auth-service.ts b/backend/src/services/identity-kubernetes-auth/identity-kubernetes-auth-service.ts
index a3ec1bdeb..d0af70ca2 100644
--- a/backend/src/services/identity-kubernetes-auth/identity-kubernetes-auth-service.ts
+++ b/backend/src/services/identity-kubernetes-auth/identity-kubernetes-auth-service.ts
@@ -2,6 +2,7 @@ import { ForbiddenError } from "@casl/ability";
 import axios, { AxiosError } from "axios";
 import https from "https";
 import jwt from "jsonwebtoken";
+import RE2 from "re2";
 
 import { IdentityAuthMethod, TIdentityKubernetesAuthsUpdate } from "@app/db/schemas";
 import { TGatewayDALFactory } from "@app/ee/services/gateway/gateway-dal";
@@ -185,7 +186,13 @@ export const identityKubernetesAuthServiceFactory = ({
       return res.data;
     };
 
-    const [k8sHost, k8sPort] = identityKubernetesAuth.kubernetesHost.split(":");
+    let { kubernetesHost } = identityKubernetesAuth;
+
+    if (kubernetesHost.startsWith("https://") || kubernetesHost.startsWith("http://")) {
+      kubernetesHost = kubernetesHost.replace(new RE2("^https?:\\/\\/"), "");
+    }
+
+    const [k8sHost, k8sPort] = kubernetesHost.split(":") ?? [];
 
     const data = identityKubernetesAuth.gatewayId
       ? await $gatewayProxyWrapper(

From 78c4a591a9afeb423986037022f46f317ed066bc Mon Sep 17 00:00:00 2001
From: Daniel Hougaard <daniel@infisical.com>
Date: Thu, 29 May 2025 16:57:22 +0400
Subject: [PATCH 2/2] requested changes

---
 .../src/server/routes/v1/identity-kubernetes-auth-router.ts   | 2 --
 .../identity-kubernetes-auth-service.ts                       | 4 ++--
 2 files changed, 2 insertions(+), 4 deletions(-)

diff --git a/backend/src/server/routes/v1/identity-kubernetes-auth-router.ts b/backend/src/server/routes/v1/identity-kubernetes-auth-router.ts
index 80aa0960e..d9ef62087 100644
--- a/backend/src/server/routes/v1/identity-kubernetes-auth-router.ts
+++ b/backend/src/server/routes/v1/identity-kubernetes-auth-router.ts
@@ -104,7 +104,6 @@ export const registerIdentityKubernetesRouter = async (server: FastifyZodProvide
         .object({
           kubernetesHost: z
             .string()
-            .url()
             .trim()
             .min(1)
             .describe(KUBERNETES_AUTH.ATTACH.kubernetesHost)
@@ -224,7 +223,6 @@ export const registerIdentityKubernetesRouter = async (server: FastifyZodProvide
         .object({
           kubernetesHost: z
             .string()
-            .url()
             .trim()
             .min(1)
             .optional()
diff --git a/backend/src/services/identity-kubernetes-auth/identity-kubernetes-auth-service.ts b/backend/src/services/identity-kubernetes-auth/identity-kubernetes-auth-service.ts
index d0af70ca2..3314d8cab 100644
--- a/backend/src/services/identity-kubernetes-auth/identity-kubernetes-auth-service.ts
+++ b/backend/src/services/identity-kubernetes-auth/identity-kubernetes-auth-service.ts
@@ -189,10 +189,10 @@ export const identityKubernetesAuthServiceFactory = ({
     let { kubernetesHost } = identityKubernetesAuth;
 
     if (kubernetesHost.startsWith("https://") || kubernetesHost.startsWith("http://")) {
-      kubernetesHost = kubernetesHost.replace(new RE2("^https?:\\/\\/"), "");
+      kubernetesHost = new RE2("^https?:\\/\\/").replace(kubernetesHost, "");
     }
 
-    const [k8sHost, k8sPort] = kubernetesHost.split(":") ?? [];
+    const [k8sHost, k8sPort] = kubernetesHost.split(":");
 
     const data = identityKubernetesAuth.gatewayId
       ? await $gatewayProxyWrapper(