security: same-origin console CORS, fail-closed helm creds, deny.toml, sample-config hardening (#2769)

Signed-off-by: Michael Graff <explorer@flame.org>
Signed-off-by: 安正超 <anzhengchao@gmail.com>
Co-authored-by: 安正超 <anzhengchao@gmail.com>
Co-authored-by: loverustfs <hello@rustfs.com>

helm/rustfs/values.yaml

@@ -48,9 +48,17 @@ mode:
 
 secret:
   existingSecret: ""
+  # SECURITY: rendering fails by default unless one of the following is true:
+  #   1. `secret.existingSecret` names a Kubernetes Secret you control, or
+  #   2. `secret.rustfs.access_key` and `secret.rustfs.secret_key` are both
+  #      set to non-empty, non-default values, or
+  #   3. `secret.allowInsecureDefaults: true` is set (only for local dev).
+  # This prevents accidental deployment with the well-known default
+  # `rustfsadmin/rustfsadmin` credentials.
+  allowInsecureDefaults: false
   rustfs:
-    access_key: rustfsadmin
-    secret_key: rustfsadmin
+    access_key: ""
+    secret_key: ""
 
 config:
   rustfs: