Skip to content

refactor: streamline OAuth configuration in templates by using defaul…#174

Merged
avaya09 merged 3 commits intomainfrom
fix/oauth-secret
Mar 26, 2026
Merged

refactor: streamline OAuth configuration in templates by using defaul…#174
avaya09 merged 3 commits intomainfrom
fix/oauth-secret

Conversation

@avaya09
Copy link
Copy Markdown
Contributor

@avaya09 avaya09 commented Mar 26, 2026

…t values for secrets

Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR refactors the Helm chart’s OAuth/SSO configuration templating to reduce conditional blocks by always rendering OAuth-related Secret keys (with defaults) and always wiring the corresponding environment variables when OAuth is enabled.

Changes:

  • Render OAuth secret data keys unconditionally (within config.oauth.enabled) using default "" fallbacks.
  • Render OAuth-related environment variables unconditionally (within config.oauth.enabled) by always referencing the Secret keys.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File Description
charts/portkey-app/templates/secrets.yaml Always emits OAuth-related Secret data entries (defaulting to empty) when OAuth is enabled.
charts/portkey-app/templates/_helpers.tpl Always injects OAuth/SSO env vars when OAuth is enabled, removing per-field conditional blocks.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment on lines 252 to 284
{{- if .Values.config.oauth.enabled }}
- name: AUTH_MODE
value: "SSO"
{{- if .Values.config.oauth.oauthType }}
- name: AUTH_SSO_TYPE
valueFrom:
secretKeyRef:
name: {{ include "portkey.secretsName" . }}
key: oauthType
{{- end }}
{{- if .Values.config.oauth.oauthIssuerUrl }}
- name: OIDC_ISSUER
valueFrom:
secretKeyRef:
name: {{ include "portkey.secretsName" . }}
key: oauthIssuerUrl
{{- end }}
{{- if .Values.config.oauth.oauthClientId }}
- name: OIDC_CLIENTID
valueFrom:
secretKeyRef:
name: {{ include "portkey.secretsName" . }}
key: oauthClientId
{{- end }}
{{- if .Values.config.oauth.oauthClientSecret }}
- name: OIDC_CLIENT_SECRET
valueFrom:
secretKeyRef:
name: {{ include "portkey.secretsName" . }}
key: oauthClientSecret
{{- end }}
{{- if .Values.config.oauth.oauthRedirectURI }}
- name: OIDC_REDIRECT_URI
valueFrom:
secretKeyRef:
name: {{ include "portkey.secretsName" . }}
key: oauthRedirectURI
{{- end }}
{{- if .Values.config.oauth.oauthMetadataXml }}
- name: SAML_METADATA_XML
valueFrom:
secretKeyRef:
name: {{ include "portkey.secretsName" . }}
key: oauthMetadataXml
Copy link

Copilot AI Mar 26, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

OAuth env vars are now always injected whenever config.oauth.enabled is true. This is a breaking behavior change for installs using config.existingSecretName: the referenced Secret must now contain all keys (oauthType, oauthIssuerUrl, oauthClientId, oauthClientSecret, oauthRedirectURI, oauthMetadataXml) or pods will fail with CreateContainerConfigError due to missing secret keys. Consider adding optional: true on these secretKeyRefs or restoring per-field conditionals (or gating OIDC vs SAML keys by oauthType) to preserve backwards compatibility.

Copilot uses AI. Check for mistakes.
Comment thread charts/portkey-app/templates/secrets.yaml Outdated
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.


💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment on lines 252 to +266
{{- if .Values.config.oauth.enabled }}
- name: AUTH_MODE
value: "SSO"
{{- if .Values.config.oauth.oauthType }}
- name: AUTH_SSO_TYPE
valueFrom:
secretKeyRef:
name: {{ include "portkey.secretsName" . }}
key: oauthType
{{- end }}
{{- if .Values.config.oauth.oauthIssuerUrl }}
optional: true
- name: OIDC_ISSUER
valueFrom:
secretKeyRef:
name: {{ include "portkey.secretsName" . }}
key: oauthIssuerUrl
{{- end }}
{{- if .Values.config.oauth.oauthClientId }}
optional: true
Copy link

Copilot AI Mar 26, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

All SSO env vars are now sourced from secret keys marked optional: true. This allows pods to start even if the referenced key is missing, which can silently deploy an unusable SSO setup (docs show oauthType/issuer/client details are required when SSO is enabled). Consider making optional conditional (e.g., only true when config.existingSecretName is set), and/or using Helm validation (fail/required) to enforce required values when the chart is managing the Secret.

Copilot uses AI. Check for mistakes.
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 1 comment.


💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment on lines 258 to 262
name: {{ include "portkey.secretsName" . }}
key: oauthType
{{- end }}
{{- if .Values.config.oauth.oauthIssuerUrl }}
optional: true
- name: OIDC_ISSUER
valueFrom:
Copy link

Copilot AI Mar 26, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Setting optional: true on these OAuth secretKeyRefs means the pod will start even when the referenced key is missing from an existingSecretName secret. Previously, if a user set the corresponding .Values.config.oauth.* value (thereby indicating the key should exist), Kubernetes would fail fast when the key was absent. Consider making optional conditional (e.g., only true when the matching .Values.config.oauth.* value is empty) so misconfigurations are still caught early while still allowing configs that are provided solely via an existing Secret.

Copilot uses AI. Check for mistakes.
@avaya09 avaya09 merged commit ad781d9 into main Mar 26, 2026
4 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants