wxops-portal-0.1.1

Same portal (0.5.2) and same image as 0.1.0, ghcr.io/wxops-idp/wxops-portal:v0.5.2. The image now follows appVersion.

Changed

• appVersion is the exact image tag, v0.5.2, and the image is <image.repository>:<appVersion>. image.tag stays empty and only overrides it when set.
• The app.kubernetes.io/version label is v0.5.2 instead of 0.5.2, so pods roll once on upgrade. Everything else renders the same.

Added

• A workflow opens a pull request when the portal publishes a release, setting appVersion to a tag it has confirmed in the registry.

wxops-portal-0.1.0

First release in this repository. Moves the chart out of the wxops-portal repository so the latest portal is installable with helm repo add wxops https://charts.wxops.cloud. Deploys W'xOps Portal 0.5.2.

Added

• A plain chart with no common dependency: Deployment, Service, ServiceAccount and optional RBAC.
• Secrets from External Secrets Operator: an ExternalSecret reads OIDC_CLIENT_SECRET and SESSION_SECRET from one path in the store, with the property names configurable and any extra secret addable. existingSecret is the alternative.
• Exposure through a Traefik IngressRoute (plain HTTP by default, with entry points, middlewares and TLS) or a standard Ingress for ingress-nginx, Kong and other controllers.
• A ConfigMap for the static cluster registry, mounted at /etc/wxops/clusters.json.
• The chart fails to render, naming the value, when env.FRONTEND_URL, env.OIDC_ISSUER_URL, env.OIDC_CLIENT_ID, env.OIDC_REDIRECT_URI, the secret store or the ingress host is missing.

Changed

• The image is ghcr.io/wxops-idp/wxops-portal with the tag v<appVersion>, which is what the portal publishes. The earlier chart pointed to ghcr.io/wxops/wxops-portal with an unprefixed tag.
• Values moved out of the portal: prefix, see the migration table in the chart README.

Fixed

• The portal no longer fails to start on a default install. The earlier chart set CLUSTERS_CONFIG_FILE to a file it never created, and the backend exits when that file is missing.

pinniped-0.1.1

Added

• Refine readme with couple new values and name of chart for easier pull and apply

dexidp-0.1.1

Aligns the dynamic config with what the W'xOps core side pushes to the secret store. Upgrade from 0.1.0 needs no
value changes. Dex 2.45.1, upstream dex chart 0.25.2.

Added

• dynamicConfig.deletionPolicy (default Merge). A scanned path with no secret is skipped, so connectors, clients
  and users are all optional.
• groups (users) and redirectURIs (clients) are accepted as a list or as a JSON-encoded string, and both produce
  the same Dex config.
• signer (local, RS256, 6h rotation) and enablePasswordDB: true in the default dynamicConfig.base.
• dexidp/tests/eso_template_test.py, which runs the ESO template with ESO's own engine settings, plus cases for
  every validation.

Changed

• An empty connectors, clients or users path no longer fails the sync with Secret does not exist.
• groups and redirectURIs must be lists of strings. A plain string, an object or a non-string entry fails the
  sync and names the secret.
• Invalid JSON in an entry is reported as invalid JSON, not as a missing field.

Fixed

• find returned the full path as the key (connector_dex/connectors/gitea), which ESO rejects. Only the secret
  name, the last path segment, is used now.
• A base without connectors, staticClients or staticPasswords failed under ESO's missingkey=error.

For core

• The name of a secret under dex/connectors, dex/clients and dex/users is its key, the path is not part of it.
• Push lists as JSON arrays or as JSON-encoded strings, both work.

pinniped-0.1.0

A Helm chart for Pinniped, a Kubernetes authentication via ImpersonationProxy with Supervisor and Concierge components.

dexidp-0.1.0

A thin wrapper around the upstream Dex chart that wires its configuration and secrets through External Secrets Operator.