helm: add oauth2-proxy wrapper chart by danish9039 · Pull Request #3479 · kubeflow/community-distribution

danish9039 · 2026-05-25T13:04:09Z

Summary

Adds the oauth2-proxy Helm wrapper chart for the Project 5 platform-first Helm work under common/oauth2-proxy/helm, co-located with the Kustomize baseline under common/oauth2-proxy.

The chart is a Kustomize-parity wrapper for the current Kubeflow oauth2-proxy install. It follows common/oauth2-proxy and keeps the first slice focused on the current Kubeflow auth integration shape.

Supported comparison scenarios

base: common/oauth2-proxy/base
overlays-istio: common/oauth2-proxy/overlays/istio

The overlays/istio path is a thin alias to the existing Istio external-auth overlay used for parity comparison.

Scope update

Move the wrapper chart from experimental/helm/charts/oauth2-proxy to common/oauth2-proxy/helm.
Update YAML lint config so co-located Helm templates under common/*/helm/templates/** are not treated as raw YAML.
Add oauth2-proxy to tests/helm_kustomize_compare.sh with the co-located chart path and base / overlays-istio scenarios.
Address review comments by:
- wiring serviceAccountName: oauth2-proxy in both Kustomize and Helm output,
- keeping Helm CI fixture values aligned with the existing Kustomize fixture values for parity,
- requiring clusterJwksProxy.image when clusterJwksProxy.enabled=true,
- fixing Kustomize hash-suffix normalization for all-letter suffixes without stripping Helm literal names,
- fixing secretName normalization under volumes,
- scoping the source-aware normalization behavior to oauth2-proxy so existing component comparisons keep their prior behavior.

CI fixture note

The oauth2-proxy runtime requires a cookie secret length valid for AES. This PR restores the existing Kustomize fixture secret values and mirrors those same values in Helm CI values so the wrapper chart remains a parity implementation. Any broader cleanup of fixture-secret naming or semantics should be handled in a separate follow-up PR.

Follow-up

Sync script extension for appVersion and image tag updates will follow separately after the chart location change, so this PR stays focused on co-location and parity proof.

The OAUTH2_PROXY_SKIP_JWT_BEARER_TOKENS / ENABLE_M2M_TOKENS naming remains unchanged in this PR because the current Kustomize baseline uses that mapping. Changing it should be handled as an intentional auth-behavior decision across both Kustomize and Helm.

Stacking note

This PR is part of the platform auth chain and is not intended to be installed before the foundation charts and Istio auth provider are present.

Expected platform order:

kubeflow-namespaces -> kubeflow-platform -> cert-manager -> istio -> oauth2-proxy + dex

The Istio chart must be installed with the oauth2-proxy extension provider, because this chart renders Istio external auth resources that reference that provider.

The default Kubeflow login path is only complete once Dex is installed as well.

Namespace behavior

The chart does not render Namespace/oauth2-proxy. That namespace is provided by the foundation chart in #3468, and the Helm release metadata is stored in the oauth2-proxy workload namespace.

Validation

helm lint common/oauth2-proxy/helm/
./tests/helm_kustomize_compare.sh oauth2-proxy base
./tests/helm_kustomize_compare.sh oauth2-proxy overlays-istio
./tests/helm_kustomize_compare_all.sh oauth2-proxy
./tests/helm_kustomize_compare_all.sh
python3 -m py_compile tests/helm_kustomize_compare.py
git diff --check HEAD~1..HEAD

Also rendered every common/oauth2-proxy/helm/ci/values*.yaml file locally.

github-actions · 2026-05-25T13:04:17Z

Welcome to the Kubeflow Manifests Repository

Thanks for opening your first PR. Your contribution means a lot to the Kubeflow community.

Before making more PRs:
Please ensure your PR follows our Contributing Guide.
Please also be aware that many components are synchronizes from upstream via the scripts in /scripts.
So in some cases you have to fix the problem in the upstream repositories first, but you can use a PR against kubeflow/manifests to test the platform integration.

Community Resources:

CNCF Slack channels: https://www.kubeflow.org/docs/about/community/#kubeflow-slack-channels
Community meetings: https://www.kubeflow.org/docs/about/community/

Thanks again for helping to improve Kubeflow.

Copilot

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Adds Helm/Kustomize parity coverage for the oauth2-proxy component and introduces an initial (static) Helm chart to render the existing Kustomize resources, while improving manifest comparison normalization.

Changes:

Extend Helm/Kustomize comparison scripts to support oauth2-proxy scenarios and “all” runs.
Add an experimental/helm/charts/oauth2-proxy chart (templates, CI values files, docs).
Refine Kustomize hash-suffix normalization logic used by the manifest diff tool.

Reviewed changes

Copilot reviewed 18 out of 19 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
tests/helm_kustomize_compare_all.sh	Adds `oauth2-proxy` scenarios to the “compare all” harness and help text.
tests/helm_kustomize_compare.sh	Adds `oauth2-proxy` chart/kustomize mappings and Helm templating path.
tests/helm_kustomize_compare.py	Adds a compiled regex for Kustomize hash suffix stripping and includes namespace in keys for `oauth2-proxy`.
experimental/helm/charts/oauth2-proxy/Chart.yaml	Introduces the new Helm chart metadata.
experimental/helm/charts/oauth2-proxy/README.md	Documents installation and comparison workflows for the new chart.
experimental/helm/charts/oauth2-proxy/values.yaml	Defines default chart values for namespaces, credentials, and feature toggles.
experimental/helm/charts/oauth2-proxy/templates/_helpers.tpl	Adds helper templates for namespaces and JWT rule rendering.
experimental/helm/charts/oauth2-proxy/templates/namespace.yaml	Renders the oauth2-proxy Namespace (optional).
experimental/helm/charts/oauth2-proxy/templates/oauth2-proxy.yaml	Renders ServiceAccount/ConfigMaps/Secret/Service/Deployment/VirtualService for oauth2-proxy.
experimental/helm/charts/oauth2-proxy/templates/networkpolicies.yaml	Renders namespace network policies (optional).
experimental/helm/charts/oauth2-proxy/templates/istio-external-auth.yaml	Renders Istio AuthorizationPolicy + RequestAuthentication (optional).
experimental/helm/charts/oauth2-proxy/templates/m2m.yaml	Renders m2m RequestAuthentication (optional).
experimental/helm/charts/oauth2-proxy/templates/cluster-jwks-proxy.yaml	Renders JWKS proxy deployment for kind-like clusters (optional).
experimental/helm/charts/oauth2-proxy/files/oauth2_proxy.cfg	Adds the oauth2-proxy config file embedded into a ConfigMap.
experimental/helm/charts/oauth2-proxy/files/kubeflow-logo.svg	Adds a logo asset embedded into a ConfigMap.
experimental/helm/charts/oauth2-proxy/ci/values-base.yaml	CI values mapping for `common/oauth2-proxy/base`.
experimental/helm/charts/oauth2-proxy/ci/values-m2m-dex-only.yaml	CI values mapping for `m2m-dex-only` overlay.
experimental/helm/charts/oauth2-proxy/ci/values-m2m-dex-and-kind.yaml	CI values mapping for `m2m-dex-and-kind` overlay.
experimental/helm/charts/oauth2-proxy/ci/values-m2m-dex-and-eks.yaml	CI values mapping for `m2m-dex-and-eks` overlay.

danish9039 · 2026-05-25T15:50:05Z

+credentials:
+  # -- OAuth client ID used by oauth2-proxy.
+  clientID: kubeflow-oidc-authservice
+  # -- OAuth client secret used by oauth2-proxy.
+  clientSecret: pUBnBOY80SnXgjibTYM9ZWNzY2xreNGQok
+  # -- Cookie secret used by oauth2-proxy.
+  cookieSecret: 7d16fee92f8d11b8940b081b3f8b8acb


Moved the Kustomize parity secrets into CI values and left placeholders in chart defaults.

danish9039 · 2026-05-25T15:50:06Z

+apiVersion: v1
+data:
+  ALLOW_SELF_SIGNED_ISSUER: {{ .Values.parameters.allowSelfSignedIssuer | quote }}
+  ENABLE_M2M_TOKENS: {{ .Values.parameters.enableM2MTokens | quote }}


Kept this aligned with current Kustomize; ENABLE_M2M_TOKENS is the existing parameter used for --skip-jwt-bearer-tokens.

danish9039 · 2026-05-25T15:50:08Z

+          valueFrom:
+            configMapKeyRef:
+              key: ENABLE_M2M_TOKENS
+              name: oauth2-proxy-parameters


Kept this aligned with current Kustomize; ENABLE_M2M_TOKENS is the existing parameter used for --skip-jwt-bearer-tokens.

danish9039 · 2026-05-25T15:50:09Z

 from typing import Dict, List, Tuple, Any
 import re

+KUSTOMIZE_HASH_SUFFIX = re.compile(r'-(?=[a-z0-9]{10}$)(?=[a-z0-9]*[0-9])[a-z0-9]{10}$')


Checked this against current manifests; removing the digit guard incorrectly strips stable names like oauth2-proxy-parameters, so I kept it.

danish9039 · 2026-05-25T15:50:11Z

+clusterJwksProxy:
+  # -- Render the cluster JWKS proxy used by kind-like clusters.
+  enabled: false
+  image: docker.io/bitnamisecure/kubectl:latest


Moved the latest image out of chart defaults; it is now only set in the CI parity values that match Kustomize.

danish9039 · 2026-05-25T15:50:12Z

+    elif [[ "$COMPONENT" == "oauth2-proxy" ]]; then
+        helm template oauth2-proxy . \
+            --namespace "$NAMESPACE" \
+            --include-crds \
+            --values "$HELM_VALUES_ARG" > "$HELM_OUTPUT"


Leaving this as a follow-up cleanup because this PR keeps the component mapping explicit for review.

juliusvonkohout · 2026-05-25T18:04:09Z

Please first update kustomize to the latest available version in a separate PR.

Signed-off-by: danish9039 <danishsiddiqui040@gmail.com>

danish9039 · 2026-05-31T16:54:55Z

Addressed: oauth2-proxy Kustomize manifests were synchronized to v7.15.2 in #3484, and this chart branch is aligned to that version.

Signed-off-by: danish9039 <danishsiddiqui040@gmail.com>

Copilot

Pull request overview

Copilot reviewed 17 out of 18 changed files in this pull request and generated 7 comments.

 from typing import Dict, List, Tuple, Any
 import re

+KUSTOMIZE_HASH_SUFFIX = re.compile(r'-(?=[a-z0-9]{10}$)(?=[a-z0-9]*[0-9])[a-z0-9]{10}$')


                if any(ref_pattern in path for ref_pattern in [
                    'secretKeyRef', 'configMapKeyRef', 'configMapRef', 'secret', 'volumes'
                ]):
-                    value = re.sub(r'-[a-z0-9]{10}$', '', value)
+                    value = KUSTOMIZE_HASH_SUFFIX.sub('', value)
                elif 'volumes' in path and key == 'secretName':
-                    value = re.sub(r'-[a-z0-9]{10}$', '', value)
+                    value = KUSTOMIZE_HASH_SUFFIX.sub('', value)
                elif 'volumes' in path and 'configMap' in path:
-                    value = re.sub(r'-[a-z0-9]{10}$', '', value)
+                    value = KUSTOMIZE_HASH_SUFFIX.sub('', value)


+def should_compare_manifest(manifest: Dict, component: str, scenario: str) -> bool:
+    """Select the resource subset owned by a comparison scenario."""
+    if component == "oauth2-proxy" and manifest.get("kind") == "Namespace":
+        return False
+
+    return True


+    spec:
+      containers:
+      - args:
+        - --http-address=0.0.0.0:4180
+        - --config=/etc/oauth2_proxy/oauth2_proxy.cfg


+        - name: OAUTH2_PROXY_SKIP_JWT_BEARER_TOKENS
+          valueFrom:
+            configMapKeyRef:
+              key: ENABLE_M2M_TOKENS
+              name: oauth2-proxy-parameters


+credentials:
+  clientSecret: pUBnBOY80SnXgjibTYM9ZWNzY2xreNGQok
+  cookieSecret: 7d16fee92f8d11b8940b081b3f8b8acb


+        - --accept-hosts=.*
+        - --accept-paths=^(?:/openid/v1/jwks)|(?:/.well-known/openid-configuration)$
+        - --reject-methods=^(POST|PUT|PATCH|DELETE|HEAD|OPTIONS|CONNECT|TRACE)$
+        image: {{ .Values.clusterJwksProxy.image }}


Signed-off-by: danish9039 <danishsiddiqui040@gmail.com>

juliusvonkohout

Pleasemove it to common/istio/helm and exten the istio synchronization script to also update helm.

juliusvonkohout · 2026-06-09T12:33:20Z

+  cookieSecret: 7d16fee92f8d11b8940b081b3f8b8acb
+
+istioExternalAuth:
+  enabled: false


do you mean authentication or authorization?

juliusvonkohout · 2026-06-09T12:33:43Z

what is in general the prupose of this file? what is the customer scenario ?

Signed-off-by: danish9039 <danishsiddiqui040@gmail.com>

google-oss-prow · 2026-06-15T03:55:57Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please ask for approval from juliusvonkohout. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

Signed-off-by: danish9039 <danishsiddiqui040@gmail.com>

Copilot AI review requested due to automatic review settings May 25, 2026 13:04

google-oss-prow Bot added the do-not-merge/work-in-progress label May 25, 2026

google-oss-prow Bot added the size/XL label May 25, 2026

google-oss-prow Bot requested review from juliusvonkohout and tarekabouzeid May 25, 2026 13:04

danish9039 mentioned this pull request May 25, 2026

helm: add Dex wrapper chart #3480

Open

Copilot AI reviewed May 25, 2026

View reviewed changes

danish9039 mentioned this pull request May 25, 2026

helm: synCHRONIZE kserve models web app chart #3481

Merged

3 tasks

danish9039 force-pushed the gsoc/oauth2-proxy-wrapper-chart branch from 5b2986d to 9cc1a98 Compare May 25, 2026 15:44

danish9039 added 2 commits May 27, 2026 01:07

helm: add oauth2-proxy wrapper chart

921517c

Signed-off-by: danish9039 <danishsiddiqui040@gmail.com>

helm: address oauth2-proxy review comments

3a11549

Signed-off-by: danish9039 <danishsiddiqui040@gmail.com>

danish9039 force-pushed the gsoc/oauth2-proxy-wrapper-chart branch from 28a36ef to 3a11549 Compare May 26, 2026 19:38

helm: align oauth2-proxy wrapper with v7.15.2

7f673c1

Signed-off-by: danish9039 <danishsiddiqui040@gmail.com>

danish9039 marked this pull request as ready for review June 1, 2026 13:36

google-oss-prow Bot removed the do-not-merge/work-in-progress label Jun 1, 2026

helm: use foundation-owned oauth2-proxy namespace

79c3ee2

Signed-off-by: danish9039 <danishsiddiqui040@gmail.com>

danish9039 requested a review from Copilot June 7, 2026 23:45

Copilot AI reviewed Jun 7, 2026

View reviewed changes

helm: fix oauth2-proxy namespace names

c45c03b

Signed-off-by: danish9039 <danishsiddiqui040@gmail.com>

juliusvonkohout requested changes Jun 9, 2026

View reviewed changes

google-oss-prow Bot assigned juliusvonkohout Jun 9, 2026

juliusvonkohout reviewed Jun 9, 2026

View reviewed changes

helm: move oauth2-proxy chart to common/oauth2-proxy/helm

747bd78

Signed-off-by: danish9039 <danishsiddiqui040@gmail.com>

danish9039 added 2 commits June 15, 2026 09:32

ci: ignore Helm templates in YAML lint

696f0d0

Signed-off-by: danish9039 <danishsiddiqui040@gmail.com>

test: add oauth2-proxy component to helm_kustomize_compare.sh

c4df15c

Signed-off-by: danish9039 <danishsiddiqui040@gmail.com>

danish9039 added 5 commits June 15, 2026 17:57

helm: address oauth2-proxy review comments

be030ca

Signed-off-by: danish9039 <danishsiddiqui040@gmail.com>

test: keep oauth2-proxy hash normalization scoped

4fa4f25

Signed-off-by: danish9039 <danishsiddiqui040@gmail.com>

helm: restore oauth2-proxy parity fixture values

04cace3

Signed-off-by: danish9039 <danishsiddiqui040@gmail.com>

test: sync hub helm ci image tags with kustomize

13987d9

Signed-off-by: danish9039 <danishsiddiqui040@gmail.com>

test: clean oauth2-proxy helm comparison style

350dbeb

Signed-off-by: danish9039 <danishsiddiqui040@gmail.com>

google-oss-prow Bot added size/XXL and removed size/XL labels Jun 27, 2026

danish9039 added 2 commits June 27, 2026 18:53

helm: align hub image tags with kustomize

5c590fd

Signed-off-by: danish9039 <danishsiddiqui040@gmail.com>

helm: inherit hub component image tags

efac721

Signed-off-by: danish9039 <danishsiddiqui040@gmail.com>

Uh oh!

Conversation

danish9039 commented May 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Supported comparison scenarios

Scope update

CI fixture note

Follow-up

Stacking note

Namespace behavior

Validation

Uh oh!

github-actions Bot commented May 25, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

juliusvonkohout commented May 25, 2026

Uh oh!

danish9039 commented May 31, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

juliusvonkohout left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

google-oss-prow Bot commented Jun 15, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

danish9039 commented May 25, 2026 •

edited

Loading