helm: add Dex wrapper chart by danish9039 · Pull Request #3480 · kubeflow/community-distribution

danish9039 · 2026-05-25T13:04:25Z

Summary

Adds the Dex Helm wrapper chart for the Project 5 platform-first Helm work under common/dex/helm, co-located with the Kustomize baseline under common/dex.

The chart is a static Kustomize-parity wrapper for the current Kubeflow Dex install. It follows common/dex and is aligned with Dex v2.45.1.

Supported comparison scenarios

base: common/dex/base
overlays-istio: common/dex/overlays/istio

Scope update

Move the wrapper chart from experimental/helm/charts/dex to common/dex/helm.
Update YAML lint config so co-located Helm templates under common/*/helm/templates/** are not treated as raw YAML.
Add Dex to tests/helm_kustomize_compare.sh with the co-located chart path and base / overlays-istio scenarios.

Follow-up

Sync script extension for appVersion, image tag, and CRD updates will follow separately after the chart location change, so this PR stays focused on co-location and parity proof.

Stacking note

This PR is part of the platform auth chain and follows the foundation, cert-manager, Istio, and oauth2-proxy wrapper work:

kubeflow-namespaces -> kubeflow-platform -> cert-manager -> istio -> oauth2-proxy + dex

The chart does not render Namespace/auth. That namespace is provided by the foundation chart in #3468, and the Helm release metadata is stored in the auth workload namespace.

Values note

The chart keeps Kustomize parity defaults in the CI values files. Production installs should provide their own static users, OIDC client values, and password hashes.

oidcClient.id and oidcClient.secret are raw values and are encoded by the template.

Validation

helm lint common/dex/helm/
./tests/helm_kustomize_compare.sh dex base
./tests/helm_kustomize_compare.sh dex overlays-istio
./tests/helm_kustomize_compare_all.sh dex
git diff --check HEAD~1..HEAD

github-actions · 2026-05-25T13:04:34Z

Welcome to the Kubeflow Manifests Repository

Thanks for opening your first PR. Your contribution means a lot to the Kubeflow community.

Before making more PRs:
Please ensure your PR follows our Contributing Guide.
Please also be aware that many components are synchronizes from upstream via the scripts in /scripts.
So in some cases you have to fix the problem in the upstream repositories first, but you can use a PR against kubeflow/manifests to test the platform integration.

Community Resources:

CNCF Slack channels: https://www.kubeflow.org/docs/about/community/#kubeflow-slack-channels
Community meetings: https://www.kubeflow.org/docs/about/community/

Thanks again for helping to improve Kubeflow.

Copilot

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Adds Dex to the Helm↔Kustomize comparison harness and introduces an initial Dex Helm chart intended to render parity manifests with common/dex.

Changes:

Extend the compare scripts to support the new dex component and scenarios.
Add a new experimental Helm chart for Dex, including templates, CRD, and CI values files.
Adjust manifest-key normalization to include namespaces for Dex comparisons.

Reviewed changes

Copilot reviewed 16 out of 16 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
tests/helm_kustomize_compare_all.sh	Adds `dex` scenarios and CLI help output for running comparisons across all components.
tests/helm_kustomize_compare.sh	Adds Dex chart/manifests paths and Helm templating logic for Dex scenarios.
tests/helm_kustomize_compare.py	Updates component allowlist and resource-keying behavior to support Dex.
experimental/helm/charts/dex/Chart.yaml	Introduces the Dex Helm chart metadata.
experimental/helm/charts/dex/values.yaml	Adds default chart values for namespaces, Dex config, and credentials.
experimental/helm/charts/dex/templates/_helpers.tpl	Adds namespace helper templates used by Dex resources.
experimental/helm/charts/dex/templates/dex.yaml	Adds Dex workload resources (SA, ConfigMap, Secrets, Service, Deployment).
experimental/helm/charts/dex/templates/rbac.yaml	Adds ClusterRole/ClusterRoleBinding for Dex.
experimental/helm/charts/dex/templates/namespace.yaml	Adds optional Namespace rendering for Dex workload namespace.
experimental/helm/charts/dex/templates/istio.yaml	Adds optional Istio VirtualService for routing to Dex.
experimental/helm/charts/dex/templates/networkpolicies.yaml	Adds optional NetworkPolicies for Dex ingress.
experimental/helm/charts/dex/crds/authcodes.yaml	Adds Dex AuthCode CRD (installed via Helm CRDs mechanism).
experimental/helm/charts/dex/ci/values-*.yaml	Adds scenario-specific values files for parity comparisons.
experimental/helm/charts/dex/README.md	Documents install/caveats and comparison commands for the Dex chart.

danish9039 · 2026-05-25T15:52:00Z

+  id: kubeflow-oidc-authservice
+  # -- OAuth client secret used by oauth2-proxy.
+  secret: pUBnBOY80SnXgjibTYM9ZWNzY2xreNGQok
+
+staticPassword:
+  # -- Bcrypt hash for the default Dex static user password.
+  hash: $2y$12$4K/VkmDd1q1Orb3xAt82zu8gk7Ad6ReFR4LCP9UeYE90NLiN9Df72


Moved the Kustomize parity secrets into CI values and left placeholders in chart defaults.

danish9039 · 2026-05-25T15:52:03Z

+data:
+  OIDC_CLIENT_ID: {{ .Values.oidcClient.id | b64enc }}
+  OIDC_CLIENT_SECRET: {{ .Values.oidcClient.secret | b64enc }}


Kept data for dex-oidc-client to preserve Kustomize secretGenerator parity; dex-passwords already uses stringData like Kustomize.

danish9039 · 2026-05-25T15:52:05Z

+kind: Namespace
+metadata:
+  labels:
+    pod-security.kubernetes.io/enforce: restricted


Made namespace labels configurable while keeping the current restricted Kustomize default.

danish9039 · 2026-05-25T15:52:06Z

+    web:
+      http: 0.0.0.0:5556
+    logger:
+      level: "debug"


Made Dex log level configurable; chart defaults to info, while CI parity values keep Kustomize debug.

danish9039 · 2026-05-25T15:52:08Z

+    # Include namespace in key for components that render same-name resources
+    # across release/workload namespaces or multiple workload namespaces.
+    if component in ["katib", "dex"] and namespace:


Fixed by using namespace-aware resource keys whenever a manifest has metadata.namespace, instead of a Dex-specific allowlist.

juliusvonkohout · 2026-05-25T18:04:04Z

Please first update kustomize to the latest available version in a separate PR.

Signed-off-by: danish9039 <danishsiddiqui040@gmail.com>

danish9039 · 2026-05-31T16:54:57Z

Addressed: Dex Kustomize manifests were synchronized to v2.45.1 in #3483, and this chart branch is aligned to that version.

Signed-off-by: danish9039 <danishsiddiqui040@gmail.com>

juliusvonkohout · 2026-06-09T12:21:04Z

why do we have this file? is it supposed to be meaningfully used standalone? What is the customer scenario?

juliusvonkohout

ad script in /scripts to automatically update the kustomize and helm for dex.

juliusvonkohout · 2026-06-09T12:23:27Z

what is the purpose of this file? do you intent do deploy dex without oauth2-proxy ? what is the customer scenario ?

i want one meainingful value file, not 3

juliusvonkohout · 2026-06-09T12:25:28Z

and please move this to common/dex/helm.

juliusvonkohout · 2026-06-09T12:25:51Z

each extra line costs maintenance, keep this in mind.

Signed-off-by: danish9039 <danishsiddiqui040@gmail.com>

google-oss-prow · 2026-06-15T03:55:56Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please ask for approval from juliusvonkohout. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

Signed-off-by: danish9039 <danishsiddiqui040@gmail.com>

Copilot AI review requested due to automatic review settings May 25, 2026 13:04

google-oss-prow Bot added the do-not-merge/work-in-progress label May 25, 2026

google-oss-prow Bot requested review from juliusvonkohout and tarekabouzeid May 25, 2026 13:04

google-oss-prow Bot added the size/L label May 25, 2026

Copilot AI reviewed May 25, 2026

View reviewed changes

danish9039 mentioned this pull request May 25, 2026

helm: synCHRONIZE kserve models web app chart #3481

Merged

3 tasks

danish9039 force-pushed the gsoc/dex-wrapper-chart branch from 41f9898 to a847509 Compare May 25, 2026 15:44

google-oss-prow Bot added size/XL and removed size/L labels May 25, 2026

danish9039 added 2 commits May 27, 2026 01:07

helm: add dex wrapper chart

f740b49

Signed-off-by: danish9039 <danishsiddiqui040@gmail.com>

helm: address dex review comments

f3ce9a7

Signed-off-by: danish9039 <danishsiddiqui040@gmail.com>

danish9039 force-pushed the gsoc/dex-wrapper-chart branch from bf386ad to f3ce9a7 Compare May 26, 2026 19:38

helm: align dex wrapper with v2.45.1

9e9a01b

Signed-off-by: danish9039 <danishsiddiqui040@gmail.com>

danish9039 marked this pull request as ready for review June 1, 2026 13:36

google-oss-prow Bot removed the do-not-merge/work-in-progress label Jun 1, 2026

google-oss-prow Bot requested a review from kimwnasptd June 1, 2026 13:36

danish9039 added 2 commits June 7, 2026 23:07

helm: use foundation-owned dex namespace

d2d1fa9

Signed-off-by: danish9039 <danishsiddiqui040@gmail.com>

helm: fix dex namespace names

16ad295

Signed-off-by: danish9039 <danishsiddiqui040@gmail.com>

google-oss-prow Bot added size/L and removed size/XL labels Jun 9, 2026

juliusvonkohout reviewed Jun 9, 2026

View reviewed changes

juliusvonkohout requested changes Jun 9, 2026

View reviewed changes

google-oss-prow Bot assigned juliusvonkohout Jun 9, 2026

juliusvonkohout reviewed Jun 9, 2026

View reviewed changes

helm: move dex chart to common/dex/helm

bb3de20

Signed-off-by: danish9039 <danishsiddiqui040@gmail.com>

danish9039 added 4 commits June 15, 2026 09:32

ci: ignore Helm templates in YAML lint

3b4e278

Signed-off-by: danish9039 <danishsiddiqui040@gmail.com>

test: add dex component to helm_kustomize_compare.sh

9d7007f

Signed-off-by: danish9039 <danishsiddiqui040@gmail.com>

test: clean dex compare script naming

3ae40e9

Signed-off-by: danish9039 <danishsiddiqui040@gmail.com>

docs: clean dex helm wording

63c497d

Signed-off-by: danish9039 <danishsiddiqui040@gmail.com>

google-oss-prow Bot added size/XL and removed size/L labels Jun 27, 2026

danish9039 added 2 commits June 27, 2026 18:53

helm: align hub image tags with kustomize

89b7337

Signed-off-by: danish9039 <danishsiddiqui040@gmail.com>

helm: inherit hub component image tags

305a04e

Signed-off-by: danish9039 <danishsiddiqui040@gmail.com>

Uh oh!

Conversation

danish9039 commented May 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Supported comparison scenarios

Scope update

Follow-up

Stacking note

Values note

Validation

Uh oh!

github-actions Bot commented May 25, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

juliusvonkohout commented May 25, 2026

Uh oh!

danish9039 commented May 31, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

juliusvonkohout left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

juliusvonkohout commented Jun 9, 2026

Uh oh!

juliusvonkohout commented Jun 9, 2026

Uh oh!

google-oss-prow Bot commented Jun 15, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

danish9039 commented May 25, 2026 •

edited

Loading