Add support to read sessionStorage.redis.standalone.connectionUrl from configmap

[Moulick]

When provisioning redis externally, other operators and provisioning tools return then connection host/url in a configmap. It would be great to be able to read the host/url from a configmap as well, same as it already reads the password from a secret.

[Moulick]

I am happy to open a PR if needed

[pierluigilenoci]

Thanks for the report! This use case can already be covered today using extraEnv with a valueFrom.configMapKeyRef:

extraEnv:
  - name: OAUTH2_PROXY_REDIS_CONNECTION_URL
    valueFrom:
      configMapKeyRef:
        name: my-redis-configmap
        key: connectionUrl

This sets the env var that oauth2-proxy reads for the standalone Redis connection URL, pulling the value directly from your ConfigMap.

Does this work for your use case, or is there a specific scenario where extraEnv doesn't fit? Happy to reconsider if there's a good reason to add native support.

[Moulick]

Thanks for looking into it. I tried your suggestion but then helm throws a validation error please set sessionStorage.redis.standalone.connectionUrl or enable the redis subchart via redis-ha.enabled. This is with the below (truncated) values file for example

sessionStorage:
  type: redis
  redis:
    clientType: standalone
    existingSecret: "my-redis-secret"
    passwordKey: REDIS_AUTH_PASSWORD
extraEnv:
  - name: OAUTH2_PROXY_REDIS_CONNECTION_URL
    valueFrom:
      configMapKeyRef:
        name: "my-redis-configmap"
        key: REDIS_HOST_URI

So to use OAUTH2_PROXY_REDIS_CONNECTION_URL, I'll have to set fake sessionStorage.type: cookie. This would theoretically work but is misleading for anyone looking at the values files later 😅.

[pierluigilenoci]

You're right, my mistake — the extraEnv workaround doesn't work here because the chart validates that sessionStorage.redis.standalone.connectionUrl is set (or the redis subchart is enabled) at template render time, before the env var is ever evaluated. Setting sessionStorage.type: cookie to bypass it is indeed misleading.

A cleaner fix would be to apply tpl() to connectionUrl itself, similar to what we're doing for existingSecret in #414:

sessionStorage:
  redis:
    clientType: standalone
    existingSecret: "my-redis-secret"
    passwordKey: REDIS_AUTH_PASSWORD
    standalone:
      connectionUrl: '{{ .Values.myRedis.url }}'

This would allow you to reference a value defined elsewhere in your values hierarchy without needing to hardcode it. Would that solve your use case? If so, I can include it in the same PR or open a follow-up.

[Moulick]

Not exactly, what I need is like configMapKeyRef to ready directly from configmap during pod runtime and not during helm rendering. Here is a diff from what I have been using for now.

diff --git a/helm/oauth2-proxy/values.yaml b/helm/oauth2-proxy/values.yaml
--- a/helm/oauth2-proxy/values.yaml
+++ b/helm/oauth2-proxy/values.yaml
@@ -594,6 +594,10 @@ sessionStorage:
      standalone:
        # URL of redis standalone server for redis session storage (e.g. `redis://HOST[:PORT]`). Automatically generated if not set
        connectionUrl: ""
+      # Name of an existing ConfigMap containing the Redis standalone connection URL.
+      # When set, this renders OAUTH2_PROXY_REDIS_CONNECTION_URL from valueFrom.configMapKeyRef.
+      existingConfigMap: ""
+      configMapKey: "REDIS_HOST_URI"
diff --git a/helm/oauth2-proxy/templates/deployment.yaml b/helm/oauth2-proxy/templates/deployment.yaml
--- a/helm/oauth2-proxy/templates/deployment.yaml
+++ b/helm/oauth2-proxy/templates/deployment.yaml
@@ -80,8 +80,16 @@ spec:
          - name: TOTAL_RETRY_TIME
            value: "{{ .Values.initContainers.waitForRedis.timeout }}"
          {{- if eq (default "" .Values.sessionStorage.redis.clientType) "standalone" }}
+        {{- if .Values.sessionStorage.redis.standalone.existingConfigMap }}
+        - name: OAUTH2_PROXY_REDIS_CONNECTION_URL
+          valueFrom:
+            configMapKeyRef:
+              name: {{ tpl .Values.sessionStorage.redis.standalone.existingConfigMap $ }}
+              key: {{ .Values.sessionStorage.redis.standalone.configMapKey }}
+        {{- else }}
          - name: OAUTH2_PROXY_REDIS_CONNECTION_URL
            value: {{ include "oauth2-proxy.redis.StandaloneUrl" . }}
+        {{- end }}
          {{- else if eq (default "" .Values.sessionStorage.redis.clientType) "cluster" }}
          - name: OAUTH2_PROXY_REDIS_USE_CLUSTER
            value: "true"
@@ -219,8 +227,16 @@ spec:
                key: {{ .Values.sessionStorage.redis.passwordKey }}
          {{- end }}
          {{- if eq (default "" .Values.sessionStorage.redis.clientType) "standalone" }}
+        {{- if .Values.sessionStorage.redis.standalone.existingConfigMap }}
+        - name: OAUTH2_PROXY_REDIS_CONNECTION_URL
+          valueFrom:
+            configMapKeyRef:
+              name: {{ tpl .Values.sessionStorage.redis.standalone.existingConfigMap $ }}
+              key: {{ .Values.sessionStorage.redis.standalone.configMapKey }}
+        {{- else }}
          - name: OAUTH2_PROXY_REDIS_CONNECTION_URL
            value: {{ include "oauth2-proxy.redis.StandaloneUrl" . }}
+        {{- end }}
          {{- else if eq (default "" .Values.sessionStorage.redis.clientType) "cluster" }}
          - name: OAUTH2_PROXY_REDIS_USE_CLUSTER
            value: "true"

Example values this would support:

sessionStorage:
  type: redis
  redis:
    clientType: standalone
    existingSecret: my-redis-password
    passwordKey: REDIS_AUTH_PASSWORD
    standalone:
      existingConfigMap: my-redis-environment
      configMapKey: REDIS_HOST_URI

[Moulick]

Or it could be something like below to allow flexibility to choose configmapKeyRef/secretKeyRef/fileKeyRef and whatever else .env.valueFrom support now and in the future?

sessionStorage:
  type: redis
  redis:
    clientType: standalone
    existingSecret: my-redis-password
    passwordKey: REDIS_AUTH_PASSWORD
    standalone:
      connectionUrl: "" # This
      connectionUrlFrom: {} # Or this

diff --git a/helm/oauth2-proxy/values.yaml b/helm/oauth2-proxy/values.yaml
diff --git a/helm/oauth2-proxy/values.yaml b/helm/oauth2-proxy/values.yaml
--- a/helm/oauth2-proxy/values.yaml
+++ b/helm/oauth2-proxy/values.yaml
@@ -594,6 +594,15 @@ sessionStorage:
      standalone:
        # URL of redis standalone server for redis session storage (e.g. `redis://HOST[:PORT]`). Automatically generated if not set
        connectionUrl: ""
+      # Raw Kubernetes EnvVarSource for OAUTH2_PROXY_REDIS_CONNECTION_URL.
+      # When set, this renders env.valueFrom directly and takes precedence over connectionUrl.
+      # Supports any valueFrom source Kubernetes supports, for example configMapKeyRef or secretKeyRef.
+      # Example:
+      # connectionUrlValueFrom:
+      #   configMapKeyRef:
+      #     name: my-redis-config
+      #     key: REDIS_HOST_URI
+      connectionUrlValueFrom: {}
diff --git a/helm/oauth2-proxy/templates/deployment.yaml b/helm/oauth2-proxy/templates/deployment.yaml
--- a/helm/oauth2-proxy/templates/deployment.yaml
+++ b/helm/oauth2-proxy/templates/deployment.yaml
@@ -80,8 +80,15 @@ spec:
          - name: TOTAL_RETRY_TIME
            value: "{{ .Values.initContainers.waitForRedis.timeout }}"
          {{- if eq (default "" .Values.sessionStorage.redis.clientType) "standalone" }}
+        {{- if .Values.sessionStorage.redis.standalone.connectionUrlValueFrom }}
+        - name: OAUTH2_PROXY_REDIS_CONNECTION_URL
+          valueFrom:
+            {{- tpl (toYaml .Values.sessionStorage.redis.standalone.connectionUrlValueFrom) $ | nindent 12 }}
+        {{- else }}
          - name: OAUTH2_PROXY_REDIS_CONNECTION_URL
            value: {{ include "oauth2-proxy.redis.StandaloneUrl" . }}
+        {{- end }}
          {{- else if eq (default "" .Values.sessionStorage.redis.clientType) "cluster" }}
          - name: OAUTH2_PROXY_REDIS_USE_CLUSTER
            value: "true"
@@ -219,8 +226,15 @@ spec:
                key: {{ .Values.sessionStorage.redis.passwordKey }}
          {{- end }}
          {{- if eq (default "" .Values.sessionStorage.redis.clientType) "standalone" }}
+        {{- if .Values.sessionStorage.redis.standalone.connectionUrlValueFrom }}
+        - name: OAUTH2_PROXY_REDIS_CONNECTION_URL
+          valueFrom:
+            {{- tpl (toYaml .Values.sessionStorage.redis.standalone.connectionUrlValueFrom) $ | nindent 12 }}
+        {{- else }}
          - name: OAUTH2_PROXY_REDIS_CONNECTION_URL
            value: {{ include "oauth2-proxy.redis.StandaloneUrl" . }}
+        {{- end }}
          {{- else if eq (default "" .Values.sessionStorage.redis.clientType) "cluster" }}
          - name: OAUTH2_PROXY_REDIS_USE_CLUSTER
            value: "true"