feat: add tpl support for sessionStorage.redis.existingSecret - #414
Open
pierluigilenoci wants to merge 3 commits into
Open
pierluigilenoci wants to merge 3 commits into
pierluigilenoci wants to merge 3 commits into
Conversation
Wrap the existingSecret field with tpl() in deployment.yaml so that
Helm template expressions (e.g. '{{ .Release.Name }}-redis-secret')
are evaluated at render time. This allows users to derive the secret
name dynamically when oauth2-proxy is deployed as a subchart alongside
operators that generate Redis secrets with structured names.
Applied to both the standalone/cluster password secretKeyRef and the
sentinel password secretKeyRef (which falls back to the base
existingSecret when no sentinel-specific one is set).
Closes oauth2-proxy#409
Signed-off-by: Pierluigi Lenoci <pierluigi.lenoci@gmail.com>
pierluigilenoci
marked this pull request as ready for review
June 9, 2026 19:19
The install test on a real kind cluster fails when existingSecret references a secret that does not exist. Use extraObjects to create the secret inline, same pattern as alphaconfig-7-existing-secret. Signed-off-by: Pierluigi Lenoci <pierluigi.lenoci@gmail.com>
The install test cannot pass without a real redis server running. The tpl() rendering is already verified by ct lint (helm template) across all existing ci/*.yaml files that touch deployment.yaml. Signed-off-by: Pierluigi Lenoci <pierluigi.lenoci@gmail.com>
pierluigilenoci
marked this pull request as draft
June 9, 2026 20:20
pierluigilenoci
marked this pull request as ready for review
June 9, 2026 20:20
Moulick
approved these changes
Jun 14, 2026
Moulick
left a comment
Moulick
left a comment
There was a problem hiding this comment.
Yes, this is exactly the patch I am running right now and will solve my issue :)
Member
Author
|
Hi — friendly ping. CI is green and the PR has an approval. Would you be able to merge this when you get a chance? Thank you! |
|
Maybe @tuunit ? |
This was referenced Jun 23, 2026
Contributor
There was a problem hiding this comment.
Pull request overview
Adds Helm tpl() evaluation support for sessionStorage.redis.existingSecret so subchart deployments can reference dynamically named Redis secrets (e.g., based on .Release.Name), addressing #409.
Changes:
- Wrap
sessionStorage.redis.existingSecret(and sentinel fallback) withtpl()when renderingsecretKeyRef.namein the Deployment. - Document templating support for
sessionStorage.redis.existingSecretinvalues.yaml. - Bump chart version to
10.8.0and update Artifact Hub changelog entry.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| helm/oauth2-proxy/templates/deployment.yaml | Evaluates templated secret names via tpl() for Redis password secret references (standalone/cluster and sentinel). |
| helm/oauth2-proxy/values.yaml | Adds inline documentation noting existingSecret supports Helm templating. |
| helm/oauth2-proxy/Chart.yaml | Bumps chart version and updates artifacthub.io/changes entry for the feature. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
606
to
608
| # Name of the Kubernetes secret containing the redis & redis sentinel password values (see also `sessionStorage.redis.passwordKey`) | ||
| # Supports Helm templating, e.g. '{{ .Release.Name }}-redis' or '{{ include "myapp.redis.secretName" . }}' | ||
| existingSecret: "" |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes #409.
When oauth2-proxy is deployed as a subchart, operators (e.g. Redis Operator, Bitnami Redis) generate secrets with structured names that depend on the release name or other chart values. Previously
sessionStorage.redis.existingSecretwas rendered verbatim, making it impossible to reference these dynamically-named secrets without hardcoding the full name.This PR wraps
existingSecretwithtpl()so Helm template expressions are evaluated at render time:Changes
helm/oauth2-proxy/templates/deployment.yaml— applytpltoexistingSecretin both the standalone/cluster secretKeyRef and the sentinel secretKeyRefhelm/oauth2-proxy/values.yaml— document tpl support in the field commenthelm/oauth2-proxy/Chart.yaml— minor version bump to 10.8.0Compatibility
Plain string values (e.g.
my-redis-secret) continue to work unchanged —tplis a no-op on non-template strings. Same pattern already used forconfig.existingSecretin_helpers.tpl.