Skip to content

Commit 88063fe

Browse files
author
CZI Argus Helm Publisher Bot
committed
Merge remote-tracking branch 'origin/main' into artifacts
2 parents 64921dc + 62d73a0 commit 88063fe

8 files changed

Lines changed: 198 additions & 22 deletions

File tree

‎.release-please-manifest.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
{
2-
"stack": "2.43.1",
2+
"stack": "2.43.2",
33
"argus-config": "1.8.0",
44
"sso-secret": "0.3.0",
55
"grafana": "0.11.0",

‎stack/CHANGELOG.md‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,12 @@
11
# Changelog
22

3+
## [2.43.2](https://github.com/chanzuckerberg/argo-helm-charts/compare/stack-v2.43.1...stack-v2.43.2) (2026-07-09)
4+
5+
6+
### Bug Fixes
7+
8+
* **stack:** oidc-proxy envFrom and skipAuth render errors, vanity OIDC route attachment ([#506](https://github.com/chanzuckerberg/argo-helm-charts/issues/506)) ([ad8cb63](https://github.com/chanzuckerberg/argo-helm-charts/commit/ad8cb6329475b2816f32fbb200860cf516052591))
9+
310
## [2.43.1](https://github.com/chanzuckerberg/argo-helm-charts/compare/stack-v2.43.0...stack-v2.43.1) (2026-07-09)
411

512

‎stack/Chart.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ type: application
1313
# This is the chart version. This version number should be incremented each time you make changes
1414
# to the chart and its templates, including the app version.
1515
# Versions are expected to follow Semantic Versioning (https://semver.org/)
16-
version: 2.43.1
16+
version: 2.43.2
1717

1818
# This is the version number of the application being deployed. This version number should be
1919
# incremented each time you make changes to the application. Versions are not expected to

‎stack/templates/_helpers.tpl‎

Lines changed: 6 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -235,19 +235,13 @@ app.kubernetes.io/name: {{ include "oidcProxy.name" . }}
235235
app.kubernetes.io/instance: {{ .Release.Name }}
236236
{{- end }}
237237

238-
{{ define "oidcProxy.envFromArgusSecrets" -}}
239-
{{- include "service.configuration" . -}}
240-
{{- end -}}
241-
242-
{{ define "oidcProxy.additionalSecrets" -}}
243-
{{ if gt (len .Values.oidcProxy.additionalSecrets) 0 }}
244-
{{ toYaml .Values.oidcProxy.additionalSecrets }}
245-
{{- end -}}
246-
{{- end -}}
247-
248238
{{- define "oidcProxy.envFrom" -}}
249-
{{- include "oidcProxy.envFromArgusSecrets" . }}
250-
{{- include "oidcProxy.additionalSecrets" . }}
239+
{{- $envFrom := list -}}
240+
{{- with fromYaml (include "service.configuration" .) -}}
241+
{{- $envFrom = concat $envFrom (default (list) .envFrom) -}}
242+
{{- end -}}
243+
{{- $envFrom = concat $envFrom (default (list) .Values.oidcProxy.additionalSecrets) -}}
244+
{{- toYaml $envFrom -}}
251245
{{- end -}}
252246

253247
{{- define "oidcProxy.authDomain" -}}

‎stack/templates/gateway-oidc.yaml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -58,11 +58,17 @@ metadata:
5858
{{- end }}
5959
spec:
6060
parentRefs:
61+
{{- if .Values.gateway.vanity.enabled }}
62+
- group: gateway.networking.k8s.io
63+
kind: ListenerSet
64+
name: {{ include "service.vanityListenerSetName" . }}
65+
{{- else }}
6166
- name: {{ .Values.gateway.gatewayName }}
6267
namespace: {{ .Values.gateway.gatewayNamespace }}
6368
{{- if .Values.gateway.sectionName }}
6469
sectionName: {{ .Values.gateway.sectionName }}
6570
{{- end }}
71+
{{- end }}
6672
hostnames:
6773
- {{ .Values.gateway.host }}
6874
{{- range $i, $rule := .Values.gateway.rules }}
@@ -100,11 +106,17 @@ metadata:
100106
{{- end }}
101107
spec:
102108
parentRefs:
109+
{{- if .Values.gateway.vanity.enabled }}
110+
- group: gateway.networking.k8s.io
111+
kind: ListenerSet
112+
name: {{ include "service.vanityListenerSetName" . }}
113+
{{- else }}
103114
- name: {{ .Values.gateway.gatewayName }}
104115
namespace: {{ .Values.gateway.gatewayNamespace }}
105116
{{- if .Values.gateway.sectionName }}
106117
sectionName: {{ .Values.gateway.sectionName }}
107118
{{- end }}
119+
{{- end }}
108120
hostnames:
109121
- {{ .Values.gateway.host }}
110122
rules:

‎stack/templates/oidc_proxy.yaml‎

Lines changed: 10 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -96,13 +96,13 @@ spec:
9696
{{- end -}}
9797

9898
{{- range .Values.oidcProxy.skipAuth }}
99-
{{ if contains "*" .method }}
100-
# for backwards compatibility, could also just be provided using extraArgs
99+
{{- $method := default "*" .method }}
100+
{{- if contains "*" $method }}
101101
- --skip-auth-route={{ .path }}
102-
{{- else -}}
103-
- --skip-auth-route={{ .method }}={{ .path }}
104-
{{- end -}}
105-
{{- end -}}
102+
{{- else }}
103+
- --skip-auth-route={{ $method }}={{ .path }}
104+
{{- end }}
105+
{{- end }}
106106

107107
{{ $cookiePrefix := list }}
108108
{{ range .Values.oidcProxy.extraArgs }}
@@ -124,8 +124,10 @@ spec:
124124
{{- toYaml .Values.oidcProxy.extraArgs | nindent 12}}
125125
{{- end }}
126126
{{- include "image" .Values.oidcProxy | nindent 10 }}
127-
{{- if gt (len (fromYamlArray (include "oidcProxy.envFrom" .))) 0 }}
128-
{{- include "oidcProxy.envFrom" . | nindent 10 }}
127+
{{- $envFrom := fromYamlArray (include "oidcProxy.envFrom" .) }}
128+
{{- if $envFrom }}
129+
envFrom:
130+
{{- toYaml $envFrom | nindent 12 }}
129131
{{- else }}
130132
envFrom: []
131133
{{- end }}

‎stack/tests/gateway_oidc_test.yaml‎

Lines changed: 93 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -223,6 +223,99 @@ tests:
223223
path: spec.rules[0].matches[0].path.value
224224
value: /
225225

226+
- it: should attach the primary HTTPRoute to the vanity ListenerSet when vanity is enabled
227+
set:
228+
global:
229+
ingress:
230+
enabled: false
231+
gateway:
232+
enabled: true
233+
host: api.example.com
234+
oidcProtected: true
235+
vanity:
236+
enabled: true
237+
oidcProxyGateway:
238+
clientID: my-client-id
239+
provider:
240+
issuer: https://auth.example.com
241+
services:
242+
service1: {}
243+
asserts:
244+
- documentIndex: 0
245+
equal:
246+
path: spec.parentRefs[0]
247+
value:
248+
group: gateway.networking.k8s.io
249+
kind: ListenerSet
250+
name: release-name-stack-service1-vanity
251+
252+
- it: should attach the public skipAuth HTTPRoute to the vanity ListenerSet when vanity is enabled
253+
set:
254+
global:
255+
ingress:
256+
enabled: false
257+
gateway:
258+
enabled: true
259+
host: api.example.com
260+
oidcProtected: true
261+
vanity:
262+
enabled: true
263+
oidcProxyGateway:
264+
clientID: my-client-id
265+
provider:
266+
issuer: https://auth.example.com
267+
skipAuth:
268+
- path: /healthz
269+
method: GET
270+
services:
271+
service1: {}
272+
asserts:
273+
- hasDocuments:
274+
count: 2
275+
- documentIndex: 0
276+
equal:
277+
path: metadata.name
278+
value: release-name-stack-service1-public
279+
- documentIndex: 0
280+
equal:
281+
path: spec.parentRefs[0]
282+
value:
283+
group: gateway.networking.k8s.io
284+
kind: ListenerSet
285+
name: release-name-stack-service1-vanity
286+
- documentIndex: 1
287+
equal:
288+
path: spec.parentRefs[0]
289+
value:
290+
group: gateway.networking.k8s.io
291+
kind: ListenerSet
292+
name: release-name-stack-service1-vanity
293+
294+
- it: should attach to the shared gateway when vanity is disabled
295+
set:
296+
global:
297+
ingress:
298+
enabled: false
299+
gateway:
300+
enabled: true
301+
host: api.example.com
302+
oidcProtected: true
303+
sectionName: https
304+
oidcProxyGateway:
305+
clientID: my-client-id
306+
provider:
307+
issuer: https://auth.example.com
308+
services:
309+
service1: {}
310+
asserts:
311+
- documentIndex: 0
312+
equal:
313+
path: spec.parentRefs[0]
314+
value:
315+
name: envoy-gateway
316+
namespace: envoy-gateway
317+
sectionName: https
318+
226319
- it: should include service labels on the HTTPRoutes
227320
set:
228321
global:

‎stack/tests/oidc_test.yaml‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -91,6 +91,56 @@ tests:
9191
lengthEqual:
9292
path: spec.template.spec.containers[0].envFrom
9393
count: 6
94+
- it: sets additionalSecrets in envFrom without argus secrets
95+
set:
96+
global:
97+
oidcProxy:
98+
enabled: true
99+
additionalSecrets:
100+
- secretRef:
101+
name: blah1
102+
optional: true
103+
- secretRef:
104+
name: blah2
105+
optional: true
106+
asserts:
107+
- documentIndex: 0
108+
lengthEqual:
109+
path: spec.template.spec.containers[0].envFrom
110+
count: 2
111+
- documentIndex: 0
112+
equal:
113+
path: spec.template.spec.containers[0].envFrom[0].secretRef.name
114+
value: blah1
115+
- documentIndex: 0
116+
equal:
117+
path: spec.template.spec.containers[0].envFrom[1].secretRef.name
118+
value: blah2
119+
- it: puts argus secrets before additionalSecrets in envFrom
120+
set:
121+
global:
122+
appSecrets:
123+
envSecret:
124+
secretName: argus-env
125+
oidcProxy:
126+
enabled: true
127+
additionalSecrets:
128+
- secretRef:
129+
name: blah1
130+
optional: true
131+
asserts:
132+
- documentIndex: 0
133+
lengthEqual:
134+
path: spec.template.spec.containers[0].envFrom
135+
count: 2
136+
- documentIndex: 0
137+
equal:
138+
path: spec.template.spec.containers[0].envFrom[0].secretRef.name
139+
value: argus-env
140+
- documentIndex: 0
141+
equal:
142+
path: spec.template.spec.containers[0].envFrom[1].secretRef.name
143+
value: blah1
94144
- it: defaults to 0 envFrom object
95145
set:
96146
global:
@@ -150,6 +200,24 @@ tests:
150200
contains:
151201
path: spec.template.spec.containers[0].args
152202
content: "--cookie-refresh=1h23m45s"
203+
- it: treats skipAuth entries without a method as all-methods
204+
set:
205+
global:
206+
oidcProxy:
207+
enabled: true
208+
skipAuth:
209+
- path: "/healthz"
210+
- path: "/v1/api/docs"
211+
method: GET
212+
asserts:
213+
- documentIndex: 0
214+
contains:
215+
path: spec.template.spec.containers[0].args
216+
content: "--skip-auth-route=/healthz"
217+
- documentIndex: 0
218+
contains:
219+
path: spec.template.spec.containers[0].args
220+
content: "--skip-auth-route=GET=/v1/api/docs"
153221
- it: overwrites the name
154222
set:
155223
global:

0 commit comments

Comments
 (0)