feat: add tpl support for sessionStorage.redis.existingSecret#414
Open
pierluigilenoci wants to merge 3 commits into
Open
feat: add tpl support for sessionStorage.redis.existingSecret#414pierluigilenoci wants to merge 3 commits into
pierluigilenoci wants to merge 3 commits into
Conversation
Wrap the existingSecret field with tpl() in deployment.yaml so that
Helm template expressions (e.g. '{{ .Release.Name }}-redis-secret')
are evaluated at render time. This allows users to derive the secret
name dynamically when oauth2-proxy is deployed as a subchart alongside
operators that generate Redis secrets with structured names.
Applied to both the standalone/cluster password secretKeyRef and the
sentinel password secretKeyRef (which falls back to the base
existingSecret when no sentinel-specific one is set).
Closes oauth2-proxy#409
Signed-off-by: Pierluigi Lenoci <pierluigi.lenoci@gmail.com>
The install test on a real kind cluster fails when existingSecret references a secret that does not exist. Use extraObjects to create the secret inline, same pattern as alphaconfig-7-existing-secret. Signed-off-by: Pierluigi Lenoci <pierluigi.lenoci@gmail.com>
The install test cannot pass without a real redis server running. The tpl() rendering is already verified by ct lint (helm template) across all existing ci/*.yaml files that touch deployment.yaml. Signed-off-by: Pierluigi Lenoci <pierluigi.lenoci@gmail.com>
Moulick
approved these changes
Jun 14, 2026
Moulick
left a comment
Moulick
left a comment
There was a problem hiding this comment.
Yes, this is exactly the patch I am running right now and will solve my issue :)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes #409.
When oauth2-proxy is deployed as a subchart, operators (e.g. Redis Operator, Bitnami Redis) generate secrets with structured names that depend on the release name or other chart values. Previously
sessionStorage.redis.existingSecretwas rendered verbatim, making it impossible to reference these dynamically-named secrets without hardcoding the full name.This PR wraps
existingSecretwithtpl()so Helm template expressions are evaluated at render time:Changes
helm/oauth2-proxy/templates/deployment.yaml— applytpltoexistingSecretin both the standalone/cluster secretKeyRef and the sentinel secretKeyRefhelm/oauth2-proxy/values.yaml— document tpl support in the field commenthelm/oauth2-proxy/Chart.yaml— minor version bump to 10.8.0Compatibility
Plain string values (e.g.
my-redis-secret) continue to work unchanged —tplis a no-op on non-template strings. Same pattern already used forconfig.existingSecretin_helpers.tpl.