Repository navigation
helm: bump bundled oauth2-proxy subchart (7.0.0 → 10.x) — image tag override is mangled #2239
Description
The kagent chart bundles oauth2-proxy chart 7.0.0 (appVersion 7.6.0). That version's deployment template hardcodes a v prefix on the image tag:
image: "{{ .Values.image.repository }}:v{{ include "oauth2-proxy.version" . }}"so any custom image.tag that doesn't follow the vX.Y.Z convention gets mangled — e.g. a private-registry mirror tag my-repo/kagent:oauth2-proxy-v7.6.0 renders as :voauth2-proxy-v7.6.0 (ImagePullBackOff). Many orgs must mirror images into a private registry (admission policies forbid quay.io), so tag overrides are common.
Upstream oauth2-proxy/manifests already fixed this — current chart (10.7.0) renders the tag via the version helper without the hardcoded prefix:
image: "{{ tpl .Values.image.registry $ | default ... }}/{{ .Values.image.repository }}:{{ include "oauth2-proxy.version" . }}"Bumping the bundled subchart to 10.x would fix this and pick up ~3 years of fixes. Happy to open a PR if maintainers agree on the target version / values migration.
Context: we hit this deploying kagent 0.9.11 on EKS with ECR-mirrored images and had to patch the vendored subchart. Related PRs from the same deployment: #2237 (pod labels), #2238 (UI Ingress).
🤖 Generated with Claude Code
Activity
peterj commentedon Jul 15, 2026
I am fine with bumping the version to 10.x assuming we don't break the functionality. Would you like to create a PR for this?
elihai-risk commentedon Jul 15, 2026
Opened #2254 with the bump (
~7.0.0→~10.7.0, app v7.6.0 → v7.15.3).Compatibility of every key the kagent chart sets was verified by render —
config.existingSecretkeys unchanged (now gated onconfig.requiredSecretKeys, defaulting to all three),extraArgs/extraEnv/extraVolumesunchanged, cookie sessions unchanged (the bitnamiredissub-chart becameredis-ha, disabled by default), andservice.portNumber: 4180still pinned by the kagent values (upstream default moved to 80).Confirmed the motivating scenario now renders verbatim:
image.tag=oauth2-proxy-v7.6.0→my-reg.example.com/mirrors/kagent:oauth2-proxy-v7.6.0(no morevmangling).feat(helm): bump bundled oauth2-proxy subchart to ~10.7.0 (kagent-dev…