Repository navigation
feat(helm): bump bundled oauth2-proxy subchart to ~10.7.0 - #2254
Merged
Merged
Conversation
Fixes kagent-dev#2239. Chart 7.0.0 hardcoded a 'v' prefix on the image tag (image: repo:v<tag>), mangling any custom image.tag that doesn't follow the vX.Y.Z convention - e.g. private-registry mirror tags like my-reg/kagent:oauth2-proxy-v7.6.0 rendered as :voauth2-proxy-v7.6.0 (ImagePullBackOff). oauth2-proxy chart 10.x renders the tag through the version helper without the prefix, and brings app v7.15.3 plus ~3 years of chart fixes. Compatibility of every key the kagent chart sets, verified by render: - config.existingSecret: same client-id/client-secret/cookie-secret keys (now gated on config.requiredSecretKeys, which defaults to all three) - extraArgs map / extraEnv / extraVolumes / extraVolumeMounts: unchanged - sessionStorage.type: cookie unchanged; the bitnami redis sub-chart was replaced by redis-ha (disabled by default), so the stale 'redis.enabled: false' default is dropped from values.yaml - service.portNumber: kagent already pins 4180 (upstream default is now 80) Verified: default render (quay.io/oauth2-proxy/oauth2-proxy:v7.15.3), custom registry/repository/tag renders verbatim, kagent extraArgs and custom-templates wiring intact, existingSecret env refs intact. Signed-off-by: Elihai Blomberg <[email protected]>
Contributor
There was a problem hiding this comment.
Pull request overview
Updates the bundled oauth2-proxy Helm dependency used by the main kagent chart to a newer upstream chart series, addressing the image tag override bug described in #2239 and aligning kagent’s oauth2-proxy defaults with the updated subchart.
Changes:
- Bump bundled
oauth2-proxysubchart version from~7.0.0to~10.7.0. - Remove the legacy
redis.enabled: falsevalues (old bitnami redis subchart), documenting cookie-session defaults and the newredis-ha.enabledswitch.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
helm/kagent/values.yaml |
Removes obsolete redis subchart disablement and documents cookie-session defaults / how to enable redis-ha. |
helm/kagent/Chart-template.yaml |
Bumps the oauth2-proxy dependency constraint to ~10.7.0. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
peterj
approved these changes
Jul 15, 2026
iplay88keys
approved these changes
Jul 15, 2026
Contributor
There was a problem hiding this comment.
Looks good to me. Validated the upgrade steps from https://github.com/oauth2-proxy/manifests/tree/main/helm/oauth2-proxy#upgrading-an-existing-release-to-a-new-major-version as well.
Collaborator
|
thanks @elihai-risk ! |
social4hyq
pushed a commit
to social4hyq/homebrew-core
that referenced
this pull request
Sep 20, 2026
kagent 0.10.0 Created-by: HarmonybrewBot Commit-by: HarmonybrewBot Merged-by: HarmonybrewBot Description: Created by `brew bump` --- Created with `brew bump-formula-pr`.<details> <summary>release notes</summary> <pre><!-- Release notes generated using configuration in .github/release.yml at v0.10.0 --> ## What's Changed ### Features * feat(streaming): configurable nginx, controller, and UI inactivity ti… by @yanivmn in kagent-dev/kagent#1973 * feat(helm): add controller service annotations by @anthonyhaussman in kagent-dev/kagent#2088 * feat: enable sharing of chat sessions by @onematchfox in kagent-dev/kagent#1935 * feat: substrate support for BYO and python runtimes for SandboxAgent CR by @jmhbh in kagent-dev/kagent#2043 * feat(substrate): bump agent substrate to 0.0.7 by @supreme-gg-gg in kagent-dev/kagent#2109 * feat(substrate): bump agent substrate to 0.0.8 by @jjamroga in kagent-dev/kagent#2140 * feat(helm/kagent): support deployment annotations by @anthonyhaussman in kagent-dev/kagent#2143 * feat: add nodeSelector support to agent helm charts by @the-mentor in kagent-dev/kagent#2145 * feat: expose icon, provider, documentation URL and version on agent A2A card by @QuentinBisson in kagent-dev/kagent#2188 * feat: add claude ACP sandbox target by @the-mentor in kagent-dev/kagent#2189 * feat(sandbox-agents): Store session state in `durableDir` volume for declarative sandbox agents by @jmhbh in kagent-dev/kagent#2171 * feat(helm): add UI HTTPRoute by @younsl in kagent-dev/kagent#2165 * feat(helm): bump bundled oauth2-proxy subchart to ~10.7.0 by @elihai-risk in kagent-dev/kagent#2254 * feat: default nodeSelector for agent deployments (--default-agent-node-selector) by @elihai-risk in kagent-dev/kagent#2259 * feat(helm): add podLabels for controller and UI pod templates by @elihai-risk in kagent-dev/kagent#2237 * feat(helm): add extraObjects for arbitrary manifests by @younsl in kagent-dev/kagent#2174 * feat(ui-test): Playwright ui tests foundation stage 0 by @cjlg-soloio in kagent-dev/kagent#2262 * feat: allow read-only shares to read A2A tasks by @QuentinBisson in kagent-dev/kagent#2191 * feat(controller): make Go (ADK) runtime agent image independently configurable by @QuentinBisson in kagent-dev/kagent#2021 * feat(helm): allow custom annotations on the default ModelConfig by @marians in kagent-dev/kagent#2201 * feat(ui-test): Playwright UI E2E suite — helpers + feature flows (stage 2) by @cjlg-soloio in kagent-dev/kagent#2264 * feat: serve A2A ListTasks from the task store by @QuentinBisson in kagent-dev/kagent#2187 * feat(models): add maxCompletionTokens for OpenAI by @anthonytwh in kagent-dev/kagent#2175 * feat(models): wire maxOutputTokens for native Gemini and Vertex by @anthonytwh in kagent-dev/kagent#2147 * feat: add envFrom support to agent deployment spec by @uncycler in kagent-dev/kagent#2321 * feat: add native AWS Bedrock Guardrails support to ModelConfig by @sanskar-singh-2403 in kagent-dev/kagent#2323 * feat(bedrock): configurable Bedrock read/connect timeout by @go-faustino in kagent-dev/kagent#2223 * feat: add deploymentAnnotations to agent deployment spec by @anthonyhaussman in kagent-dev/kagent#2359 * feat(helm/kagent): allow disabling default modelconfig by @anthonyhaussman in kagent-dev/kagent#2142 * feat(sts): send RFC 8707 resource and audience on token exchange by @QuentinBisson in kagent-dev/kagent#2106 * feat(sts): send RFC 8707 resource and audience on token exchange (Python) by @QuentinBisson in kagent-dev/kagent#2107 * Backport of 2407 (pg connection) to 0.10.x release by @supreme-gg-gg in kagent-dev/kagent#2399 * Backport 2409 (db session cleanup) to 0.10.x release by @supreme-gg-gg in kagent-dev/kagent#2403 * Backport of 2408 (s3 skills) to 0.10.x release by @supreme-gg-gg in kagent-dev/kagent#2405 * feat: configurable refresh interval for tool server controllers by @supreme-gg-gg in kagent-dev/kagent#2480 * feat: support file upload in agent chat by @supreme-gg-gg in kagent-dev/kagent#2429 ### Bug Fixes * fix(ui): chat interface overflows viewport causing input to be hidden below fold by @onematchfox in kagent-dev/kagent#2081 * fix(ui): avoid false stale chat send guard by @erauner12 in kagent-dev/kagent#2034 * fix(go-adk): extract system prompt from genai.GenerateContentConfig in Ollama and Bedrock model providers by @supreme-gg-gg in kagent-dev/kagent#2118 * fix(helm): support omitting image.registry in grafana-mcp chart by @michaelspinks in kagent-dev/kagent#2125 * fix(helm): support omitting image.registry in querydoc chart by @michaelspinks in kagent-dev/kagent#2124 * fix(security): patch CRITICAL/HIGH CVEs in golang-adk-full and app images by @jsonmp-k8 in kagent-dev/kagent#2133 * fix(go-adk): openai embeddings generation by @supreme-gg-gg in kagent-dev/kagent#2132 * fix(helm): omit empty repository segment in bundled image path by @michaelspinks in kagent-dev/kagent#2120 * fix: intermittent Postgres deadlock for concurrent memory searches by @supreme-gg-gg in kagent-dev/kagent#2146 * fix(deps): bump google-adk to 1.32.0 for Anthropic thinking blocks by @anxkhn in kagent-dev/kagent#2172 * fix: fix typos in part_converter comments by @mesutoezdil in kagent-dev/kagent#2195 * fix(adk): annotate serialize_metadata_value as str | dict by @anxkhn in kagent-dev/kagent#2173 * fix(ui): fix model name editing on the model config form by @Valyrian-Code in kagent-dev/kagent#1979 * fix: correct package comment in v1alpha2 groupversion_info by @mesutoezdil in kagent-dev/kagent#2183 * fix(crewai): unwrap Part before DataPart check so structured inputs are used by @anxkhn in kagent-dev/kagent#2231 * fix(helm): expose nodeSelector and tolerations for kagent-tools subchart by @the-mentor in kagent-dev/kagent#2213 * fix(helm): make the cluster DNS domain configurable by @shekhargit1912 in kagent-dev/kagent#2209 * fix: parse migration filenames the same way golang-migrate does by @mesutoezdil in kagent-dev/kagent#2194 * fix: build sandbox runtime outside QEMU emulation by @peterj in kagent-dev/kagent#2299 * fix: set kgateway.dev/a2a as appProtoco for BYO agents by @supreme-gg-gg in kagent-dev/kagent#2305 * fix(db): normalize agent name in memory vector search by @mesutoezdil in kagent-dev/kagent#2307 * fix(adk/bedrock): coerce nil tool-call args to empty object by @go-faustino in kagent-dev/kagent#2222 * fix: correct webhook typo in CLI help text by @tziyon31 in kagent-dev/kagent#2203 * fix(build): use AZURE_OPENAI_API_KEY env var name consistently by @mesutoezdil in kagent-dev/kagent#2310 * fix(security): scope task get, create, and delete to the owner by @mesutoezdil in kagent-dev/kagent#2265 * fix(adk): keep token refresh loop alive after a failed read by @mesutoezdil in kagent-dev/kagent#2330 * fix(acp-shim): drain child stdout during terminate to avoid teardown deadlock by @tomsen02 in kagent-dev/kagent#2338 * fix(adk): keep full session state when num_recent_events is set by @mesutoezdil in kagent-dev/kagent#2329 * fix(controller): wire up SessionSharesHandler in NewHandlers (#2363) by @onematchfox in kagent-dev/kagent#2420 * fix: ensure API key passthrough works for OpenAI embedding models by @onematchfox in kagent-dev/kagent#2494 * fix(adk): validate ask_user questions by @erauner12 in kagent-dev/kagent#2486 * Backport fix(golang-adk): resolve user identity from A2A call context to 0.10.x by @buravc in kagent-dev/kagent#2507 * fix(a2a): serve exact task reads from the persistent store by @erauner12 in kagent-dev/kagent#2484 * fix(ui): preserve post-login redirect target through `oauth2-proxy` sign-in by @onematchfox in kagent-dev/kagent#2532 ### Documentation * docs: fix duplicate descriptions and broken link in README by @mesutoezdil in kagent-dev/kagent#2068 * docs: fix typos and errors in component READMEs by @mesutoezdil in kagent-dev/kagent#2070 * docs: fix typos and list formatting in contributor docs by @mesutoezdil in kagent-dev/kagent#2069 * docs: replace outdated AutoGen reference in SECURITY.md by @mesutoezdil in kagent-dev/kagent#2110 * docs(python): fix kagent-langgraph README import to kagent.langgraph by @anxkhn in kagent-dev/kagent#2167 * docs(python): fix KAgentSession import path in kagent-openai README by @anxkhn in kagent-dev/kagent#2163 * docs: fix stale references and See merge request: Harmonybrew/homebrew-core!18335
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #2239.
What
Bump the bundled oauth2-proxy subchart
~7.0.0→~10.7.0(app v7.6.0 → v7.15.3).Why
Chart 7.0.0 hardcodes a
vprefix on the image tag (image: repo:v<tag>), mangling any customimage.tagthat doesn't follow thevX.Y.Zconvention — e.g. a private-registry mirror tagmy-reg/kagent:oauth2-proxy-v7.6.0renders as:voauth2-proxy-v7.6.0→ ImagePullBackOff. Orgs whose admission policies forbid quay.io must mirror the image, so tag overrides are common. Chart 10.x renders the tag without the hardcoded prefix, and brings ~3 years of chart fixes.Compatibility — every key the kagent chart sets, verified by render
config.existingSecretclient-id/client-secret/cookie-secretkeys (now gated onconfig.requiredSecretKeys, defaults to all three)extraArgsmap /extraEnv/extraVolumes(+Mounts)sessionStorage.type: cookieredissub-chart replaced byredis-ha, disabled by default — dropped the staleredis.enabled: falsefrom values)service.portNumber: 4180Verified renders
quay.io/oauth2-proxy/oauth2-proxy:v7.15.3--set image.registry=my-reg.example.com --set image.repository=mirrors/kagent --set image.tag=oauth2-proxy-v7.6.0→ renders verbatim ✅extraArgs(custom-templates-dir, skip-jwt-bearer-tokens, ...) andexistingSecretenv refs intact ✅🤖 Generated with Claude Code