open-webui/helm-charts
1
0
Fork 0
mirror of https://github.com/open-webui/helm-charts.git synced 2026-07-22 09:55:25 -04:00
Code Issues 13 Packages Projects Releases 10 Wiki Activity

[PR #226] [MERGED] feat(open-webui): Make it possible to define SSO OAuth secrets from Kubernetes Secrets #261

New Issue
Closed
opened 2026-02-15 19:17:06 -05:00 by yindo · 0 comments
yindo commented 2026-02-15 19:17:06 -05:00
Owner
Copy Link
Copy Source

📋 Pull Request Information

Original PR: https://github.com/open-webui/helm-charts/pull/226
Author: @mjtrangoni
Created: 4/25/2025
Status: ✅ Merged
Merged: 5/6/2025
Merged by: @westbrook-ai

Base: main ← Head: feature-secrets-oauth

📝 Commits (1)

  • f8ae1e0 feat(open-webui): Make it possible to define SSO OAuth secrets from k8s secrets

📊 Changes

5 files changed (+85 additions, -10 deletions)

View changed files

📝 charts/open-webui/Chart.yaml (+1 -1)
📝 charts/open-webui/README.md (+13 -5)
📝 charts/open-webui/templates/_helpers.tpl (+11 -0)
📝 charts/open-webui/templates/workload-manager.yaml (+32 -0)
📝 charts/open-webui/values.yaml (+28 -4)

📄 Description

Hi,

This PR extends the Open WebUI Helm chart to allow the SSO ClientSecret to be defined either directly in the values.yaml file or via a Kubernetes Secret for all supported providers.

Additionally, I’ve added validation logic in the helpers to ensure that when an SSO provider is enabled, either the clientSecret or the clientExistingSecret variable must be provided. If both are defined, the clientSecret will be ignored in favor of the clientExistingSecret.

The changes were tested locally using helm template, and the rendering works as expected.

For a given secret for Microsoft SSO,

kubectl create secret generic test --from-literal=mykey=REDACTED

values-test.yaml is,

# Disable bundled dependencies
ollama:
  enabled: false

pipelines:
  # -- Automatically install Pipelines chart to extend Open WebUI functionality using Pipelines: https://github.com/open-webui/pipelines
  enabled: false
  # -- This section can be used to pass required environment variables to your pipelines (e.g. Langfuse hostname)
  extraEnvVars: []

tika:
  # -- Automatically install Apache Tika to extend Open WebUI
  enabled: false

# -- A list of Ollama API endpoints. These can be added in lieu of automatically installing the Ollama Helm chart, or in addition to it.
ollamaUrls: []

# -- Disables taking Ollama Urls from `ollamaUrls`  list
ollamaUrlsFromExtraEnv: false

websocket:
  # -- Enables websocket support in Open WebUI with env `ENABLE_WEBSOCKET_SUPPORT`
  enabled: true
  # -- Specifies the websocket manager to use with env `WEBSOCKET_MANAGER`: redis (default)
  manager: redis
  # -- Deploys a redis
  redis:
    # -- Enable redis installation
    enabled: false

# -- Deploys a Redis cluster with subchart 'redis' from bitnami
redis-cluster:
  # -- Enable Redis installation
  enabled: true
  # -- Redis cluster name (recommended to be 'open-webui-redis')
  # - In this case, redis url will be 'redis://open-webui-redis-master:6379/0' or 'redis://[:<password>@]open-webui-redis-master:6379/0'
  fullnameOverride: open-webui-redis
  # -- Redis Authentication
  auth:
    # -- Enable Redis authentication (disabled by default). For your security, we strongly suggest that you switch to 'auth.enabled=true'
    enabled: false
  # -- Replica configuration for the Redis cluster
  replica:
    # -- Number of Redis replica instances
    replicaCount: 3


replicaCount: 2

serviceAccount:
  enable: true

ingress:
  enabled: true
  class: "external"
  # -- Use appropriate annotations for your Ingress controller, e.g., for NGINX:
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt
    nginx.ingress.kubernetes.io/affinity: "cookie"
    nginx.ingress.kubernetes.io/session-cookie-expires: "172800"
    nginx.ingress.kubernetes.io/session-cookie-max-age: "172800"
    nginx.ingress.kubernetes.io/session-cookie-name: "route"
  host: "REDACTED"
  tls: true

persistence:
  enabled: true
  # -- Sets the storage provider, availables values are `local`, `s3`, `gcs` or `azure`
  provider: azure
  azure:
    # -- Sets the endpoint URL for Azure Storage
    endpointUrl: "REDACTED"
    # -- Sets the container name for Azure Storage
    container: "data"
    key: "test"

# -- Enables the use of OpenAI APIs
enableOpenaiApi: true

# -- OpenAI base API URL to use. Defaults to the Pipelines service endpoint when Pipelines are enabled, and "https://api.openai.com/v1" if Pipelines are not enabled and this value is blank
openaiBaseApiUrl: "https://api.openai.com/v1"

# -- Env vars added to the Open WebUI deployment. Most up-to-date environment variables can be found here: https://docs.openwebui.com/getting-started/env-configuration/
extraEnvVars:
  # -- Default API key value for Pipelines. Should be updated in a production deployment, or be changed to the required API key if not using Pipelines
  # OpenAI config
  - name: OPENAI_API_KEY
    valueFrom:
      secretKeyRef:
        name: openai-api-key
        key: api-key
  - name: ENABLE_MODEL_FILTER
    value: "true"
  - name: MODEL_FILTER_LIST
    value: "gpt-4o-mini;gpt-4o-2024-08-06;ask_hr_policies"
  - name: DEFAULT_MODELS
    value: "gpt-4o-mini"
  - name: DEFAULT_LOCALE
    value: "en_US"
  - name: DEFAULT_USER_ROLE
    value: "user"
  # Blob storage key
  - name: AZURE_STORAGE_KEY
    valueFrom:
      secretKeyRef:
        name: azure-storage-account
        key: azure-account-key
  # Database URL
  - name: DATABASE_URL
    valueFrom:
      secretKeyRef:
        name: postgres-db-url
        key: postgres-url
  # Redis
  - name: WEBSOCKET_REDIS_URL
    value: "redis://infra-openwebui-redis.infra-openwebui.svc.cluster.local:26379/0"
  - name: WEBSOCKET_REDIS_MASTER_NAME
    value: "mymaster"
  - name: WEBSOCKET_REDIS_PASSWORD
    valueFrom:
      secretKeyRef:
        name: redis
        key: secret
  # Log Level
  - name: GLOBAL_LOG_LEVEL
    value: "debug"

sso:
  # -- **Enable SSO authentication globally** must enable to use SSO authentication
  # @section -- SSO Configuration
  enabled: true
  # -- Enable account creation when logging in with OAuth (distinct from regular signup)
  # @section -- SSO Configuration
  enableSignup: false
  # -- Allow logging into accounts that match email from OAuth provider (considered insecure)
  # @section -- SSO Configuration
  mergeAccountsByEmail: false
  # -- Enable OAuth role management through access token roles claim
  # @section -- SSO Configuration
  enableRoleManagement: false
  # -- Enable OAuth group management through access token groups claim
  # @section -- SSO Configuration
  enableGroupManagement: false

  microsoft:
    # -- Enable Microsoft OAuth
    enabled: true
    # -- Microsoft OAuth client ID
    clientId: "REDACTED"
    # -- Microsoft tenant ID - use 9188040d-6c67-4c5b-b112-36a304b66dad for personal accounts
    tenantId: "REDACTED"
    clientSecret: "test"
    clientExistingSecret: "test"
    clientExistingSecretKey: "mykey"

  roleManagement:
    # -- The claim that contains the roles (can be nested, e.g., user.roles)
    # @section -- Role management configuration
    rolesClaim: "roles"
    # -- Comma-separated list of roles allowed to log in (receive open webui role user)
    # @section -- Role management configuration
    allowedRoles: ""
    # -- Comma-separated list of roles allowed to log in as admin (receive open webui role admin)
    # @section -- Role management configuration
    adminRoles: ""

  groupManagement:
    # -- The claim that contains the groups (can be nested, e.g., user.memberOf)
    # @section -- SSO Configuration
    groupsClaim: "groups"

  trustedHeader:
    # -- Enable trusted header authentication
    # @section -- SSO trusted header authentication
    enabled: false
    # -- Header containing the user's email address
    # @section -- SSO trusted header authentication
    emailHeader: ""
    # -- Header containing the user's name (optional, used for new user creation)
    # @section -- SSO trusted header authentication
    nameHeader: ""

# -- Postgresql configuration (see. https://artifacthub.io/packages/helm/bitnami/postgresql)
postgresql:
  enabled: false

And rendering with helm template,

helm template . --values values-test.yaml > redacted-secrets.yaml

Now with default empty values for clientExistingSecret and clientExistingSecretKey,

  microsoft:
    # -- Enable Microsoft OAuth
    enabled: true
    # -- Microsoft OAuth client ID
    clientId: "REDACTED"
    # -- Microsoft tenant ID - use 9188040d-6c67-4c5b-b112-36a304b66dad for personal accounts
    tenantId: "REDACTED"
    clientSecret: "test"
    clientExistingSecret: ""
    clientExistingSecretKey: ""

helm template . --values values-test.yaml > redacted-raw.yaml

The difference between the two cases is,

diff -u redacted-secrets.yaml redacted-raw.yaml
--- redacted-secrets.yaml       2025-05-06 08:25:24
+++ redacted-raw.yaml   2025-05-06 08:26:04
@@ -509,10 +509,7 @@
         - name: "MICROSOFT_CLIENT_ID"
           value: "REDACTED"
         - name: "MICROSOFT_CLIENT_SECRET"
-          valueFrom:
-            secretKeyRef:
-              name: "test"
-              key: "mykey"
+          value: "test"
         - name: "MICROSOFT_CLIENT_TENANT_ID"
           value: "REDACTED"
         - name: OPENAI_API_KEY

and this repeats for every provider.

Please let me know if you approve of this extension. I’m happy to contribute further to this project!

Thank you!

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/open-webui/helm-charts/pull/226 **Author:** [@mjtrangoni](https://github.com/mjtrangoni) **Created:** 4/25/2025 **Status:** ✅ Merged **Merged:** 5/6/2025 **Merged by:** [@westbrook-ai](https://github.com/westbrook-ai) **Base:** `main` ← **Head:** `feature-secrets-oauth` --- ### 📝 Commits (1) - [`f8ae1e0`](https://github.com/open-webui/helm-charts/commit/f8ae1e036e0decffdc4ea65f6716c6b6eb8dc2c7) feat(open-webui): Make it possible to define SSO OAuth secrets from k8s secrets ### 📊 Changes **5 files changed** (+85 additions, -10 deletions) <details> <summary>View changed files</summary> 📝 `charts/open-webui/Chart.yaml` (+1 -1) 📝 `charts/open-webui/README.md` (+13 -5) 📝 `charts/open-webui/templates/_helpers.tpl` (+11 -0) 📝 `charts/open-webui/templates/workload-manager.yaml` (+32 -0) 📝 `charts/open-webui/values.yaml` (+28 -4) </details> ### 📄 Description Hi, This PR extends the Open WebUI Helm chart to allow the SSO ClientSecret to be defined either directly in the `values.yaml` file or via a Kubernetes Secret for all supported providers. Additionally, I’ve added validation logic in the helpers to ensure that when an SSO provider is enabled, either the `clientSecret` or the `clientExistingSecret` variable must be provided. If both are defined, the `clientSecret` will be ignored in favor of the `clientExistingSecret`. The changes were tested locally using helm template, and the rendering works as expected. For a given secret for Microsoft SSO, ```console kubectl create secret generic test --from-literal=mykey=REDACTED ``` `values-test.yaml` is, ```yaml # Disable bundled dependencies ollama: enabled: false pipelines: # -- Automatically install Pipelines chart to extend Open WebUI functionality using Pipelines: https://github.com/open-webui/pipelines enabled: false # -- This section can be used to pass required environment variables to your pipelines (e.g. Langfuse hostname) extraEnvVars: [] tika: # -- Automatically install Apache Tika to extend Open WebUI enabled: false # -- A list of Ollama API endpoints. These can be added in lieu of automatically installing the Ollama Helm chart, or in addition to it. ollamaUrls: [] # -- Disables taking Ollama Urls from `ollamaUrls` list ollamaUrlsFromExtraEnv: false websocket: # -- Enables websocket support in Open WebUI with env `ENABLE_WEBSOCKET_SUPPORT` enabled: true # -- Specifies the websocket manager to use with env `WEBSOCKET_MANAGER`: redis (default) manager: redis # -- Deploys a redis redis: # -- Enable redis installation enabled: false # -- Deploys a Redis cluster with subchart 'redis' from bitnami redis-cluster: # -- Enable Redis installation enabled: true # -- Redis cluster name (recommended to be 'open-webui-redis') # - In this case, redis url will be 'redis://open-webui-redis-master:6379/0' or 'redis://[:<password>@]open-webui-redis-master:6379/0' fullnameOverride: open-webui-redis # -- Redis Authentication auth: # -- Enable Redis authentication (disabled by default). For your security, we strongly suggest that you switch to 'auth.enabled=true' enabled: false # -- Replica configuration for the Redis cluster replica: # -- Number of Redis replica instances replicaCount: 3 replicaCount: 2 serviceAccount: enable: true ingress: enabled: true class: "external" # -- Use appropriate annotations for your Ingress controller, e.g., for NGINX: annotations: cert-manager.io/cluster-issuer: letsencrypt nginx.ingress.kubernetes.io/affinity: "cookie" nginx.ingress.kubernetes.io/session-cookie-expires: "172800" nginx.ingress.kubernetes.io/session-cookie-max-age: "172800" nginx.ingress.kubernetes.io/session-cookie-name: "route" host: "REDACTED" tls: true persistence: enabled: true # -- Sets the storage provider, availables values are `local`, `s3`, `gcs` or `azure` provider: azure azure: # -- Sets the endpoint URL for Azure Storage endpointUrl: "REDACTED" # -- Sets the container name for Azure Storage container: "data" key: "test" # -- Enables the use of OpenAI APIs enableOpenaiApi: true # -- OpenAI base API URL to use. Defaults to the Pipelines service endpoint when Pipelines are enabled, and "https://api.openai.com/v1" if Pipelines are not enabled and this value is blank openaiBaseApiUrl: "https://api.openai.com/v1" # -- Env vars added to the Open WebUI deployment. Most up-to-date environment variables can be found here: https://docs.openwebui.com/getting-started/env-configuration/ extraEnvVars: # -- Default API key value for Pipelines. Should be updated in a production deployment, or be changed to the required API key if not using Pipelines # OpenAI config - name: OPENAI_API_KEY valueFrom: secretKeyRef: name: openai-api-key key: api-key - name: ENABLE_MODEL_FILTER value: "true" - name: MODEL_FILTER_LIST value: "gpt-4o-mini;gpt-4o-2024-08-06;ask_hr_policies" - name: DEFAULT_MODELS value: "gpt-4o-mini" - name: DEFAULT_LOCALE value: "en_US" - name: DEFAULT_USER_ROLE value: "user" # Blob storage key - name: AZURE_STORAGE_KEY valueFrom: secretKeyRef: name: azure-storage-account key: azure-account-key # Database URL - name: DATABASE_URL valueFrom: secretKeyRef: name: postgres-db-url key: postgres-url # Redis - name: WEBSOCKET_REDIS_URL value: "redis://infra-openwebui-redis.infra-openwebui.svc.cluster.local:26379/0" - name: WEBSOCKET_REDIS_MASTER_NAME value: "mymaster" - name: WEBSOCKET_REDIS_PASSWORD valueFrom: secretKeyRef: name: redis key: secret # Log Level - name: GLOBAL_LOG_LEVEL value: "debug" sso: # -- **Enable SSO authentication globally** must enable to use SSO authentication # @section -- SSO Configuration enabled: true # -- Enable account creation when logging in with OAuth (distinct from regular signup) # @section -- SSO Configuration enableSignup: false # -- Allow logging into accounts that match email from OAuth provider (considered insecure) # @section -- SSO Configuration mergeAccountsByEmail: false # -- Enable OAuth role management through access token roles claim # @section -- SSO Configuration enableRoleManagement: false # -- Enable OAuth group management through access token groups claim # @section -- SSO Configuration enableGroupManagement: false microsoft: # -- Enable Microsoft OAuth enabled: true # -- Microsoft OAuth client ID clientId: "REDACTED" # -- Microsoft tenant ID - use 9188040d-6c67-4c5b-b112-36a304b66dad for personal accounts tenantId: "REDACTED" clientSecret: "test" clientExistingSecret: "test" clientExistingSecretKey: "mykey" roleManagement: # -- The claim that contains the roles (can be nested, e.g., user.roles) # @section -- Role management configuration rolesClaim: "roles" # -- Comma-separated list of roles allowed to log in (receive open webui role user) # @section -- Role management configuration allowedRoles: "" # -- Comma-separated list of roles allowed to log in as admin (receive open webui role admin) # @section -- Role management configuration adminRoles: "" groupManagement: # -- The claim that contains the groups (can be nested, e.g., user.memberOf) # @section -- SSO Configuration groupsClaim: "groups" trustedHeader: # -- Enable trusted header authentication # @section -- SSO trusted header authentication enabled: false # -- Header containing the user's email address # @section -- SSO trusted header authentication emailHeader: "" # -- Header containing the user's name (optional, used for new user creation) # @section -- SSO trusted header authentication nameHeader: "" # -- Postgresql configuration (see. https://artifacthub.io/packages/helm/bitnami/postgresql) postgresql: enabled: false ``` And rendering with helm template, ```console helm template . --values values-test.yaml > redacted-secrets.yaml ``` Now with default empty values for clientExistingSecret and clientExistingSecretKey, ```yaml microsoft: # -- Enable Microsoft OAuth enabled: true # -- Microsoft OAuth client ID clientId: "REDACTED" # -- Microsoft tenant ID - use 9188040d-6c67-4c5b-b112-36a304b66dad for personal accounts tenantId: "REDACTED" clientSecret: "test" clientExistingSecret: "" clientExistingSecretKey: "" ``` ```console helm template . --values values-test.yaml > redacted-raw.yaml ``` The difference between the two cases is, ```bash diff -u redacted-secrets.yaml redacted-raw.yaml --- redacted-secrets.yaml 2025-05-06 08:25:24 +++ redacted-raw.yaml 2025-05-06 08:26:04 @@ -509,10 +509,7 @@ - name: "MICROSOFT_CLIENT_ID" value: "REDACTED" - name: "MICROSOFT_CLIENT_SECRET" - valueFrom: - secretKeyRef: - name: "test" - key: "mykey" + value: "test" - name: "MICROSOFT_CLIENT_TENANT_ID" value: "REDACTED" - name: OPENAI_API_KEY ``` and this repeats for every provider. Please let me know if you approve of this extension. I’m happy to contribute further to this project! Thank you! --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
yindo added the pull-request label 2026-02-15 19:17:07 -05:00
yindo closed this issue 2026-02-15 19:17:07 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
awaiting-user-feedback
awaiting-user-feedback
bug
bug
documentation
enhancement
good first issue
help wanted
pull-request
Mirrored from GitHub Pull Request
 question
upstream
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: open-webui/helm-charts#261
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?